On Alert

When a workplace is hit by corporate terrorism — in the form of vandalism, bomb threats or other acts of sabotage — fear is sure to reverberate through the ranks, delivering a severe blow to both the bottom line and the overall sense of security. While the employer is the most immediately obvious victim, corporate terrorism also raises questions that may influence worker well-being. Was the employer duly diligent? Could the incident, which some liken to a form of workplace violence, have been foreseen? With that foresight, could steps have been taken to avoid the incident altogether?

Fright night

For Shawn Hamilton, it was a Halloween season he will not soon forget.

The treat of the usually busy, fun and lucrative time for the costume store owner in Toronto’s west end was transformed into a malicious trick. Faux horror turned to real terror as bomb packages —  seven in all —  were found in and around Amazing Party and Costume over the last few days of October, 2011.

The explosive packages kicked off a decidedly more somber gathering, one attended by police officers, bomb squad members in bomb suits and sniffer dogs prowling in and around the area where the store is located.

There bombs assumed different masks, belying any clear intent: one came in a black vinyl purse; one took the form of a water bottle containing a propellant, with a timer and battery; several others were packaged in brown paper bags. “It looked like a bomb, it smelled like a bomb,” Hamilton recounts. Fortunately, none of the devices detonated.

“I don’t think they were meant to go off,” Hamilton says. “Their purpose was to actually have the bomb squads come in and so forth and actually close me down during those very critical days of sales,” he speculates about the perpetrator or perpetrators.

Toronto police continue to investigate; Hamilton says he is hoping to provide some extra incentive with a $10,000 reward for tips leading to an arrest. “It’s a scary situation that any business can be subject to,” he says, characterizing the attack as a nasty bit of corporate terrorism.

What it is

Just what exactly is corporate terrorism? If it is, indeed, an emerging trend, what can employers do to prevent it from derailing health and safety?

“It’s a fairly elastic term right now,” says Robert Chandler, Ph.D., director and professor of communications in the Nicholson School of Communications at the University of Central Florida in Orlando. Where the term does appear in research, Dr. Chandler reports that it has been frequently used to refer to malevolent acts committed against a particular corporate entity, in many cases, multi-national corporations (MNCs). Think a targeted, Black Bloc approach.

Often deemed as high-value targets because of their widespread presence around the globe, terror acts against MNCs can have a ripple effect that, in turn, garners wide media attention. “The larger your profile is, the larger your shadow is for casting this net,” says Dr. Chandler, noting that large corporations typically have a bigger potential audience eyeing them to further a cause.

Government agencies and MNCs are the most frequent targets, but that does not mean small and medium-sized businesses should consider themselves off the radar for violence or mischief. That matters since, as Industry Canada reported in 2010, small businesses make up 95 per cent of all registered employer businesses across the country.

South of the border in Marquette, Michigan, a number of retailers were evacuated last November after bomb threats were called in. The searches, fortunately, came up empty, but the events were sufficient to cause significant disruption to Black Friday shopping.

Here at home, a Nova Scotia hospital was evacuated last May after a bomb threat came through the switchboard. Local police cleared the building after carrying out a search and a 14-year-old from Pictou County was eventually charged in connection with the incident.

“I think it certainly does highlight the fact that small businesses are just as vulnerable to these types of things as any other businesses,” Satinder Chera, vice-president of the Ontario arm of the Canadian Federation of Independent Businesses (CFIB), says from Toronto.

To Christopher Menary, president of Menary Group, a security consulting firm in Toronto, corporate terrorism is any violence — whether physical, online or a hoax — intended to shut down a business.

A 2010 paper, “Terrorism and the Stock Market,” found that 75 attacks against 43 publicly traded companies around the world between 1995 and 2003 resulted in a negative stock price reaction of -0.83 per cent on the day of the attack. That percentage corresponds to an average loss of $401 million for each firm per attack, the paper notes.

Economic impact aside, business terrorism also carries a human cost, regardless of whether a company is targeted or merely gets caught in the crossfire: oil executives kidnapped in Niger, an Italian tanker hijacked off the pirate-infested coast of Somalia, or the kidnapping and slaying of four engineers from a British telecom company in Chechnya.

“You have the potential for serious injury that can take place when this sort of criminal activity is transpiring. It all takes a toll on employees,” says Chera.

That toll may reveal itself as a  burden imposed on worker mental health and productivity. “Terrorism is designed to create fear,” Dr. Chandler argues. “It changes people’s attitude, it makes people stay out of your place of business, it makes your workers not want to come to work.”

Hamilton can commiserate. Two of his employees have quit since the bomb scares last Halloween.

