EP 141 Beyond Observe & Report, You Don’t Hire Journalists: Reframing the Role of Security Officers to Predict, Prevent, Protect with Amotz Brandez, CEO Chameleon Associates

BIO

AMOTZ BRANDES

Amotz is the CEO of Chameleon Group, first established in 1992. The company’s reach and reputation has grown and now supports a wide range of clients seeking top rung security consulting and training across the globe.

Amotz  began his career in an Israeli Defense Forces Special Forces Reconnaissance Unit, leading recon and intelligence gathering teams on complex missions against Hezbollah and other terrorist organizations. 

After completing his military service, he moved to Los Angeles and joined the Security Department of the Israeli Consulate and El Al Airlines whose agents are trained to detect suspicious behavior and threats across its operations. As a profiler, Amotz carried out these duties for El Al and the consulate, protecting both assets and dignitaries. 

In 2002, he established Chameleon’s Training Department in the wake of 9/11 and has since trained private, public, and military sectors in Predictive Profiling, Security Questioning, Insider Threat, Threat, Risk & Vulnerability Assessments, HUMINT, Effective Security Management, Proactive Security, and more.  He designed and developed a slate of eLearning courses to provide Chameleon curriculum to clients in an online format.

Over two decades, Amotz has managed security projects for clients in a wide variety of sectors including aviation, mass transit, critical infrastructure, museums, schools, government agencies, manufacturing, retail, banking, and more. 

His diverse professional and personal background affords Amotz a unique ability to develop and deliver threat mitigation solutions that conform well to each unique client’s organizational culture and mission.

Amotz is a leading expert in aviation and transportation security, Predictive Profiling and counter terrorism and is sought out as a speaker, media expert and trainer worldwide.  

Amotz earned a B.A. Degree in International Development Studies from University of California at Los Angeles.  He is fluent in English and Hebrew.

Security Circle ⭕️ is an IFPOD production for IFPO the International Foundation of Protection Officers

Transcript

0:01

If you enjoy the security circle podcast, please like share and comment or even better. Leave us a fab review We can be found on all podcast platforms. Be sure to subscribe. The security circle every Thursday. We love Thursdays. Hi, I'm Yolanda And welcome to the Security Circle Podcast, produced in association with IFPO, the International Foundation for Protection Officers. This podcast is all about connection, bringing you closer to the greatest minds, boldest thinkers, trailblazers, and change makers across the security industry. Whether you are here to grow your network, spark new ideas, or simply feel more connected to the world of protection and risk, you are in the right place wherever you are listening from. Thank you for being a part of the Security Circle journey..

Yoyo: 1:13

So I have with me today somebody that, uh, you might not have heard about this is his introduction to the Security Circle alumni. His name is Amotz Brandes He is the CEO for Comedian Associates. And I saw this little introduction about him on LinkedIn. He says, I'm a serial entrepreneur, family man, world traveler, former soldier, security consultant, educator and trainer. And moreover, he's fascinated by innovation and creativity and admires common sense and elegant solutions. Well, I'm gonna ask him all about that. I, amongst branders, welcome to the Security Circle podcast. How you doing? I'm

Amotz: 1:51

doing very well. Thank you for having me.

Yoyo: 1:54

We got there in the end, didn't we?

Amotz: 1:57

Yes.

Yoyo: 1:59

Welcome really genuinely to the Security Circle podcast. We are gonna talk about some very exciting subjects today, but most importantly, let's talk about methodology. Methodology is something that's quite important to you, isn't it? And how you apply it both personally and to your business practices. Why, why is that?

Amotz: 2:20

Well, specifically within the context of security, methodology is not just how we do things, is why we do those things. So I think that often in security there's this tendency to just go through a process. Of, you know, if it's aviation, security or security for a manufacturing facility, it doesn't matter. Or, or a government building, it's, we need to put security in this place to do 1, 2, 3, screening, access control, et cetera. But do we actually look at it and say, why do we do what we do? And the why should inform the how. One of the things that I think is missing within the methodology of security is the adversary. And often we just do security in order to do security, but we don't think about the adversaries, methods of operation as a major influencer on our methodology. And those methodologies in security. Sometimes you would have. Uh, budget is an influencer on, on, on process. You would have, liability. You would, different kinds of liabilities. Could be legal, cultural, political, and you have marketability, how do I sell the security? But from those three aspects, those are things that everybody, content with, insecurity. What's missing often is the adversary.

Yoyo: 3:49

Don't you think most people have all of those liabilities all at once? All of the time.

Amotz: 3:54

Yes, all the time. The issue is what do we prioritize in the way that we do security? Do we prioritize liability over marketability and budget? But the thing is, what we should prioritize first and foremost is the adversary. We have to ask, is it effective? That's, when you read my my bio, you mentioned elegant solutions that I like that, and you know, and so in common sense. And the only thing that drives common sense and security really is the adversary. Now, I'm not saying, uh, remove the liability aspects or the marketability aspects in terms of how I sell security to the users or to, to whoever needs to go through security or do not look at budget. Those are things that we have to, but the first and foremost, aspect of security is to, we, we do this against or to deal with an adversary. And so we need to study the adversary well in order for our solutions to make sense, common sense, which is often not very common because we don't necessarily, uh, want or have the capacity to look at things from an adversarial standpoint.

Yoyo: 5:09

I've always found, uh, you know, a lack of common sense generally in life. Uh, not of course with me, but in generally in the workplace. You know, I'm thinking we are as security professionals operating in a world with a lack of common sense, aren't we?

