* Benefits of cooperation
He describes the practical benefits of a very public campaign of open cooperation with law enforcement that he instituted at a credit union when he was hired to improve security.
In the first of this two-part series, Michael Meline, MSIA, CISSP, CFE, CEH described a dreadful case of incompetence at a bank where the manager refused to cooperate with law enforcement and ended up being fired after a number of thefts were discovered from customer accounts. In today’s sequel, he describes the practical benefits of a very public campaign of open cooperation with law enforcement that he instituted at a credit union when he was hired to improve security. For ease of use in teaching and in security awareness, Meline has used the third person when describing himself. All of the work that follows is Meline’s with minor edits.
* * *
When the Credit Union (CU) hired its first security manager, he had a plan to reduce crime: since criminals talk to one another, the CU would benefit from an aggressive campaign of “hammering” people who perpetrated crimes against the credit union. He was constantly seen escorting law enforcement officials (LEO) to his office and later walking out with the officers – and a criminal in handcuffs. He capitalized on crime deterrence, a well-known phrase in the law enforcement and computer security industry that means that if everyone knows that the CU will hold criminals accountable for committing crimes, crime will be reduced.
The CU reports every crime to law enforcement and follows the crime through the courts to recover all losses. When an officer comes in to take a report, the officer is provided with a thoroughly investigated case with all the evidence properly obtained, correctly safeguarded in a chain of custody, and clearly labeled and organized.
When the case goes to court, the CU sends appropriate employees to testify against the accused. The CU also asks the court to order restitution for the stolen money and for the costs associated with the investigation and account maintenance. The courts usually order that the person pay back all stolen money and between $350 and $750 for the costs associated with the investigation. Based on interviews with the subjects, these penalties usually hurt the criminal a great deal.
Over the last two years, the CU has developed a very strong relationship with the law enforcement community. These long-term relationships generally result in the CU’s receiving advanced alerts in the event of potential crimes. In addition, many LEOs coming in and out of the CU both for investigations and also as members; there are also many members of the CU who are involved in the courts. Even the probation department (the ones who recover restitution and write the pre-sentence reports) work well with the CU. As Morgan Wright says in his chapter in the Computer Security Handbook, 4th Edition, “The importance of a prior relationship with law enforcement and the local prosecutor cannot be overstated.”
This CU frequently reports crimes to law enforcement and has seen a decrease of crime of about 50%. The CU has benefited from the publicity involved in the cases; members (and criminals) understand that the CU will not tolerate crime.
The CU has seen, first hand, that the reasons cited for failure to report incidents to law enforcement are simply myths.
Every reader would do well to discuss these issues with management to ensure that their organization builds a strong relationship with local, state, and federal law enforcement organizations.
[MK adds (with the full concurrence of the author): one of the ways to bond with law enforcement is to join and support your local InfraGard chapter. You can go online to find the nearest chapter to your location.]
* * *
Meline, MSIA, CISSP, CFE, CEH is president of ArizonaFIRST Coalition, which is dedicated to enhancing “the ability of member institutions to respond and recover from incidents affecting the financial sector by fostering partnerships and collaboration between public sector agencies, public utilities, service providers, volunteer agencies and infrastructure providers.” The organization’s Web site has a number of valuable links for emergency preparedness on its home page. In addition, Meline serves as Steering Committee Chairman at the Community Justice Boards of the Greater Yuma Area and is a member of InfraGard. He welcomes your comments.
* * * ADVERTISEMENT * * *
On another note: join me online for three courses in October and November 2009 under the auspices of Security University. We will be meeting via conference call on Saturdays and Sundays for six hours each day and then for three hours in the evenings of Monday through Thursday. The courses are “Introduction to IA for Non-Technical Managers,” “Management of IA,” and “Cyberlaw for IA Professionals“. Each course will have the lectures and discussions recorded and available for download – and there will be a dedicated discussion group online for participants to discuss points and questions. See you online!
