Cut whatever you want, but not security

By Jianggan Li | 25 March 2009 | Permanent link | 1 comment

Two days ago I attended a security briefing organised by US State Department’s Overseas Security Advisory Council, together will security directors of many American firms for China and Asia Pacific.

During the course of the event, a speaker asked the audience who had their budget slashed, many hands raised. The next question on personnel cut also saw many raised hands.

Last week’s Global Security Asia, a large biannual security tradeshow and conference in Singapore, was conspicuously much quieter than the same event two years ago. A few police officers from another country whom I spoke to earlier told me that their planned trip was cancelled because of the budget freeze.

In the downturn, it is normal that many organizations are cutting budgets and staff. But weakening your own security capabilities, no matter you are public sector or private company, is only going to be counterproductive.

A particular problem is the security threats caused by layoffs. When the newly unemployed lose hope in finding new jobs, they start to take revenge against their previous employer or the society.

Analysts believe as the crisis deepens, the number of economic protests, some of which violent, will continue to rise. The Wall Street Journal recently said that “as China’s jobless numbers mount, protests grow bolder”.

In China, the number of unemployed workers had risen from five million to 20 million between New Year and end February, and the figure is estimated to be 25 million now and continues to rise. It is also estimated that only five per cent of them stayed in their villages after the Chinese New Year holidays – the majority still came back to cities where jobs are now scarce.

At the OSAC conference, the gentleman who sat next to me runs the security operations of a large IT hardware company in China, where they hire more than 40,000 employees. Recent dwindling orders have forced them to cut jobs, and it is a headache ensuring how this is done smoothly without causing much upheaval.

Several executives of an American company was held hostage at their manufacturing facilities in China, amid an impasse in layoff negotiations. On March 12, a retrenched worker in Guangzhou stabbed two senior staff of his jewellery factory to death before killing himself.

Last November, an engineer in Silicon Valley shot three of his colleagues dead after he was fired by the company. The casualties were the CEO, the Vice-President and the Director of Human Resources.

And some people choose to target organizations which they believe are to blame for the whole crisis. Just last week, an individual who blamed the US for his recent retrenchment had smashed glasses of a few cars outside the US Embassy in Beijing before he was apprehended. A few weeks earlier, someone crashed his car into the gate of the same Embassy for the same reason.

In January, a man wearing a vest of firecrackers tried to detonate the explosives at a police station in Shanghai, killing only himself.

China is currently training directors of 3000 county-level Public Security Bureaux (local police forces) to deal with the crisis.

A friend of mine, who works for a major financial company here in Hong Kong, had a colleague who was recently dismissed. The newly unemployed lady turned up in the office the next week with a huge white bag. The whole office was in fear of possible retaliation by her and nobody could concentrate on their work during the two hours she was there.

It later turned out she was only there to take her belongings, but nevertheless caused a significant loss of productivity to the company. Who would expect employees who fear both job security and personal security to work productively?

And it is not physical security which is more stressed, a recent survey by Symantec and Ponemon Institute showed that among the employees who lost or left a job in 2008, more than half admitted to have stolen confidential company information, such as customer contact lists.

Rajendrasinh Makwana, a former UNIX contractor for the American mortgage giant Fannie Mae, implanted a logic bomb in the company’s network after he was fired last October. The “bomb” would have been activated and irretrievably erased all the company’s records on January 31 this year.

By pure luck, another programmed discovered and script and disabled it. Otherwise it would have shut down the organisation for at least a week and cost millions.

While none of these problems is new, they are becoming more common because of the downturn, and thus require more attention. Layoffs are major decisions to make, therefore they deserve proper risk analysis and relevant mitigation measures put in place.

And to slash on security is probably the last thing you want to do.