Amotz: 5:26

Yes, and I think the the lack of common sense often is derived from those other aspects of liability and marketability and budget, which again, I don't think that those things should be not considered., They're a fact of life, but they need to be, prioritized after, or put in, as a consideration after we really study the adversary. And what are the ways by which we can prevent, an attack or a crime or a terrorist event. So those are the things that we need to focus on. First on the adversary, those other things need to come later, and I can give examples to it. often we look at, for instance, you look at the private security world in the United States, but all over the world, where security officers are. Um, you know, in the US the, the idea is to just observe and report. Now, the joke I use for it is that we don't hire journalists, we hire security officers. And so where does this concept of observant report comes from? Comes from lawyers that say to the corporations or to the clients who use contracted security, don't ask them to do anything. Just tell'em to observe and report. That will not make you liable. You know? So that's a liability approach where I come in and I say, well, if I have a security officer, their role is to detect. Determine and deploy. They need to detect the suspicion indicators that correlate to an mo of an adversary. Then they need to, uh, determine once they see that sus that suspicion. If that suspicion can be refuted. Um, and if it's refuted, therefore there's no issue, we can go back to business. But if it cannot be refuted, that means it's a threat. That threat needs to be dealt with vis-a-vis deployment. The deployment could be asked the person to leave, not authorize them to, to go in, uh, further question that person, um, bring the police, uh, or even, you know, tactically deal with the situation. But you see, detect, determine, and deploy is a much more adversary based security solution. Just in terms of terminology than observant report that has almost no merit in security, but it's liability driven.

Yoyo: 7:49

I mean, that's what CCTV cameras do, isn't it? Observe and report?

Amotz: 7:53

Well, yeah, to, to an extent. So depends. Now with CCTV, you add analytics and it, it detects too. So it has a, but even, and, and that brings to another issue. Detection is actually an e, the easy part of security. So CCTV or anything. It could be a person, it could be a technology, it could be a screening machine, could be a metal detector, could be anything. It could be CCTV can detect something. It detects suspicion. Now we need a human interaction in order to see that this action is either suspicious or not. If it is suspicious, does it move up to the level of threat? How vis-a-vis, uh, you know, usually questioning, usually further investigating this issue. But, uh, one of the things, uh, with CCTV and any kind of security technology, the more we put those technologies in, the more suspicion we will generate for our system to deal with suspicion indicators. And for that, you need humans who are capable of discerning whether it's a threat or not a threat.

Yoyo: 9:03

We talked in the pre-chat around predictive profiling. Mm-hmm. How do you define predictive profiling and why is it so important?

Amotz: 9:13

Uh, predictive profiling is a, is a, is a buzzword, right? But really, and we, we coined the, the, the term 20 some years ago, 22 years ago at Chameleon Associates, uh, when we started training, um, after nine 11. And we wanted something that really correlates with situational threat assessments. Uh, some people call it behavioral assessment, but I don't like that term because behavior, behavior begets human behavior. And it's not just that when you, when you, uh, do an assessment, you might do an assessment of an object or a situation, uh, not just a person. So it's not just behavior, uh, or human behavior. It's, the ability to look. At object situations and people, and discern at the end of this interaction, whether there's a threat or no threat. It's very different, for instance, than police interaction, where at the end of every conversation or interaction, the decision needs to be crime or no crime. So in the security world, we need to come up with the decision of threat, no threat. How do you do it through predictive profiling. And again, you can call it situational threat assessment. You can call it even behavioral threat assessment. Like, but like I said, that's not a term I like so much because it's, it's, it's narrower

Yoyo: 10:40

limited. Yeah. I, I can see that. Now, give us a use case then, uh, for how you use predictive profiling.

Amotz: 10:48

Well, any kind of, I, I've already talked about CCTV giving us an indicator of, uh, of a person who, um. Who, um, might be, you know, engaging in a suspicious activity and suspicious activity, for instance, with CCTV. Um, let's take in a situation of an event where everybody's going in one direction towards, let's say the stadium and one person is going, uh, against, against the grain. Okay? That could be suspicious. Why? Because it correlates with an MO The mo might be that he's trying to gain access, he's trying to target someone. He's, so, I can see that this is suspicious, not just abnormal, but suspicious. And I can go into later. What's the difference between these two terms that usually, uh, that are used, uh, um, sometimes in, uh, people don't know how to, how to define those, uh, those terms well, but, um, let's look at this situation. A person moving against the grain into an event. And you, you now have this as A-C-C-T-V operator or a security on the ground, you need to now go and approach this person and question them in order to know what is their identity? What, what are they doing here? What's in terms of time and place? Are they part of the organization, not part of the organization? And what is their intent for moving from point A to point B? If you're not able to get, uh, the right kind of answers to refute the suspicion that you have, you have a threat. How do you define that? Threat is an MO he's about to steal. He's a pickpocket, he's a terrorist. He's a, you know, about to bomb or about to stab or about to shoot, but, and now I know what, what to do. So again, it's those three elements of I detected vis-a-vis technology or my own eyes. Um, and then I, now security needs to determine what is he doing here? Who is he, uh, and what is the mo behind that activity? And third, now I have a threat. I, I articulated the threat. Now I know what I need to, need to do. Again, that could be from escorting him out to refuse, ask, uh, um, access to even, you know, deal with him in a, in a, in a more physical manner because the threat is imminent.

Yoyo: 13:22

Our security frontline, our security officers on the frontline, our as a team, are only ever as good as the weakest link. Mm-hmm. And we learned this in the Manchester Arena attack, the Ariana Grande concert, where we had, um, a person turn up with the most horrendous looking sized backpack. In a number of different gray areas around the premises, for quite a long period of time was spotted by security, but the security at the time didn't, know how to escalate it. There was a lot of inexperience. There was inaction when there should have been affirmative action. And I think, and even now, we've had reports that since then, that the security at large venues isn't as good as it should be, and it's a constant battle. I know that we don't always have the luxury of recruiting great people all the time. Sometimes we, it's slim Pickens, as we would say in the uk, but when you factor in that weakest link, how, and I wanna lead you into, you know, you never know how good your security function is until it's tested. Not a lot of people test as much as they should. Do they.

