INFORMATION SECURITY FOR THE FIREARMS RETAILER — YES, IT MATTERS

By John Clark, NSSF Security and Compliance Team Member

I know, I know, internet security is just one more item in a long list of things a small business owner must pay attention to. Unfortunately, and as I’m sure you all know, your cyber-security will continue to require your focus, with no end in sight, in today’s world, so we do need to talk about this topic.

Now, I know someone out there is going to say, “Information security? That doesn’t have anything to do with me!” To those people I’d respond, “You bet your sweet data it does!” So, let’s talk about why this is important to every firearms retailer. In doing so, I think it’s vitally important to begin by establishing a strong foundation and then start to layer on the minutiae that can consume all of us when it comes to this topic. But I’ll also provide translation of this minutia down to what I like to call “you-and-I language” that will cut out all of the “Check out the big brain on John” speak and gets right down to the meat and potatoes of it. Here we go!

You’re Replacing the “Big Guys” When it Comes to Cyber-Attacks

The fact of the matter is that up until the last few years or so, small businesses weren’t really even on the radar of hackers and cyber-criminals. Quite frankly, they were going after the big players, which has been much more lucrative for them. Nowadays, though, the once more lucrative targets and their sizable wallets have been able to mitigate much of this problem, and this has caused the “evil empire” of hackers to look for new targets. Enter the small business.

As of the close of 2016, approximately 43 percent of cyber-attacks targeted small businesses, a staggering increase year over year of more than 40 percent. Taking into account that, according to the Small Business Administration (SBA), there are 28 million small businesses in America, accounting for 54 percent of all U.S. sales, that creates a very nice “site picture” for the cyber-criminal.

Now let’s scare you a bit: The SBA also reported that only 14 percent of small businesses rate their ability to mitigate cyber-risks, vulnerabilities and attacks as “highly effective.” Fourteen percent! Of even greater concern, 60 percent of small companies are forced to go out of business within six months of a cyber-attack due to the associated financial implications.

I don’t know that any of those numbers have caused you any great concern, but what I do hope is that now that you’ve seen these stats, they’ve at least caused you to think about what information or data within your environment as a firearms retailer is or may be of interest to those looking to exploit your vulnerabilities.

More Valuable Than Your Firearms Inventory

It’s important to keep in mind that as an FFL you have quite a bit of very desirable and valuable information for which you’re responsible for its safe keeping. The personal information associated with a firearms transaction alone offers an evil-doer an extensive amount of information that is, for all intents and purposes, the currency of the criminal underground. And that’s really just the tip of the iceberg. As a business, you have the ultimate responsibility of protecting whatever information your customers have entrusted to you — and this is, ultimately, the “why” that deserves your interest and focus.

Cyber-criminals who are able to obtain personal information can sell it to identity thieves, spammers, botnet operators and organized crime rings, who then use the information to make more money. The value of your data to them is dependent on what information they can exploit. How do you know whether your in-house data is of interest to them and at what level? Let’s look at something we can all easily relate to and have equal amount of animosity for — spam — and a hypothetical case study.

Let’s say a spammer obtains a list of, say, 10,000 emails from an evil doer for, let’s say, $100. That breaks down to $0.10 per email address. With that list, the spammer can now solicit, via email, every address on it. Now, if the spammer is promoting a specific product for which he receives a commission for of $10 for every unit, even if only a few people out of that list of 10,000 buy the product, it’s a profit for him — and all his “effort” included was paying for the email addresses, creating a tempting sales pitch, accessing a mass emailing software solution to send it and patiently waiting for payday.

I deliberately kept the numbers very simple in this example, but I promise you, no spammer ever sticks to just 10,000 email addresses. They are looking for and buying lists that contain hundreds of thousands of email address files. But you didn’t think that they were spamming you just to be annoying, did you? Spam is also the vehicle for phishing schemes, which is the fraudulent practice of sending emails purporting to be from reputable companies in order to induce individuals to reveal personal information, such as passwords, credit card numbers, etc.

All of this being said, there’s one significant component of all of this we haven’t discussed, and that is your customer. Data breaches have a lasting impact on customer loyalty, and based on industry studies more than 60 percent of consumers surveyed indicated they would likely end their relationship with a business after their personal information had been exposed. In addition, the majority of those surveyed also advised that they would at least consider taking legal action against an organization involved in the exposure of personal information. Using the percentages provided, along with the fact that the average cost of recovery from a data breach for a small to midsized business has been estimated to be anywhere from $36,000 to $50,000, you can easily see how a breach can impact your business, as well as determine the probability of recovery.

Spam is only one area of concern and certainly not the most serious of all of the areas in which we’ll be discussing in subsequent articles, but it’s certainly one pathway that can open the door to much more lucrative opportunities. Indeed, information or cyber-security is a very broad topic, and we’re going to walk you through all of the areas of concern that can be relevant to small and midsize businesses in this series of articles so that you may be better equipped to protect your business, your customers, your employees and yourself.

In the next article, I’ll discuss establishing best practices and policies that will set the stage for protecting sensitive information you’re responsible for. Until then, please send us your questions and comments and we’ll be sure to incorporate them into future articles. In the event you have a concern regarding the security of your business and are in need of immediate support, feel free to contact John McNamara, jmcnamara@nssf.org, and he will help to coordinate NSSF resources to support your needs.

