© link associates international 2011 ‘7/7’ – selected learning points roger kember link...

65
© LINK Associates International 2011 7/7’ 7/7’ – selected learning – selected learning points points Roger Kember Roger Kember LINK Associates International LINK Associates International 07545 388269 07545 388269 NEPIC Business Security NEPIC Business Security Event Event

Upload: leo-fox

Post on 20-Jan-2016

214 views

Category:

Documents


0 download

TRANSCRIPT

Page 1: © LINK Associates International 2011 ‘7/7’ – selected learning points Roger Kember LINK Associates International 07545 388269 NEPIC Business Security Event

© LINK Associates International 2011

‘‘7/7’ 7/7’ – selected learning points– selected learning points

Roger Kember Roger Kember LINK Associates InternationalLINK Associates International

07545 38826907545 388269

NEPIC Business Security EventNEPIC Business Security Event

Page 2: © LINK Associates International 2011 ‘7/7’ – selected learning points Roger Kember LINK Associates International 07545 388269 NEPIC Business Security Event

© LINK Associates International 2011

‘‘7/7’ – selected learning points7/7’ – selected learning points

Improving Crisis Management Reviewing your plans Incorporating into exercises Selling to the Board

Page 3: © LINK Associates International 2011 ‘7/7’ – selected learning points Roger Kember LINK Associates International 07545 388269 NEPIC Business Security Event

© LINK Associates International 2011

‘‘7/7’ – selected learning points7/7’ – selected learning points

H & S warning

( PD 25111:Guidance on Human Aspects of Business Continuity )

Page 4: © LINK Associates International 2011 ‘7/7’ – selected learning points Roger Kember LINK Associates International 07545 388269 NEPIC Business Security Event

© LINK Associates International 2011

‘‘7/7’ – selected learning points7/7’ – selected learning points

- an insider’s view

Page 5: © LINK Associates International 2011 ‘7/7’ – selected learning points Roger Kember LINK Associates International 07545 388269 NEPIC Business Security Event

© LINK Associates International 2011

learning point 1learning point 1

confusionconfusion

&&

unstructured communications unstructured communications

are at a maximum at the start of a are at a maximum at the start of a major incidentmajor incident

Page 6: © LINK Associates International 2011 ‘7/7’ – selected learning points Roger Kember LINK Associates International 07545 388269 NEPIC Business Security Event

© LINK Associates International 2011

the 5 incidents of ‘7/7’the 5 incidents of ‘7/7’

Page 7: © LINK Associates International 2011 ‘7/7’ – selected learning points Roger Kember LINK Associates International 07545 388269 NEPIC Business Security Event

© LINK Associates International 2011

learning point 2learning point 2

dealing with incidents dealing with incidents

occurring at the same occurring at the same

timetime oror placeplace

Page 8: © LINK Associates International 2011 ‘7/7’ – selected learning points Roger Kember LINK Associates International 07545 388269 NEPIC Business Security Event

© LINK Associates International 2011

M.P.S. - 9M.P.S. - 9amam Thursday 7 July 2005 Thursday 7 July 2005

Central Command Complex ‘Major Incident’ declared call cascade (inc. COBR) GOLD GROUP called MPS in Major Incident mode

Page 9: © LINK Associates International 2011 ‘7/7’ – selected learning points Roger Kember LINK Associates International 07545 388269 NEPIC Business Security Event

© LINK Associates International 2011

learning point 3learning point 3

in a crisisin a crisis

the organisation needs to go the organisation needs to go into into

crisis response modecrisis response mode

Page 10: © LINK Associates International 2011 ‘7/7’ – selected learning points Roger Kember LINK Associates International 07545 388269 NEPIC Business Security Event

© LINK Associates International 2011

incidentincident

Cabinet Office Briefing RoomCabinet Office Briefing Room

CT Crisis Management in the U.KCT Crisis Management in the U.K

Gold Gold -- SilverSilver -- BronzeBronze

Strategic Co-ordinating GroupStrategic Co-ordinating Group

Page 11: © LINK Associates International 2011 ‘7/7’ – selected learning points Roger Kember LINK Associates International 07545 388269 NEPIC Business Security Event

© LINK Associates International 2011

ChairChair (P.M, Home Sec. or H.O senior civil servant) (P.M, Home Sec. or H.O senior civil servant)