Amotz: 14:38

Right. So I mean, it, I always equate, uh, security to, um, to, uh, football match, whether it's American football or soccer or whatever, whatever that may be. Uh, or a basketball game. You know, when, when you go, uh, so a function of, of any kind of team sport is recruiting. Do I have the right players? Right? So if you don't have good players, you are not necessarily going to do well. So yes, recruiting is a function, you know, do I get people who have the capacity to be, um, are they aware, are they capable, are they well trained, et cetera. Uh, but then, you know, the other thing with, uh, these types of team sports is, is training and, and practice. You don't win the World Cup in anything by just sitting there and not practicing. In security, in order to practice, you need the opposing team. The opposing team will only show up either in, you know, the, the, if you're in a high risk environment, they might attack you every day, and that's how you're going to practice your, your craft. But in a place like, uh, an event in the UK and Europe, the United States and many other places, uh, if you are, uh, a security, the likelihood of you seeing threat and dealing with it is very, very low in terms of, um, statistical probability. So you have to simulate it. And that comes through red teams, uh, the more red teams an organization does. In terms of, um, uh, constantly trying to attack the system, the better practice the practitioners, uh, have in dealing with it. But when you're not doing red teams, the assumption is that you're gonna, uh, win the World Cup without, without ever stepping on a field and playing against, uh, another team. And that's, uh, that's a really big, bad, uh, approach I think.

Yoyo: 16:44

I think you're spot on, but I also think certainly in the UK the security industry isn't flush with money. Margins are tight, margins are low, money is made on mass numbers rather than, you know, boutique kind of deliverables. I just know that sometimes the training of, personnel, certainly those that are integrated or contracted is a luxury rather than a perfunctory part of their employment. And, and that's a shame. Businesses that are doing well, that don't have struggles will always be able to look at red teaming and do it comfortably and look for learning outcomes. But businesses that are struggling that have tight margins will never have the luxury of being able to deliver that. And that's a pretty painful part of the security industry frontline, isn't it?

Amotz: 17:33

I think that, uh, thanks for the challenge because I get that all the time when I meet with clients. I don't think it's a function of budget again. Now you remember how we talked about putting liability and marketability. Now we're putting budget is, is an influencing factor. Really. You have to start with the beginning of what you're trying to prevent and who are the team members that you have. Most red teams don't necessarily need to cost a lot of money. They don't need to even be done by an external, you know, provider or contractor, that red teams, you can be done internally. You have your own employees. Ask them, you know, come up, come into to the facility today. By saying, I forgot my, my ID card. That's a red team stand outside of the building for an X amount of time to see what would be the approach. And the idea is to constantly simulate those things. Um, and it, it, it requires a work, but it doesn't necessarily require an, you know, an huge amount of, resources.'cause the resources exist within an organization. Of course, if you wanna raise it to a higher level of, uh, you know, red teams, you might consider, using, contractors or something like that. But really it comes down with the approach to constantly test your own security with the resources that you have or don't have. But, uh, to test it without red teams, um, you're basically. Kind of playing it for, for luck because you don't know whether or not your security would be able to handle the kind of security incidents that you want them to handle. So yeah, everybody can do red team starting literally as soon as they just hear that in this podcast, they can start it five minutes from now, uh, by asking one of their employees or them themselves to go out and test the system.

Yoyo: 19:29

So I had an interview about, uh, seven or eight years ago at the Bank of England. Mm-hmm. It was for a physical security, uh, sort of management role. I don't remember the actual job, but I thought I would approach this a little bit differently. So I did hang around outside the building. And I watched their security officers and I watched them move, you know, periodically. I worked out when their lunch breaks were. I worked out when they changed over shifts and I managed to see, uh, one security officer who was quite flamboyant about having his ID badge displayed, for everyone to see, which I didn't feel was necessary. So I was able to get his name and then with that information. From his card, I was able to go back home, research him online, and I was able to provide quite a lot of damning information about him actually, that he was just pinging out on social media. And one is that, you know, when he goes back to his home country, he has parties and tells everybody he works for the Bank of England. He's very open about it. I could, I found out where his son played basketball. I could see, you know, I did this whole number on him. And so when I went in for the job interview, I said to my interviewer, I said, look, I think, you know, if we look at this as a case in point, there is some work to be done around some security hardening for how the security officers are, you know. Literally leaking valuable information while they're at their posts. But moreover,, there's a view here that these individuals are making the bank more vulnerable because they're so open about where they work. They're not exercising any discretion and they're making themselves targets for things like kidnapping and ransom and and coercion or anything else of that nature. Do you know, they didn't offer me the job, like, don't get me wrong, because I think I should have slammed dunked it with that. They did say they were really grateful for the information. I'm not grateful enough. I ended up getting a really, really good job at Accenture, so I wasn't in any way, you know, aggrieved. But I think sometimes just getting that different perspective and looking at what's going on and doing that red teaming is critical no matter what you're doing, even if you're going for the next job.

Amotz: 21:53

Right. And look, red teaming is a hard sell. It's a hard sell for an organization. And you made a hard sell. I did. Well, you made a hard sell. It's a good sell, but, it's a hard sell to take someone in who provides, who identifies the problems. Okay. Uh, you know,'cause, and, and from a, from a management, perspective, you're like, oh, why do I need to see the problem? But from a security standpoint, that should be what you're, you should be looking for. The issue is also how red teams are being managed. You know, so here's, I mean, your example is perfect because you came in for an interview. So you provided a free service. Okay. You provided a free service of a vulnerability assessment.