Duty of care

Under occupational health and safety legislation, employers must practise due diligence by, among other things, conducting workplace hazard assessments and implementing effective control measures to remedy any identified hazards. Employers have a legal responsibility to protect employees from a gamut of dangers, but does that onus extend to terror attacks on the job? 

“The fact that an incident occurring in the workplace is also a criminal incident would not prevent occupational health and safety from investigating,” says Sorcha Thomas, a spokesperson with Alberta Human Services in Edmonton. Police would investigate if there are any criminal code violations, while oh&s officers would determine if there is non-compliance with health and safety legislation.

“This could include looking at what policies and procedures are in place regarding potential workplace violence, and appropriate responses,” Thomas says. “Employers are expected to assess hazards that are reasonably foreseeable.”

Foreseeability, defined as whether or not a reasonable person could have foreseen that something could happen, is one of three factors that make up the due diligence defence. The remaining two are preventability (was there an opportunity to prevent the injury or incident) and control (who was the responsible person present who could have prevented the incident), notes a bulletin from Work Safe Alberta.

In response to each of these defences, the bulletin adds the Crown prosecutor would compare an employer’s practices against relevant pr
ovincial, national and international standards; current industry best practices and specifications; and the company’s written programs, procedures and policies.

Competition, politics, a firm’s bid to monopolize a product and a company’s presence or operation in parts of the world where it is not welcomed are factors that can put a firm at risk, Menary says. “If we are in a marketplace where we are dealing with a higher risk product and I deem that as a threat, I have to take all those steps to reassure your safety coming in and [going] out of work everyday,” he adds.

From a workers’ comp perspective, a worker injured when,  say, opening a bomb package mailed to a business, is eligible for coverage. “The injury would likely be considered to have been caused by an ‘accident’, which our legislation defines as including a willful and intentional act, not being the act of the worker,” says Donna Freeman, director of media relations for WorkSafeBC in Richmond, British Columbia.

Freeman says that “each claim is adjudicated on a case-by-case basis,” although the presumption in favour of coverage could be rebutted if the worker’s employment was not of causative significance in the occurrence of the injury or death.

As long as an injury or illness arose out of and during the course of a worker’s employment, a claim related to an act of terror directed at a place of employment “would be adjudicated using the same process as other workplace injuries,” adds Marcela Matthew, communications director for the Workers’ Compensation Board (WCB) of Alberta in Edmonton.

Terror as violence

Bomb threats tend to figure prominently when it comes to corporate terrorism. The RCMP’s Canadian Bomb Data Centre (CBDC) reports that of the 206 bomb-related incidents reported in 2010, a quarter of them are hoaxes. In all, there were two fatalities and three injuries from the 21 bombings.

Commercial explosives used in industry, such as mining operations, make up a big chunk of explosives used in these incidents, says Steve McDonagh, staff sergeant and non-commissioned officer-in-charge at CBDC in Ottawa. Approximately 35 per cent of the 206 incidents in 2010 fell under that category; in 2009, about 35 per cent of the 170 reported incidents involved recoveries of commercial explosives.

In cases of intentional malice, “IEDs are placed everywhere from somebody’s front porch to somebody sitting in a wheelchair, and for businesses as well,” McDonagh says. However, there is no indication from the statistics or incidents “that says categorically we’re getting a lot more business threats.”

Chera says he does not get a lot of calls from CFIB members expressing concern over being targeted, “but that doesn’t mean that it does not happen.” For its part, he says the federation has certainly been working on helping companies crime-proof their businesses.

Potential terror threats can originate with business rivals, disgruntled customers, employees and even disenfranchised shareholders. For a health and safety manager whose job it is to help ensure work-related safety, understanding how corporate terrorism may operate differently from workplace violence may provide some much-needed assistance. 

Workplace violence manifests itself in numerous ways, including physical assault, sexual harassment, verbal or written abuse, intimidation, psychological trauma and sabotage.

The places in which that abuse can occur also vary widely from the workplace itself to clients’ premises and even away from work, say a threatening phone call or text message from a colleague, notes information from the Canadian Centre for Occupational Health and Safety in Hamilton, Ontario.

For Dr. Chandler, workplace violence or corporate terrorism is mainly an issue of definition. “If I’m in my office and someone comes in and throws acid on me or releases a gas,” he says, “I don’t think I really care whether you call that workplace violence or terrorism.” Any intentional act of violence is “pretty much indistinguishable at the ground level,” he contends.