Home Office, FHome Office, F&&CO, MoD, Special Forces,CO, MoD, Special Forces,HMT, Government Information Co-HMT, Government Information Co-ordination Service(GICS), Secret ordination Service(GICS), Secret Intelligence Service, Security Service & Intelligence Service, Security Service & ACPO(Terrorism & Allied Matters)ACPO(Terrorism & Allied Matters)

Devolved Administrations,Devolved Administrations,Territorial Departments (e.g. DH, DEFRA, DfT )Territorial Departments (e.g. DH, DEFRA, DfT )

Minister for LondonMinister for London

ChairChair (P.M, Home Sec. or H.O senior civil servant) (P.M, Home Sec. or H.O senior civil servant)

Home Office, FHome Office, F&&CO, MoD, Special Forces,CO, MoD, Special Forces,HMT, Government Information Co-HMT, Government Information Co-ordination Service(GICS), Secret ordination Service(GICS), Secret Intelligence Service, Security Service & Intelligence Service, Security Service & ACPO(Terrorism & Allied Matters)ACPO(Terrorism & Allied Matters)

Devolved Administrations,Devolved Administrations,Territorial Departments (e.g. DH, DEFRA, DfT )Territorial Departments (e.g. DH, DEFRA, DfT )

Minister for LondonMinister for London

CABINET OFFICE BRIEFING ROOM (COBR) CABINET OFFICE BRIEFING ROOM (COBR) membershipmembership

ALWAYSALWAYSALWAYSALWAYS

USUALLYUSUALLYUSUALLYUSUALLY

LONDONLONDONLONDONLONDON

Page 12: © LINK Associates International 2011 ‘7/7’ – selected learning points Roger Kember LINK Associates International 07545 388269 NEPIC Business Security Event

© LINK Associates International 2011

COBR – Black September 1970COBR – Black September 1970

Page 13: © LINK Associates International 2011 ‘7/7’ – selected learning points Roger Kember LINK Associates International 07545 388269 NEPIC Business Security Event

© LINK Associates International 2011

Iranian Embassy SiegeIranian Embassy Siege

Page 14: © LINK Associates International 2011 ‘7/7’ – selected learning points Roger Kember LINK Associates International 07545 388269 NEPIC Business Security Event

© LINK Associates International 2011

““The New Reality”The New Reality”

Page 15: © LINK Associates International 2011 ‘7/7’ – selected learning points Roger Kember LINK Associates International 07545 388269 NEPIC Business Security Event

© LINK Associates International 2011

COBR ‘Concept of Operations’COBR ‘Concept of Operations’

from hostage negotiations tofrom hostage negotiations to

‘‘cascade failures’cascade failures’

Page 16: © LINK Associates International 2011 ‘7/7’ – selected learning points Roger Kember LINK Associates International 07545 388269 NEPIC Business Security Event

© LINK Associates International 2011

learning point 4learning point 4

move at the speed of the crisis- move at the speed of the crisis-

not the speed of the organisationnot the speed of the organisation

Page 17: © LINK Associates International 2011 ‘7/7’ – selected learning points Roger Kember LINK Associates International 07545 388269 NEPIC Business Security Event

© LINK Associates International 2011

COBRCOBR

cabinetoffice.gov.uk/ukresilience

Conference Room

PoliceRoom

Page 18: © LINK Associates International 2011 ‘7/7’ – selected learning points Roger Kember LINK Associates International 07545 388269 NEPIC Business Security Event

© LINK Associates International 2011

learning point 5learning point 5

when the game changeswhen the game changes

- change your game- change your game

Page 19: © LINK Associates International 2011 ‘7/7’ – selected learning points Roger Kember LINK Associates International 07545 388269 NEPIC Business Security Event

© LINK Associates International 2011

COBR trainingCOBR training

an enlarged training programme for staff

national exercise programme for Silvers, Golds, civil servants & Ministers

Page 20: © LINK Associates International 2011 ‘7/7’ – selected learning points Roger Kember LINK Associates International 07545 388269 NEPIC Business Security Event

© LINK Associates International 2011

learning point 6learning point 6

training & exercisingtraining & exercising

improve performanceimprove performance

Page 21: © LINK Associates International 2011 ‘7/7’ – selected learning points Roger Kember LINK Associates International 07545 388269 NEPIC Business Security Event

© LINK Associates International 2011

‘‘9/11’ Commission9/11’ Commission

“ A failure of imagination”

Page 22: © LINK Associates International 2011 ‘7/7’ – selected learning points Roger Kember LINK Associates International 07545 388269 NEPIC Business Security Event