Speaker 9: 22:42

Yep. And

Amotz: 22:42

now you found a vulnerability with one officer for free.'cause you came for an interview. Uh, and it's something that you could ask. And I've, I've seen that happen where people are asking people as they come into an interview, as you came into the building, what did you see? Correct. Like from an adversarial standpoint? In fact, in, one of my previous employer, my first day on the job was to red team.'cause nobody knew me yet.

Speaker 9: 23:08

Yeah,

Amotz: 23:09

perfect. You know, you're coming in, nobody knows you, you were hired through an office somewhere else. Why don't you know, why don't you red team us? And that's a way of doing this in within budget. But I would say, okay, you found a vulnerability. What do we do with this officer? Do we kick him out? Do we talk to him? Do we use this information to empower him and yes, that we should use this information in order to coach him? Just like, again, let's go back to the analogy of the football field. My son plays lacrosse, okay? He played football before. On a Monday morning after the game, over the weekend or the Friday before that, the coach sits them down and they go through videos of what, went wrong. You know, why didn't you protect your right, or why didn't you protect your left? How would you do it better next time? And that's what we need to do with security officers as well. We need to tell'em, Hey. You missed this game, it's okay. But now put your, you know, your ID card inside or in a way that would not show your, your name or understand if someone interacts with you, you need to ask them questions this way or the other. And then you can even add a force multiplier to it by not just training this officer, but making it a much be, you know, something that everybody can learn from. Like my, my son and the lacrosse team. It's not just him that if he made a mistake, he learned from it. But everybody watches the video together and everybody makes mistakes, but they get better and better. So if we use that analogy and we, we can really coach our teams this way, uh, it, we we do a better job in, in prevention. And that's what we need to do.

Yoyo: 24:59

I mean, you almost crushed me there with that. And quite rightly, you know, I, I didn't see that as an outcome in terms of why I didn't get that job. Because I was thinking I've gone above and beyond. I've done something to help me stand out as a consummate professional, the critical thinking space, you know? Uh, and so, yeah, it hadn't occurred to me that I was bringing them a problem they didn't wanna see. And I'm thinking, but these are security professionals. Why then on the broader scheme, do we have such a tough time as security professionals trying to convince other security professionals that there are problems they need to see? Then let's talk about that.

Amotz: 25:38

I think it's, at the end of the day, human behavior and security managers are humans. And then, I've had a, by the way, a very similar situation, to you where I didn't come in for a job interview, but selling, our services, our chameleon services, that include red teams. So we had, for instance, we worked with a major client for a long time with the head of security that asked every day, tell me where I'm doing things wrong so I can better my security system. And so we attacked and attacked and attacked, you know, with quote quotes attacked. And, the security system became better and better over time, not because of our effort, but because of her effort in that regard. She was a very confident, security manager in her position., She wanted the feedback. That's a good manager that wants the feedback constantly of where to improve. She left to a different position, got, an offer from another organization and a different head of security came over. Within a month we were asked to stop red team because it was overwhelming. Yeah, overwhelming. I needed, I need to do so many things to, but that, yeah, but that's the way. So it's a very similar to you. Now I look at those two heads of security taking on the same position. Um, and, and those heads of security had a different approach. One wanted to know, the other one felt comfortable not knowing now. One of the things that, you know, um, we, we, one of the organizations that I came from, uh, that I worked many years ago in, had this, uh, kind of motto that we can afford being attacked. We cannot afford being surprised. So the issue is how do you not get surprised in security? You don't get surprised by constantly simulating the attack, by constantly being aware of the adversaries methods of operation. Now if you haven't done this, you will be surprised. I mean, you see the biggest, the attacks that had the biggest impact in the world are attacks where, um, you know, we were surprised by the mo by the, you look at nine 11, you look at October 7th, you look at many, many, many attacks around, around the world. Uh, whether it's criminal attacks or um, or terrorist attacks, the surprise element is what really creates the terror impact.

Yoyo: 28:17

But can I challenge that fractionally? Sure. Because if you look at each of those cases, there are a number of different events that led up to the heat, the escalation, I suppose. Uh, when you, especially when you look at nine 11, and you look at the lack of comms between the CIA and the FBI that led to serious intelligence not being shared. There were, there was already significant intelligence about airline pilots that were not keen to learn how to land planes. And so there were lots of, um, things that should have been picked up on. So some would say, now was it really a Black Swan event? Because. All the signs were there, but we didn't listen. And isn't that complacency? Uh, I think we referred to that. Uh, the, in the, in the Metropolitan police, I think one of our former heads of policing said, you know, complacency is our biggest enemy. Don't listen to those signs. We don't follow those signals. We don't act on those learning outcomes. So I would put that to you. Okay.

Amotz: 29:20

To, uh, apply common sense to it. Uh, I would say this, that when it, came to nine 11 or any, almost any incident that you can think of. Um, but nine 11 is a good example. You have two categories of failures here. You have the intelligence failure, and you have the security failure. Okay? Now, the way I look at, intelligence is always the outer ring of security. Okay. Meaning it's the unseen ring, the outer ring that if the FBI or CIA or military or the uk it would be the, uh, you know, MI six or the military or whoever caught the bad guy prior to him coming to the facility to do the bad deed. Then we won because intelligence didn't fail. But intelligence is bound to fail. Why? We can go into, you know, it's cognitive dissonance sometimes, that it's

Yoyo: 30:15

bad intel,

Amotz: 30:17

bad intel, or even if you have intel, you didn't analyze it the right way. Why? Yeah, because you're under a different concept of evaluating this type of intel does how intelligence fails. On September 11th, they also came in, and. The system failed as a security failure. Now, where was the security failure? It was the lack of understanding of the MO of using, using, uh, aircraft as missiles, suicidal missions using, and in that regard, it is a black swan event, by the way, multiple hijacking of several aircraft in the same time, same day happened in the past. 1970 is a good example of that in Europe, by the way. But, uh, but that mo and the way they used it was not contemplated and put into the procedures. Why? Because it never happened before. To circle back to something we already talked about, predictive profiling. In order for us to be better than the adversary. We don't just need to work based on the moss of the past, but the MOS of the future. That's why we predict, predict the MO and what we profile as the MO How do we predict the mo? Going back to another subject we talked about is red teams, because not all red teams need to check the system that it does things well, you know, in terms of officer so and so ask me the right questions, process me the same way. That's one level of red team. Another level of red team is to constantly check the system for MOS that our system doesn't deal with.