Menary, too, regards corporate terrorism and workplace violence as two sides of the same coin. Pointing to Ontario’s Bill 168 — which addresses workplace violence issues — provisions contained therein reinforce the obligation for employers to assess the workplace’s risk for violence, develop policies and implement preventive measures.

“From a corporate level, we are starting to catch up that terrorism just doesn’t happen to world leaders, it just doesn’t happen to countries. It happens to businesses,” he points out.

And while terror attacks can happen anywhere, the nature of some businesses may put them at a higher risk. These include couriers operations, public transit systems, hospitals, financial institution services, computer software firms and insurance companies, Menary reports.

Consider the disgruntled claimant who held eight employees of Alberta’s WCB hostage in the Edmonton office three years ago.

Further back was the 1982 bombing of Litton Systems of Canada, a plant in Toronto that manufactured cruise missile guidance systems for the United States. The attack, involving 250 kilograms of dynamite, resulted in the injury of numerous Litton employees and an estimated $3.9 million in damages, including the company’s loss of the contract, notes an opinion piece by Bob Bergen, Ph.D., writing as a research fellow with the Canadian Defence & Foreign Affairs Institute in Calgary.

Visual cue

A building is not just picked at random, Menary says, explaining that visuals account for 90 per cent of security work. A building equipped with steel doors, surveillance cameras and uniformed security personnel convey a hard target and a deterrent to potential saboteurs. On the other end of the spectrum is what Menary calls “the house with broken windows,” which presents itself as a soft target.

Access points are often the weakest links. Examples include the front reception area, the back of an office where packages arrive through courier services and single-point vulnerabilities in systems and infrastructure like loading docks, drive-throughs, dumpsters and a single electrical main service entrance, notes “Building Terrorism Mitigation: Vulnerability Assessment,” a manual penned by Continuing Education and Development Inc. in Stony Point, New York.

The manual recommends identifying and examining various aspects associated with a building when conducting a vulnerability assessment, including the following: major structures surrounding the building; whether or not the building’s architectural design incorporates security measures from a crime prevention perspective; the building’s structural robustness; and the security of systems ranging from utility, plumbing and gas, electrical and ventilation to chemical, biological and radiation.

But access is not just about the buildings themselves. Consider the bus stop outside a business where workers alight or board vehicles; the road that leads directly to the building (tempered glass and landscaping often being the only barriers to oncoming traffic); and even traffic lights where motoring employees need to stop before turning into or driving out of their office.

That possibility was tragically borne out two decades ago in Langley,
Virginia. On January 25, 1993, a man walked into slow-moving traffic during rush hour and began to randomly fire at drivers who were waiting to turn into the main entrance of the CIA’s headquarters. Two employees were killed and another three injured. 

Dr. Chandler emphasizes the need to look at places where people congregate — both inside and outside of a workplace. “You can be 1,000 per cent secure in your business, but if they really want to attack and you haven’t looked at the fact that at 5 o’clock, you’ve got 300 employees lined up at the bus station to take the bus home, that’s where they are going to be,” he says, citing the CIA incident.

The first step to beefing up workplace security is to assess a company’s risks and vulnerabilities by looking to the past for the organization’s history, and to the present for existing business operations, competitors and security measures. “The methodology goes right down to how people enter that building on a daily basis, how do they move around, what protection do we have around the building, within the building and from outside the building,” Menary says.

Once vulnerabilities have been identified, measures need to be taken to mitigate risks. This would include identifying locations of trash cans, increasing the number of surveillance cameras, establishing screening tools and erecting barriers for vehicles entering the facility, decreasing clutter around the facility, improving sightlines by removing bushes from entrances and updating building procedures. “Our job as security risk assessment managers is to take away that risk, take away that opportunity,” Menary says.

That will demand not only training, but properly equipping employees. For example, the receptionist — often an organization’s first line of defence — is critically important when it comes to incidents such as bomb threats or any intimidation directed at businesses and delivered over the telephone. Receptionists and other frontline staff who man the phone should have a list and be trained on how to respond should they receive a bomb threat.

If a threat is received, the CBDC recommends that operators remain calm, ask for specific information about the threat and listen for identifying characteristics, like accent, pattern of speech and diction, that may help police investigate and decipher the credibility of the threat.

It may also be possible to initiate a trace of the caller’s number which can provide vital information about his or her whereabouts. A pre-arranged signal to alert the supervisor or co-workers sitting nearby should also be established, the CBDC advises.

Routine is a spot of bother when it comes to becoming a target. “Potentially, people are always looking at your pattern, looking at what time are you leaving the office, what time are you coming in, are you transferring money at a certain hour?” says the CFIB’s Satinder Chera. He recommends changing the routine and having employees work in at least pairs as precautionary measures that can be taken.

