Industry Voice: Travel security and the rise of the machines in travel risk management

Proactive travel security 

Security, especially in relation to TRM, must be proactive, with a robust reactive support mechanism. Further, if things go wrong, it is hard to find many examples of when people immediately turn to their apps and call centres for advice, whether it be an active shooter in Nairobi, a terrorist attack in London, or an earthquake in Mexico City.
In safety and security, the ability to make a rapid, effective decision can make a huge difference and is perhaps the most important aspect of facilitating a successful outcome. This is not obtained by pushing an SOS button on the app. 
When an organisation signs up for a travel risk app service, there seems to be a mindset among some – primarily the travel planners and human resources departments from my experience – which says, ‘we are all now covered and we can concentrate on other things’. There is a lack of focus on the proactive measures of risk avoidance, as well as an overreliance on the functions that were probably sold to them: panic buttons, real-time risk alerts, geofencing, 24/7 phone assistance, and police alerts. There is an almost complete lack of attention put into thinking through the process of incident response.
As is typical within the risk management industry, things become a buzzword, or a key ‘must-have’, and apps were touted as the most important thing in TRM since the seatbelt. Everyone rushed to initiate panic alert apps with SOS buttons, check-ins, and geo-fencing. Some, to the neglect of other aspects of TRM, but nearly all with lack of forethought as to process. 
People seemed to forget to ask – why are we doing this?  

Why do we need TRM? 

The objective of TRM is to bring travellers back home safely to their friends and families every time. To improve your organisation’s chance of doing this, there are quite a few steps to take before bringing an app into the picture. I’m a huge believer in three things: the basics, process, and simplification. 
Provide regionally focused training, pre-travel briefings, secure transportation, and support. Develop and communicate process around responsibility, and direction, and simplify by cutting out the noise, the fluff, and focusing on what will have an impact.
Organisations could learn a lot from some travel-heavy organisations, such as media groups. Some of the leading media organisations have really embraced proactive measures to manage risk, and although some may say they are often completely different risk scenarios, the principles remain the same.  
Media groups identified the need to invest heavily in training their own staff to make sensible decisions, as well as how to react if the worst-case scenarios occurred. They initiated robust process and protocols, they made teams accountable, had senior sign-off, and they invested in security and transportation when appropriate to do so. They are required to support operations, often in challenging environments, just like corporate organisations. Yes, some media organisations use apps, and have a range of technologies, but these are used for supplementation, not reliance. 
Apps designed for broad regional audiences don’t have the necessary context to answer the ‘so what?’ question. In response to a local bombing, the risk appetites of each individual, and different business realities, may in fact vary greatly, and follow-on risk mitigation responses would likewise vary greatly. An app would be ill equipped to consider business imperatives that need to be preserved, while at the same time managing the associated risks to keep everyone involved safe.
If the main objective of TRM is to bring people back safely to their friends and families, then you need practical, actionable risk management measures. To have those is time and labour intensive, and unfortunately, more expensive than the alternative system of having a few things in place, giving travellers an app, and responding when things go wrong. 

Reactive vs proactive security measures

There are two other flaws in the system, but really they are only apparent if apps are over relied upon. The first is that they are predominantly reactive. The app is there to let the correct resources know when something has gone wrong.
If a factory was experiencing loads of accidents every month, with workers getting injured through interaction with machinery, would they give all the workers an app so that they can report to management when an incident occurred and where, so they can get medical response and advice? Or would they train the workers to be safer around the machines, and adapt processes to reduce the number of accidents? 
Secondly, noise. If a traveller has downloaded the app, then they will receive alerts from it, alongside all the other ‘noise’ from WhatsApp, social media, and emails. The app likely sends a lot of useless (or content the user deems useless) information, and it isn’t long before the traveller filters out that ‘noise’.

Employee engagement with travel security apps

The genuine issue I have seen time and time again is that some travellers are overconfident in their travel skills, others focus on the extreme dangers that are unlikely to impact them, while completely ignoring the ones that will most likely creep up and bite them, and some will genuinely understand the importance of what the security team is trying to do and embrace them, but with varying levels of interest.
A lot of travellers are very difficult to work with for different reasons:

• They think they know everything and are complacent
• They think they are being monitored for transgressions, or lack of productivity
• They are too fearful of the extreme
• They don’t want any ‘inconvenience’
• They will only call you when things go really wrong.