Yoyo: 31:55

I have to, I have to ask you, do you think AI can help us with that in terms of agen ai?

Amotz: 32:01

Yes, I think so. I think in terms of, generating, um. Ideas on mos? Uh, absolutely. I mean, and again, talk about nine 11. The biggest failure of nine 11 according to the nine 11 commission, was lack of an imagination. And the ability to imagine the mo, the ability to imagine that this thing could happen both on intel and in terms of security, but in, but AI can definitely be a source for helping us first design systems with more mos in place. Second, in providing a better, better ability to make decisions. But the decisions will be human. At the end of the day. It wouldn't be AI making the decision. It would be a human making the decision. It will just support the decision making. That's what I think.

Yoyo: 32:51

Yeah, I think you are right. And the other thing that you said, which I thought was fantastic, was looking at the moss of the future, because when we all saw the, the pager attack. By the IDF. I think a lot of us in the security profession, potentially even those who have ever worked in any type of clandestine services, would've thought, well, that was freaking clever. You know what I mean? Because of the preparation that would've had to have gone on. And I just think nobody, I thought it was genius. Nobody could have seen that coming. And I think you've kind of made my head go into a space where I'm thinking, how do we keep thinking like that in terms of, you know, stuff that people can't, foresee coming.

Amotz: 33:35

The pager, uh, attack what done by the Mosad by the way? Not the IDF. Oh, I apologize. But, um, it is, um, it is, it, it shows the creativity that an adversary would have. Now, this is an organization that operates. You know, under, uh, you know, one of the things about intelligence agencies, especially the ones working outside of the boundaries of their own country, whether it's Mossad or CIA or MI six or whoever, they're all basically, uh, criminals under the, uh, guidance of the state. Because their job, if they're doing it well, is to break the, the laws of other countries. Let's face it. in order for you to be good in that role, you have to be creative. And adversaries constantly come into to, organizations that they want to target or facilities and say, okay, how do I get past this and past the security, past this wall, past this fence? And they come up with innovative mos. That's how we need to look at it when we come into to an organization that's how you looked at it when you went to an interview, uh, a job interview. But, we need to look at it this way. And you could see, even if we take the example of aviation security, you could see that, okay, they tried to put it, you know, after nine 11, they tried to put it in shoes. Well, then we put a countermeasure for shoes. Then they put it, you know,, in their underpants. Then, you know, under the hat, whatever. They're constantly trying to see what are the measures that, that organizations don't have. Because if you don't employ something, a methodology like predictive profiling, you're always the, you're one step behind them, always creating a countermeasure for an MO that was already realized as opposed to, let's figure out the moss. Let's figure out through red teams if they're actually applicable and put countermeasures. And if you do that to bring it to another subject that we talked about that actually saves money. Because usually knee jerk reactions to countermeasures that come into an attack that already happened are usually exaggerated over the top, often not necessarily effective, uh, and definitely not provide a comprehensive solution for a security system. But if you find something that, to your point, you know, with, uh, information, uh, that shouldn't have been di uh, divulged about a security officer in a secured facility, the correction to that is very, very small, minimal, and doesn't cost money. But if the attack came from exactly that point. You know, then we will have people hired just to run issues and whatnot. The countermeasure would be over the top.

Yoyo: 36:35

Yeah. So in fact, you, you have my head going towards prisons a little bit there because if you ever wanna see how quickly adversaries can adapt, is getting drugs and prohibited items into prisons because you stop one way of it coming in, it comes in the other way. You stop that way, it comes in another way. And before you know it, they're dropping drones with tennis balls full of heroin, you know, in the backyard. And they move very quickly. They, they think very quickly. They always one step ahead. It is really crazy.

Amotz: 37:04

And you look at, for instance, the shoe bomber. Yeah. Who came and, and tried to attack, American Airlines. He was a, he was in prison for five years. Studying. So his mo was obviously tested in prisons, which is to put, you know, the, in this case, explosives, but it probably in prisons was drugs or other things in the shoes as a way to go past metal detectors. And so he learned it somewhere. He practiced it somewhere. He was trained on it, possibly and probably in the, in during, while he was in prison in the uk. And then brought it to another environment, which is an aviation environment.

Yoyo: 37:44

And he also trained with Al-Qaeda. It was a British chap, apparently got caught trying to set light to the explosives in the plane. I mean, for goodness sake. Wasn't that bright, was he at all?

Amotz: 37:55

Yeah, but security failed prior to it, you know, and although they were designating him as a suspicious person and even a threatening person, the protocol failed there. For many reasons. But yeah, if we look at how he studied the mos, he could have gotten it from Al-Qaeda, but I would, you know, if he brought his own training, it probably something that came on from his prison time in the uk.

Yoyo: 38:18

So it's thanks to, Mr. Reed that we all had to take our shoes off at the airport. Therefore, you know, prolonging, I mean, I didn't want to take my shoes off and put my socks back into my shoes having walked in that I just found it all a bit ick. But did you know that the FBI has, has an artifact related to this case, and it actually is Richard Reed's shoes. They've probably got it in a internal museum somewhere.