All in

“Private companies should have a plan in their business that engages all employees so everybody knows what their role is” should a threat occur, McDonagh advises.

In addition, it would be prudent for organizations to establish a command structure that kick starts a response that could involve such actions as alerting the police, assessing the threat and evaluating whether or not if employees should be informed and immediately evacuated.

If the latter, McDonagh says it would also be helpful if employees are on the lookout for anything that may be out of place. If so, they should not touch or move the suspicious package or object, but report it to management or police.

A comprehensive risk management plan addresses not only the preventive aspects of corporate security, but includes planning for business continuity, reviewing communication plans with employees and putting in place disaster recovery measures in the event of an incident, says Dr. Chandler.

Unfortunately, “what we typically do is prepare for the last terrorist attack and not the next one,” Dr. Chandler observes. “That’s a tough thing to overcome because that’s what we know, that’s what just happened.”

Just how much of the planning gets done may come down to availability of resources. “Some directors of security will sit in one part of Canada with 22 other offices across Canada. So it’s hard to co-ordinate all [this] stuff,” Menary suggests.

Another hurdle revolves around perception — the thought that terrorism is a remote possibility. Even so, Menary says he is encouraged by the apparent increase in the number of businesses, from small outfits to MNCs, that are conducting on-the-job risk assessments.

Following the Halloween scare, Hamilton is not taking any chances. He has spent about $50,000 beefing up security at his store by installing 32 cameras, erecting gates, instituting a bag check-in system for customers, training employees to be security-aware and having a bomb dog patrol the premises on a regular basis.

His employees remain cautious, Hamilton says, but otherwise comfortable working at his store. “We just hope that this ugly thing that happened to us is over.”  

Follow us on Twitter @OHSCanada

Sidebars:

False Alarm

Canada may not spring to mind when terrorism is mentioned, but the world’s second largest country is by no means immune. Consider the following media reports of bomb threats at various businesses and institutions:

• February 24, 2012 — A bomb scare was snuffed out after a suspicious package was found outside of a Scotiabank location in Saint John. A crowd watched as the RCMP bomb squad’s robot fired two water cannons at the package in an attempt to destroy it, but it contained no explosive materials.
• December 9, 2011 — No explosive device was discovered, but approximately 1,000 workers were evacuated from Bombardier Inc.’s plant in Thunder Bay, Ontario after the security department received a bomb threat and contacted police.
• December 3, 2011 — A WestJet flight heading to Toronto was forced to make an unscheduled stop in Thunder Bay after a passenger made a bomb threat. Members of the Ontario Provincial Police’s bomb squad were called in to search the vacated aircraft.
• October 27, 2011 — Everest College in downtown Sudbury, Ontario was evacuated after a student received a text about a bomb being in the building. A search by the canine unit was completed before police gave the all-clear to reopen the building.
• March 16, 2011 — A small wooden box in the shape of a house left behind at the Alberta legislature in Edmonton sparked a bomb scare. Handed out by protestors the previous year, a janitor took a box that had been discarded, but inadvertently left it in front of an office, prompting the scare.

You’ve Got Mail

Everyone can snicker about snail mail, but receiving correspondence, packages and whatnot through the mail system continues to be a critical means of communication and marketing for many businesses. Unfortunately, this system can also serve as a conduit for receipt of hazardous devices righ
t at a workplace’s door.

The Ottawa-based Canadian Bomb Data Centre, part of the RCMP, points to a number of features that should raise some eyebrows about incoming mail:

• excessive weight or thickness for the size of an envelope or a package;
• a feeling of springiness, metallic components or stiffeners inside, small holes or protruding wires, string or metal foil;
• unusual odours or oily/greasy stains on packaging;
• rigid or lopsided letters or packages; and,
• excessive weight or securing material, such as masking tape or string.

Beyond weight and configuration, however, telltale signs can also be detected in the postage and addresses themselves: excessive postage; an unusual or unexpected point of origin, indecipherable or no return address; restrictive markings such as Confidential, Personal, Rush or Do Not Delay Delivery; a hand-written or poorly typed address; and inaccuracies in addresses, titles or titles without names or misspelling of common words.

Mailroom employees who receive suspicious mail should isolate the package in question, inform the supervisor and contact police. If workers suspect a harmful chemical or biological substance may be involved, cover the package or envelope with a plastic sheet or raincoat (if none is available, leave the package as is), evacuate the room, close all doors and windows, isolate the area where the package is located, and retreat to an area that is equipped with phone access to await emergency responders.