All of them, even if engaged, will have rapid attention and skills fade. Engaging a wide collective of people is not easy, and I understand why a lot of organisations have focused on apps, but they do so to the detriment of what will actually work to improve safety. 
Through discussions with clients, we have found that the average adoption of an app across a workforce is under 50 per cent, and the actual usage of that app is far less than that, at 35 per cent. As an example, one client saw under seven-per-cent adoption across 100 countries and of those seven per cent, on average three per cent ever responded via the app, and even fewer had updated user information, so functionality suffered. In certain countries, the privacy restrictions reduced the efficacy of the app even further. 
Making people turn on an app is difficult, and without getting into social science, I envisage uptake will only become harder with the increased focus on privacy and worker rights, but time and time again, we see organisations, and security/risk companies selling them as an overarching TRM saviour. Large organisations specifically like them as they check a lot of boxes for insurance and cost-saving purposes. 
Training, accountability, on-the-ground support, and management working in close conjunction with technical and intelligence assets is key.

Getting rid of excess noise

Without a doubt, people are overloaded with noise, and they will filter it out. People don’t care that there is a protest planned in the west side of a city when they are in the east, they are not bothered that there was a bank robbery a few miles away, and they definitely have no interest in a random police incident downtown. It only takes a few of these before alerts are silenced, then ignored. 
I think apps are getting better, as is some of the technology in relation to micro-location, itinerary management, and undoubtedly AI too. In my opinion, the key differentiator is a good Global Security Operations Center (GSOC) with great staff. But, that is expensive, and as everyone in this industry knows, good people are hard to find and even harder to keep. 
In order to provide value to the customer (the end user), risk management need to have analysts to provide customisable information that is timely, accurate, relevant, and actionable. 
 

Getting ahead of the risk

In this article, I have purposefully focused on apps, and not GSOCs, because some GSOCs are absolutely fantastic and worth their weight in gold. Why are GSOCs and apps sending information to the traveller? To proactively try to get them ahead of potential incidents that could impact them. This is where I think they come in very useful, but primarily only in relation to non-imminent issues. For example, a hurricane is heading your way and should start to impact you in the next 48 hours, or there is a large protest planned on the road where your meeting is due to take place tomorrow. The app will then facilitate communication and incident response. This is extremely valuable to TRM, the organisation, and the traveller. 
But, and at the risk of over-simplifying it (although it will help get the point across) the app offers little value for imminent situations or critical incidents. As examples, if you are close enough for an earthquake to immediately affect you, then you will feel it and experience it, you don’t need an app to tell you; and, if you are close enough for an active shooter to immediately impact you, then you will hear it and experience it. You won’t need the app to tell you, and the last thing you need is someone to ping or call your phone. 
Also, in both these cases, the app will not be the first thing you turn to. The GSOC will be able to know, and provide a briefing to the appropriate management, but that is of no value to the traveller on the ground at the time. Only the traveller’s immediate actions will have an impact on whether there is a successful outcome.

Move on from duty of care

Organisations need not only to understand, but also meet, their duty of care requirements to employees, and it is a complex process to navigate. Understanding what measures to take to manage certain risks remains a considerable challenge. If an organisation looks at TRM solely from a duty of care perspective, it will fail its people. There must be more of a driver than liability.
The new ISO:31030 quality standard will be interesting. I think it will help highlight the risk, promote ownership, and improve practices and approaches, but as with any standards system, some will see it as a box-checking exercise and will do the ‘minimum’ to cover themselves to be seen as meeting duty of care obligations. The standard may be seen by some purely from a compliance perspective, which as I mentioned earlier, will be to the detriment of the traveller’s safety. But, it will definitely help bring organisations that don’t necessarily have a TRM framework into the fold and develop their TRM procedures, which can only be a good thing. 
The common issues we see within corporate organisations can be summed up with the following statements that we have unfortunately heard time and time again:

• Our people have been travelling for years, they don’t need training
• I have never had an issue before, so why would I now?
• Yeah, (insert country here) is dangerous, but not if you are with the locals and speak the language
• I’ll just get an Uber when I get there
• I have the Embassy’s phone number so I should be ok.