Amotz: 38:45

By the way, that shows you that the countermeasure for an incident like that was, it became all over the world. There, there are issues with that I have with those countermeasures that are overwhelming like that to, to a specific incident like that in terms of really analyzing the MO here, with regards to, in this case, shoes, you know, it was a specific kind of shoe with a specific kind of sole that allows to infiltrate a certain amount, you know, so are these,

Yoyo: 39:17

are these the ones that Mel Gibson has to wear on set because he was a bit on the short side, a little bit of a,

Amotz: 39:23

maybe that's the, maybe we should refuse, uh, uh, shoes on sets, you know?

Yoyo: 39:30

Yeah. Like if, if you are on the short side, check out the soles, uh, because Yeah. Um, he came over to shoot, uh, Braveheart and one of my sites. Was was up in the area. And of course he was frequenting the area, going to pubs in the area in Scotland and right out in the middle of nowhere. And they came back to me and said, oh, you'd be ever disappointed. Yoyo, he's quite short like that he's actually wearing these kind of block heels on every set to make himself look taller. So that's,, Lance stayed with me that unfortunately, so they would be a great shoe, I think, for security and TSA or border control, you know, all around the world customs to look at any men wearing those. Yeah. Not my flip flops. I mean, why should I need to take them off? You know,

Amotz: 40:16

yeah. The big Dr. Martins, the, you know. Yeah.

Yoyo: 40:21

I mean, can you imagine those lace ones go right up to the knee and you're like, oh, I've gotta take that shit off. I can put it back on again.

Amotz: 40:28

Yeah. But you see, everything is contextual and that context is the, you know. I'm tying it back to things we already talked about, but it, it's exactly the context that, uh, the officer needs to make. I mean, if it's, uh, Mel Gibson wearing shoes that are, have these big soles well, why? Because he wants to appear taller. That is completely okay within the context of, uh, you know, uh, short men, a set short men, but also in a set. Okay. But you put that same behavior, if you want to call it in a different environment. And that could be, you know, let's say, visiting, you talk about prisons, visiting someone at a prison with these kinds of soles, you're saying, okay, that I can associate with the mo of infiltrating drugs or weapons or explosives or whatnot, and therefore I need to check these shoes. Uh, you see, something that would be abnormal in a set becomes suspicious, uh, in a different setting. Why?'cause, and then I said that I'm going to talk about the difference between suspicion and abnormal. Abnormal, yeah. So the difference here is in a prison setting someone with these kinds of soles that correlates with an MO If you can associate an abnormal activity or any kind of activity with an mo, a method of operation of an adversary, that means that you have suspicion that it is suspicious. If you can correlate any kind of adversaries mo with the, what you've seen, the behavior, the situation of the object, therefore the object is just weird or abnormal or strange. So often the more mos, you know, the more suspicious things around you, become because you can correlate MO to an activity. But that is also a function of training and red teams and all that because., You're, again, you're not just looking for abnormal activities, you're looking for suspicious activities. And in order to do that, you have to be familiar with the mo with the method of, method of operation of the adversary. Otherwise, you'll just look at him, at a person or a situation and say, ah, weird, strange, you know, abnormal

Yoyo: 43:02

Amma. Are there any good soles in prisons?

Amotz: 43:05

Good soles? Well, they apparently they're all innocent.

Yoyo: 43:12

We were talking about thick soles and I prisons, and I thought soles in prisons, otherwise I would play on words. Yeah, I like, I like that what is abnormal is not suspicious, but. Our brains are usually very good at picking up abnormalities. In fact, in the uk following the terrorist attacks we had on, in July 7th, 2005,, the common messaging to the public was if you think it's suspicious report because you've seen something that isn't right, report it, it's abnormal, report it.'cause they just wanted people to start believing that if it's abnormal, it, there's something that could be wrong with it. People are a lot more open to looking for the abnormal now, aren't they?

Amotz: 43:55

Yes. And, look, uh, the, the issue is, uh, not to look or not to report. That's where I'm, uh, that's my approach to this. Not to report everything that is abnormal. I mean, I live close to Hollywood. There's a lot abnormalities here that I shouldn't be reporting because I would say that even the abnormal behavior here is quite normal. So, so I would say this, what we need in order to get people to be more aware, we don't really need to teach them about what makes someone suspicious. We just need to teach them about adversaries, methods of operation.

Speaker 9: 44:34

Mm-hmm.

Amotz: 44:34

Like how people do surveillance, how people do do the crime. If we have a better understanding of how. Uh, people do the crime, an intimate understanding of it. We will see abnormal situations as suspicious because we have the capacity to correlate these things. And one of the things that we, uh, I mean, one of the training methods that I have, it's also to, to some extent, I gotta tell you, it's, it's more of a sales, uh, pitch when we go to an organization and, and a CEO, general manager or head of security says, look, I believe what you guys are telling me that, you know, but I need everybody to get it, to have a buy-in. So when we go to organizations and we, we start projects with them, often we go to, you know, the HR department, the operations people who don't necessarily deal with security on a regular uh, basis. We sit them together all in the same room. And what we do is what we call an adversaries workshop. So if you work for, uh. Um, I don't know, whatever organization. Let's say a school, we tell that school, the staff there, your job is to kidnap a school, a a kid from the other school across town.

Speaker 9: 45:51

Yeah. Okay.

Amotz: 45:52

What do you need to know? How would you do surveillance? How do you get, see what you're

Yoyo: 45:58

doing?