© LINK Associates International 2011

Tokyo - 20.March 1995Tokyo - 20.March 1995

13 dead 50 severely injured 1000s vision impairment

Page 23: © LINK Associates International 2011 ‘7/7’ – selected learning points Roger Kember LINK Associates International 07545 388269 NEPIC Business Security Event

© LINK Associates International 2011

Ex. OSIRIS II – 7.September 2003Ex. OSIRIS II – 7.September 2003

Page 24: © LINK Associates International 2011 ‘7/7’ – selected learning points Roger Kember LINK Associates International 07545 388269 NEPIC Business Security Event

© LINK Associates International 2011

learning point 7learning point 7

predictablepredictable

- but not predicted- but not predicted

Page 25: © LINK Associates International 2011 ‘7/7’ – selected learning points Roger Kember LINK Associates International 07545 388269 NEPIC Business Security Event

© LINK Associates International 2011

learning point 8learning point 8

prepareprepare

andand

be preparedbe prepared

Page 26: © LINK Associates International 2011 ‘7/7’ – selected learning points Roger Kember LINK Associates International 07545 388269 NEPIC Business Security Event

© LINK Associates International 2011

2 weeks before ‘7/7’2 weeks before ‘7/7’

‘Hanover Weekend’ seminar

Put the SIO (Senior Investigating Officer) in the ‘virtual hot seat’

Psychologically prepared Some mental pre-planning

Page 27: © LINK Associates International 2011 ‘7/7’ – selected learning points Roger Kember LINK Associates International 07545 388269 NEPIC Business Security Event

© LINK Associates International 2011

learning point 9learning point 9

putting someone in the putting someone in the virtual hot seat virtual hot seat increases their increases their

motivation to investmotivation to invest

Page 28: © LINK Associates International 2011 ‘7/7’ – selected learning points Roger Kember LINK Associates International 07545 388269 NEPIC Business Security Event

© LINK Associates International 2011

New Reality – new thinkingNew Reality – new thinking

Page 29: © LINK Associates International 2011 ‘7/7’ – selected learning points Roger Kember LINK Associates International 07545 388269 NEPIC Business Security Event

© LINK Associates International 2011

CT presumption 1CT presumption 1

an incident that couldcould be terrorist related WILLWILL be treated as terrorist related until the contrary is proved

Page 30: © LINK Associates International 2011 ‘7/7’ – selected learning points Roger Kember LINK Associates International 07545 388269 NEPIC Business Security Event

© LINK Associates International 2011

CT presumption 2CT presumption 2

a terrorist incident will treated as the firstfirst of a SERIESSERIES of such incidents until the contrary is proved

Page 31: © LINK Associates International 2011 ‘7/7’ – selected learning points Roger Kember LINK Associates International 07545 388269 NEPIC Business Security Event

© LINK Associates International 2011

COBR – 11am, 7.July 2005COBR – 11am, 7.July 2005

Three unanswered questions

Page 32: © LINK Associates International 2011 ‘7/7’ – selected learning points Roger Kember LINK Associates International 07545 388269 NEPIC Business Security Event

© LINK Associates International 2011

COBR – 11am, 7.July 2005COBR – 11am, 7.July 2005

Three unanswered questions:

1) WhoWho was behind this attack?

Page 33: © LINK Associates International 2011 ‘7/7’ – selected learning points Roger Kember LINK Associates International 07545 388269 NEPIC Business Security Event

© LINK Associates International 2011

COBR – 11am, 7.July 2005COBR – 11am, 7.July 2005

Three unanswered questions:

1)Who was behind this attack?

2)2)WhenWhen would the next attack be?

Page 34: © LINK Associates International 2011 ‘7/7’ – selected learning points Roger Kember LINK Associates International 07545 388269 NEPIC Business Security Event

© LINK Associates International 2011

COBR – 11am, 7.July 2005COBR – 11am, 7.July 2005

Three unanswered questions:

1)Who was behind this attack?

2)When would the next attack be?

3)3)WhereWhere would the next attack be?