The travel security industry can help corporate organisations move away from this mentality by simplifying their service delivery.

Corporate investment advice – transport matters

Corporate entities need to invest in a process that enables travellers to be supported with appropriate secure transportation for their itinerary. Bad things happen in and around vehicles, and the key to minimising risk when travelling is to reduce the variables. If organisations can manage and reduce the variables of airport transfers, overland travel, and vehicular movement, then risk can be reduced. 
Let’s not forget that the function of security is to enable operations, and it’s important to emphasise the benefits of secure transportation and how these align with smooth, efficient travel. Our clients get from their hotel to meetings quickly, efficiently, and safely. Less time in vulnerable locations such as airports, shuttle buses, sidewalks (pavements), outside restaurants, and most importantly, not in vehicles with unknowns. 
If someone is utilising secure ground transportation, whether out of choice, or mandated by a responsible company with a robust TRM programme, they are already ahead of the game. Secure ground transportation should have a solid journey management plan surrounding the itinerary that likely includes a risk assessment. This risk assessment is the key to ensuring all threats are understood and either managed or mitigated.
Travellers and organisations are quickly realising that secure ground transportation is not just about getting someone from A to B, it is about managing and mitigating various risks that surround being in and around vehicles. 
Covid has definitely changed overland transportation, at least in the short term. Consider how many people have been in that rideshare the same day as you, what cleaning protocols have been mandated, etc. You lose control of all the variables. For travellers with a low-risk approach to Covid, even though surface transmission risk is low, or any other related issue, a designated vehicle for the day, with mandated cleaning protocols, and a known driver, reduces variables significantly, and therefore provides travellers with confidence.
Very simply, rideshare is not secure ground transportation (SGT) and should never be classed as such. My company carried out a recent poll of clients and asked: do you allow employees to use rideshare when travelling? And 56 per cent said yes, with limitations. But, there was absolute agreement among all security managers polled that rideshare services was not classed as SGT.
Rideshare has its place in employee transportation when travelling. I use it, as do millions of others around the world. But, I would not use it in some places, and as an organisation I would strictly control where and when it can be used. 
The biggest risk when travelling is road traffic crash. Furthermore, a vast majority of incidents and crimes occur in and around vehicles. The majority of rideshare drivers are part-time drivers, not professional, nor trained. They just jump in the car on their way home from work and do a few extra hours to supplement their income, or will do excessive hours. This also significantly increases the risk of fatigued driving, which is a major risk factor and the cause of multiple accidents. 
A rideshare driver, generally, is not a full-time professional chauffeur and is generally reliant on an app to move from location to location. They follow the guidance from the app blindly. This may be ok in some cities. But as soon as you move into more challenging or dangerous environments, one wrong turn or one ‘shortcut’ provided by Waze could lead the vehicle (and therefore the user) into a high-risk environment. Imagine taking a wrong turn in Rio de Janeiro and ending up in a favela. Or, taking a shortcut through a Mexico City suburb.
Clients ask me the question ‘can we use rideshare services’ time and time again, but very few like the answer when it doesn’t suit them. This is the struggle any TRM programme will come across, and it also mirrors the ‘app issue’ – the management of the traveller. 

What else has Covid changed with regards to TRM practices?

I think it may have made people more risk averse, or at the least, risk aware. I have seen scary levels of indifference, ignorance, and complete lack of accountability, both at a traveller level, and managerial level, for many years. Covid may make people more aware of risk. 
Also, the anxiety of travelling after more than a year of being at home should be taken into account. Even seasoned travellers have lost their routines and may be forgetful with protocols when returning to travel. Mental wellness is just as important as physical safety. 
Getting travellers engaged for short periods of time is not too hard – keeping them engaged and aware all the time is a great deal more difficult. A terrorist attack happens in Paris and everyone wants to jump on a HEAT course and learn the difference between cover and concealment, but try to get a traveller to join a 30-minute safety briefing for Bogota and you'll get push back because they have been there before, and don’t have the time.