Amotz: 45:58

And, and so now you have the, uh, local teacher and the head of school or whoever operations, the, the receptionist thinking about kidnapping. Yeah. Sometimes it's actually quite interesting, fun to where they talk, talk about how they're going to cut their limbs off and things. Hey guys, we're just okay. Um, but the, the interesting thing about it is that they go. They think like a bad guy for the first time. And then what I do is I say, okay, you had this, this approach of a, you know, of a bad guy. Now let's put on the head of security hat. And now let's move back to your facility, your organization, your school. And uh, think now in terms of if this was done by someone else to you, like they are now preparing these mos, what would you do to better, uh, the security in your community, in your organization? With one caveat, I don't want you to spend a single dime, a single dollar, single, you know, Euro, whatever it is. I don't want you to, to, to spend one thing. Whatever resources that you have, and the answers are always the same. We need to push, push the perimeter outward. We need to approach people, question them. We need to look at 1, 2, 3, 4, and five. You know, those are the suspicion indicators. How did they come up with the suspicion indicators? They came up with it because they were put in the adversaries shoes and they were able to therefore know what made them suspicious. If they engaged in, you know, with an organization or with a target this way. And so when I come into, let's say, uh, build the sort of, uh, the, uh, get the buy-in from an organization, I don't talk to them about security. I let them figure out the security on their own by putting them in that adversarial mindset.

Speaker 9: 48:07

Wow.

Amotz: 48:08

Uh, I think, and usually it works well, you know, it works well because people, it's a creative process, but they, they, you, you kinda see that how their kinda light bulbs, uh, appear after exercise like that where they start, oh, I didn't think about it this way. I didn't think. Of course not because you were thinking about it from a different perspective. So

Yoyo: 48:33

you, you, you honestly, that school example's phenomenal when you were talking about the teacher that came up and talked about, you know, cutting limbs off. I was thinking how to say you watch Dexter without saying you watch Dexter.

Amotz: 48:44

Yeah, yeah. But, and, but you know, sometimes we are so protective of, of people within the organizations that have, and especially that's why I gave you the school environment because, in the US when we work with school, they said, you know, don't mention the word shooter or active shooter. It'll stress them out. It's something that is spoken in every, uh, uh, every evening when you watch the news., It's on our screens all the time. So the idea of hiding the threat from the potential targets, I think is, you know, it really, it's not fair to the potential targets. They need to know that the threats exist. Now, how to deal with that threat. Look, there are actually three ways to deal with threat, from a sort of psychologically speaking. And we saw it very well during the pandemic actually, when the threat, not, not, an adversary here, a health threat, affected all of us. And you choose as a person to deal with threat, either by panicking, you know, with panic. With indifference, I don't care. Doesn't matter. It doesn't exist. The threat doesn't exist. It's

Yoyo: 49:56

not, it's not gonna get me.

Amotz: 49:58

Yeah. Uh so either panic, you know, let's not, let's completely, you know, take a, I know

Yoyo: 50:05

a toilet roll, you know,

Amotz: 50:06

bio cam suit as I go into the supermarket,

Yoyo: 50:10

put a box over my head. Yeah,

Amotz: 50:12

yeah. So those are the two extremes. Okay. And the, the, the elevated path we want people to be is, be in is a level of awareness. What's awareness? Awareness is the knowledge of the MO First of all, the existence of the threat. But also this is what it takes for an adversary to do what they're doing usually involves surveillance, usually involves in information gathering. This is how they would do it, this is how we can prevent. So giving them tools also to deal with it. Simple tools, not over the top. That's where people to be.

Yoyo: 50:49

There were two scenarios that I can think of straight away during COVID that used to spin even rational people out of control. One of them was, if I'm at the park, my dog touches another dog, and that dog's owner's got COVID, can that dog pass COVID through to me? And the other one was, if a jogger is running past me on a path and I inhale their breath, can I catch COVID? And even sensible people were thinking, yeah, that's a good point actually, because it is airborne. Do you know what I mean? It was hard times for even the rational

Amotz: 51:25

For us who also lived through another pandemic, which was the AIDS pandemic. We remember all of those things that came with that as well. Mm-hmm. And so why? It was lack of awareness with knowledge that created panic, or if it was too much to handle, it created indifference, but. But when we move it to security, really not the difference, by the way, between what you were referencing here and the way that when we train about MO, we differentiated MO from scenario. Not every scenario is an MO

Yoyo: 51:58

Yes. Okay. Oh, agreed. Yeah.

Amotz: 52:01

So the example I I give is the movie Oceans 11. Go on. You know how to, you know, Rob a casino? Well, it works in the movies, that type of scenario. Yeah. But it's not an MO is something simple, something that can be executed. It requires not a lot of contingencies from the adversary. So, you know, plan A must work. If you look for instance, at nine 11, it was at the end of it, it was simple. It wasn't complex, okay. It was simple. And so most. MLS are simple. Yeah. And that's what from a security standpoint, we need to, we need to, address, if we are in the security role, we all, one of the things that we need to establish for ourselves is what is the level of adversary that we're dealing with. If the adversary is at the level of an intelligence agency, your point about the pager attack, then, you know, a, a different country that operates against us, then we have to prepare against some very, uh, you know, robust, possibly savvy, complicated moss. But if we're, if our, uh, you know, to take it to the other side, if our adversary is the local thief or pickpocket or whatnot, then we're talking about, um, mos that are really easy, simple, and, um, easily preventable.