Page 35: © LINK Associates International 2011 ‘7/7’ – selected learning points Roger Kember LINK Associates International 07545 388269 NEPIC Business Security Event

© LINK Associates International 2011

COBR – 11am, 7.July 2005COBR – 11am, 7.July 2005

there were no answers

Page 36: © LINK Associates International 2011 ‘7/7’ – selected learning points Roger Kember LINK Associates International 07545 388269 NEPIC Business Security Event

© LINK Associates International 2011

learning point learning point

everyone must learn to everyone must learn to deal with uncertaintydeal with uncertainty

Page 37: © LINK Associates International 2011 ‘7/7’ – selected learning points Roger Kember LINK Associates International 07545 388269 NEPIC Business Security Event

© LINK Associates International 2011

learning point 10learning point 10

everyone must learn to deal everyone must learn to deal with uncertaintywith uncertainty

- and still carry on- and still carry on

Page 38: © LINK Associates International 2011 ‘7/7’ – selected learning points Roger Kember LINK Associates International 07545 388269 NEPIC Business Security Event

© LINK Associates International 2011

COBR – 11am, 7.July 2005COBR – 11am, 7.July 2005

the press release

Page 39: © LINK Associates International 2011 ‘7/7’ – selected learning points Roger Kember LINK Associates International 07545 388269 NEPIC Business Security Event

© LINK Associates International 2011

learning point learning point

take all reasonable steps to take all reasonable steps to find outfind out

put H put H && S first S first undertake a R.A and undertake a R.A and

document itdocument it

Page 40: © LINK Associates International 2011 ‘7/7’ – selected learning points Roger Kember LINK Associates International 07545 388269 NEPIC Business Security Event

© LINK Associates International 2011

learning point 11learning point 11

take all reasonable steps to find outtake all reasonable steps to find out

put H put H && S first S first undertake a R.A and document itundertake a R.A and document it

apply ‘CT presumption 3’apply ‘CT presumption 3’

Page 41: © LINK Associates International 2011 ‘7/7’ – selected learning points Roger Kember LINK Associates International 07545 388269 NEPIC Business Security Event

© LINK Associates International 2011

CT presumption 3CT presumption 3

the UK Government will

not

do the terrorists job for them

Page 42: © LINK Associates International 2011 ‘7/7’ – selected learning points Roger Kember LINK Associates International 07545 388269 NEPIC Business Security Event

© LINK Associates International 2011

7.July 2005 7.July 2005

the 1st press

conference

Page 43: © LINK Associates International 2011 ‘7/7’ – selected learning points Roger Kember LINK Associates International 07545 388269 NEPIC Business Security Event

© LINK Associates International 2011

7.July 2005- press conference 7.July 2005- press conference

Page 44: © LINK Associates International 2011 ‘7/7’ – selected learning points Roger Kember LINK Associates International 07545 388269 NEPIC Business Security Event

© LINK Associates International 2011

learning point 12 learning point 12

seen to be in controlseen to be in control reassure all stakeholdersreassure all stakeholders no info. = no questionsno info. = no questions

Page 45: © LINK Associates International 2011 ‘7/7’ – selected learning points Roger Kember LINK Associates International 07545 388269 NEPIC Business Security Event

© LINK Associates International 2011

7.July 20057.July 2005

Page 46: © LINK Associates International 2011 ‘7/7’ – selected learning points Roger Kember LINK Associates International 07545 388269 NEPIC Business Security Event

© LINK Associates International 2011

Learning point Learning point

• authoritative• conference in full

• live• loops v live• speculation

Page 47: © LINK Associates International 2011 ‘7/7’ – selected learning points Roger Kember LINK Associates International 07545 388269 NEPIC Business Security Event

© LINK Associates International 2011

learning point 13 learning point 13

time delay on live operationstime delay on live operations

Page 48: © LINK Associates International 2011 ‘7/7’ – selected learning points Roger Kember LINK Associates International 07545 388269 NEPIC Business Security Event

© LINK Associates International 2011

7.July 2005 7.July 2005

Page 49: © LINK Associates International 2011 ‘7/7’ – selected learning points Roger Kember LINK Associates International 07545 388269 NEPIC Business Security Event

© LINK Associates International 2011

learning point 15 learning point 15

CCTV is a vital tool in CCTV is a vital tool in Counter TerrorismCounter Terrorism

Page 50: © LINK Associates International 2011 ‘7/7’ – selected learning points Roger Kember LINK Associates International 07545 388269 NEPIC Business Security Event

© LINK Associates International 2011

Thursday 21Thursday 21stst July 2005 July 2005

Page 51: © LINK Associates International 2011 ‘7/7’ – selected learning points Roger Kember LINK Associates International 07545 388269 NEPIC Business Security Event

© LINK Associates International 2011

Thursday 21Thursday 21stst July 2005 July 2005

Page 52: © LINK Associates International 2011 ‘7/7’ – selected learning points Roger Kember LINK Associates International 07545 388269 NEPIC Business Security Event

© LINK Associates International 2011

Friday 22Friday 22ndnd July 2005 July 2005

Page 53: © LINK Associates International 2011 ‘7/7’ – selected learning points Roger Kember LINK Associates International 07545 388269 NEPIC Business Security Event

© LINK Associates International 2011

2222ndnd July 2005 – press conference July 2005 – press conference

Page 54: © LINK Associates International 2011 ‘7/7’ – selected learning points Roger Kember LINK Associates International 07545 388269 NEPIC Business Security Event

© LINK Associates International 2011

Friday 22Friday 22ndnd July 2005 July 2005

Page 55: © LINK Associates International 2011 ‘7/7’ – selected learning points Roger Kember LINK Associates International 07545 388269 NEPIC Business Security Event

© LINK Associates International 2011

Friday 22Friday 22ndnd July 2005 July 2005

Page 56: © LINK Associates International 2011 ‘7/7’ – selected learning points Roger Kember LINK Associates International 07545 388269 NEPIC Business Security Event

© LINK Associates International 2011

learning point 16 learning point 16

authenticate authenticate

youryour

factsfacts

Page 57: © LINK Associates International 2011 ‘7/7’ – selected learning points Roger Kember LINK Associates International 07545 388269 NEPIC Business Security Event

© LINK Associates International 2011

Leeds – home of ‘7/7’Leeds – home of ‘7/7’

Page 58: © LINK Associates International 2011 ‘7/7’ – selected learning points Roger Kember LINK Associates International 07545 388269 NEPIC Business Security Event

© LINK Associates International 2011

‘‘9/11’ Commission9/11’ Commission

“ A failure of imagination”

Page 59: © LINK Associates International 2011 ‘7/7’ – selected learning points Roger Kember LINK Associates International 07545 388269 NEPIC Business Security Event

© LINK Associates International 2011

learning points – the future learning points – the future

their next attack -

your next response

Page 60: © LINK Associates International 2011 ‘7/7’ – selected learning points Roger Kember LINK Associates International 07545 388269 NEPIC Business Security Event

© LINK Associates International 2011

learning points – the future learning points – the future

10 February 2011

Pakistan attack: 'Schoolboy' suicide bomber hits Mardan

A young suicide bomber dressed in school uniform has blown himself up at an army compound in Pakistan, killing at least 31 people, officials say.

Page 61: © LINK Associates International 2011 ‘7/7’ – selected learning points Roger Kember LINK Associates International 07545 388269 NEPIC Business Security Event

© LINK Associates International 2011

learning points – the future learning points – the future

7/7 ringleader Mohammed Sidique Khan tried to radicalise boy aged 11

7/7 bomber Mohammed Sidique Khan, who worked as a primary school mentor, told a young student British people would ‘pay for what they had done to Pakistan’.

Page 62: © LINK Associates International 2011 ‘7/7’ – selected learning points Roger Kember LINK Associates International 07545 388269 NEPIC Business Security Event

© LINK Associates International 2011

learning points – the future learning points – the future

Page 63: © LINK Associates International 2011 ‘7/7’ – selected learning points Roger Kember LINK Associates International 07545 388269 NEPIC Business Security Event

© LINK Associates International 2011

learning points – the future learning points – the future

“Today one can threaten a whole society with a flask carrying pathogens created in a garage – and without a detectable signature”

Page 64: © LINK Associates International 2011 ‘7/7’ – selected learning points Roger Kember LINK Associates International 07545 388269 NEPIC Business Security Event

© LINK Associates International 2011

‘‘7/7’- selected learning points7/7’- selected learning points

youryour

QUESTIONSQUESTIONS

pleaseplease

Page 65: © LINK Associates International 2011 ‘7/7’ – selected learning points Roger Kember LINK Associates International 07545 388269 NEPIC Business Security Event

© LINK Associates International 2011

‘‘7/7’ – selected learning points7/7’ – selected learning points

Thank YouThank YouRoger Kember Roger Kember MAMA(Distinction),(Distinction), BSc BSc(Hons)(Hons), MBCI, MBCI

LINK Associates InternationalLINK Associates International

[email protected]@linkassociates.com

07545 38826907545 388269