Yoyo: 53:36

Interesting that even though it was simple then to execute nine 11. Mm-hmm. I like to think that it isn't simple now because of all of the security hardening that's in place and that's the,

Amotz: 53:48

yeah. Battle That I would say also the awareness of people, the awareness of the O makes it diff more difficult. I mean, look, nine 11 at the end of the day wasn't an issue of screening. It wasn't an issue of screening. It was an issue of access to the cockpit. Mm-hmm. So that was the issue, wasn't the screening'cause under regulation, they were allowed, that's why they did it. They did it with box cutters because they knew it was an allowed item. So even if it was to be caught by screening, it would've been given to them. They knew it because they prepared well. For it. They knew the regulations of screening and all of that. Yeah. What was missing was the what to do in a situation like that with access to the cockpit by the pilot. Yeah. And, and so again, it's the analysis and understanding of the MO Now why did we in nine 11 put in, uh, you know, and the US built a TSA 60 plus thousand people. Uh, don't take your shoes off, don't take this off liquids. All of those things that came with it. Afterwards, we did that because we did a security countermeasure That applies to marketability how, you know, selling it to the people that use it, rather than doing a countermeasure that really affects the adversary. You see the, the, you see the issue. We wanted to give the world that flies around here, we're doing something. Look, trust. You could, yeah. You know, we, we scream, but that has nothing to do with the Yeah, with the mo The mo was access to the cockpit and there were measures that were put into access to the cockpit. But that is the main thing that prevents nine 11, I would say more so than anything because all of us know, I mean, you could use a piece of plastic that you broke off of a, in the plane to sandwich box.

Yoyo: 55:48

Yeah,

Amotz: 55:49

yeah. Whatever. Something

Yoyo: 55:50

simple. Yeah, yeah, yeah.

Amotz: 55:51

So, yeah.

Yoyo: 55:53

I find it hard though, to imagine going back to a world where the cockpit isn't secure and you look back at how we lived in that world and it just seems absolutely crazy that we would never protect that space

Amotz: 56:07

the recognition of the MO became evident on nine 11. Yeah. But if that recognition of the MO became evident to every pilot around the world, as in, as a, as something that they need to contend with. And I've trained a lot of pilots Okay. On security and most of the, and I don't know how to fly airplanes, but they all told me that I can fly any plane in a way that, nobody would get to the cockpit. Okay. You know, take it up, down, whatever. They are not, nobody's gonna be able to stand. Okay.

Yoyo: 56:44

Just nose dive it.

Amotz: 56:45

Yeah. But if you're looking at a countermeasure, that makes sense.

Yoyo: 56:49

Mm-hmm. Yeah.

Amotz: 56:50

That doesn't cost money now, but it needs the recognition of, to begin with, to come up with this kind of countermeasure. Yeah. The pilots look. This is, you do not give away the plane. That is absolutely not. But if you look at the regulations and the SOPs that pilot worked with during nine 11, it was based on mos of hijackings from the 1960s

Speaker 9: 57:16

Yeah.

Amotz: 57:17

Seventies, where it was mostly ransom for money and things. So the idea was give them the plane, we'll land in Cuba, we'll send the, you know, they'll host hostages. We'll, yeah, this, we'll have a nice beach vacation for two weeks in Cuba and everything is gonna be fine. We're good. The MO was not inserted into the SOPs of pilot, you know, crazy. So, yeah,

Yoyo: 57:44

just utterly mind blowing. Am Did you. Did you always know you had an entrepreneurial, let's find out a little bit more about you before we finish. Mm-hmm. Did you know that you were always that entrepreneurial minded, or did you kind of one day think, Hey, this is looking good, feeling good, I'm gonna roll with it and make shit happen?

Amotz: 58:05

Um, I, I don't know. I think it, I think I added the entrepreneur part to a, you know, after, uh, many successes and mostly failures,, which is what you need to do in order to be an entrepreneur, is constantly go in and try new things, um, and try new businesses and failing them. But this business, the chameleon, which, I'm the CEO and owner I've been doing for many years and, and, and I've had a lot of failures in this, in this business. Uh. Um, but I mean, overall, if you try constantly, you fail often enough, you get better and better and better. And the business is a thriving business now with a good brand name with clients all over the world. And we've been in business 30 plus years. Um, so, I'm very happy. But all of that is a function of training and actually a lot of those things we talked about, you know, kind of red teaming yourself, not just from a security standpoint, but also a business standpoint, knowing where we're not doing the right thing and where we need to improve constantly.

Yoyo: 59:16

I know some people listening that are gonna be going away and red teaming themselves. I

Amotz: 59:20

hope so. Maybe we influenced the industry in, in, in some way.

Speaker 3: 59:26

Amotz, what have you got coming up, uh, for the end of the year? Anything exciting?

Amotz: 59:30

So we have a, we have a training where, a seminar where we're gonna present a lot of the content that was, mentioned here. But go in deeper and, and in a more, uh, methodological way. And that seminar is gonna happen, in November, beginning of November in London. And you can look it up on our website, chameleon associates.com

Speaker 3: 59:53

in London.

Amotz: 59:54

In London, yes. Awesome. I a different accent by then we're chameleons.

Speaker 3: 1:00:03

Listen, you mentioned earlier that you live near Hollywood. I know that you are used to this very, you know, temperate weather over there, but you're gonna need to put some clothes on when you come over to London in November. Okay. Just giving you the heads up.

Amotz: 1:00:15

I travel enough to know the London weather. And I know to start every conversation with a conversation about the weather with the britts which we haven't, by the way. We didn't talk about the weather.

Speaker 3: 1:00:28

I usually talk about the weather all the time, but I am a bit fanatical about it. So, uh, yeah, that's why I talk about it. That's my excuse. But, great. Good luck with your event.

Yoyo: 1:00:39

Only the best movers and shakers on the Security Circle podcast Amotz. We don't just have any riffraff here. You know, always winners, top leaders, thought leaders, awards, winners, global influencers, CEOs. I mean, the best of the best, quite frankly.

Amotz: 1:00:56

Very good, very good. That's, I, you know, I'm honored to, to be part of that, a part of that.

Yoyo: 1:01:02

You passed my screening service. What can I say? I'm not genuinely a real pleasure. Listeners connect, build your network. Amotz, thank you so much for joining us on the Security Circle podcast.

Amotz: 1:01:13

Thank you very much. Thank you.