John Clark is a firearms industry consultant and a member of the NSSF’s Security and Compliance Consultant Teams. He is also the principal partner and founder of PCI Services, LLC, a consultancy firm that provides small to mid-size businesses with sustainable solutions that positively affect growth and protect interests. John has served as an executive in a variety of public and private domestic and international businesses, where his responsibilities have included implementing risk and loss mitigation strategies, governmental compliance initiatives, business assessment and control functions and the implementation of corporate governance practices. Visit www.pciservices.us or email jclark@pciservices.us for more information.

2015
 Nov 22

The following is a script from “Active Shooter” which aired on Nov. 22, 2015. Anderson Cooper is the correspondent. Ira Rosen and Habiba Nosheen, producers. The coordinated strikes in Paris, carried out by terrorists at multiple locations, as well as the attack this past Friday in Mali, are the latest examples of what American law enforcement calls “active shooter cases.” These are situations where gunmen are intent on killing as many people as possible, and often are still shooting when the police arrive on the scene.

LEARNING FROM THE PARIS ATTACKS

Anderson Cooper, on assignment for 60 Minutes, begins the story from Paris…
What happened here a week ago Friday is law enforcement’s worst nightmare: multiple shooters attacking multiple locations, stretching the resources of police, and crippling a city. There was only one active shooter attack in the United States in 2000, but by 2015 there were more than one a month. They usually involve just one gunman, but American law enforcement has been expecting a Paris-style attack in the U.S. for years.

Bill Bratton: In American policing, we have no answer for why we don’t have more of these events and why we don’t have more that are very specifically put on by terrorist-related activists.

New York Police Commissioner Bill Bratton says the NYPD has been preparing for that kind of attack ever since the 2008 terrorist strike in Mumbai, India, that killed 173 people and shut down a city of more than 18 million for three days.

Anderson Cooper: What did you learn from Mumbai?
Bill Bratton: The idea of the multiple shooters consciously going in a lot of different directions.
Anderson Cooper: Multiple shooters, multiple locations.
Bill Bratton: Multiple (shooters) who had bombs in taxi cabs, railway stations, the hotel. We also learned that these people are going to take hostages only for the purpose of media attention. They’re going to kill them. They’re not interested in negotiating to surrender. They’re negotiating just to extend the span of time that you in the media are going to cover what they’re doing. So that’s a very significant change where we normally try to rescue the hostages through negotiation.
Anderson Cooper: After Mumbai, you fully anticipated, we’re going see that here in the United States?
Bill Bratton: That’s correct.
Anderson Cooper: And you still believe that?
Bill Bratton: Still believe it. And that’s why we prepare for it.

The New York Police Department is so concerned about a Paris and Mumbai-type attack, they’re retraining all 35,000 police officers in the city. They allowed us to watch some of what they’re doing. Detective Raymond McPartland is the lead trainer with the NYPD Counterterrorism Division and says its critical police move in quickly to stop an active shooter.

Raymond McPartland: The big piece I always tell people is time is of an issue for both ends. The shooter always wants more time inside because that’s more victims. We need to cut his time in half, if not minimize it completely, by getting there quickly. And that’s a complete shift, a paradigm change for law enforcement across the board. Getting in there quickly means overcoming chaotic and confusing situations in pursuit of the gunman.
Raymond McPartland: So now you got a shot. So now that changes what we’re doing here because we’re going to go in that direction. In this drill, a team of four officers has to stop an active shooter in a classroom full of students some of whom are already wounded. Responding officers are told to focus on finding the gunmen, before they try to treat any casualties.
Anderson Cooper: It’s also got to be tough because you have hysterical people in a classroom, they’re going to be screaming, “Help this person, help this person.”
Raymond McPartland: Yeah, sure, and just think of the psychological aspect. I mean, you go into a school shooting and you see children. You see– this is something anybody’s going to want to bend over and do whatever they could to stop that. But what we try to instill in them is that we need to stop the killing further.

In another training scenario, we watched the police respond to a simulated attack by two terrorists with rifles, loosely based on what happened in Mumbai. They immediately engage in a gun battle with the first shooter who’s surrounded himself with civilians.

Raymond McPartland: The issue becomes now you’ve got a crowded hallway. So this is how they are going to have to deal with it.
Raymond McPartland: If you notice on the floor, there is a bag. At the very least we should start thinking IED, explosive device. It’s something we are concerned about. For the first officers on the scene information is limited, and often contradictory. With every second that passes more people could be dying.
Anderson Cooper: The adrenaline is pumping so much that it changes the way you think. It changes your judgment.
Raymond McPartland: Sure. It’s a survival instinct. There’s a man with a gun that’s in that room and he’s trying to kill other people.
Anderson Cooper: Right.
Raymond McPartland: And under stress, the idea of stress science is fascinating when it comes to our world because your vision goes down to about 17 percent under stress.
Raymond McPartland: If I said “long guns,” if I said “tactical gear,” and I said “terrorism,” what’s the one thing you should also be thinking about?
Officer: IEDs?
Raymond McPartland: IEDs. Thinking about bombs.

Afterwards, Detective McPartland reviews the exercise with the officers and asks them about the bag that was left in the hallway.

Officer: I didn’t notice the bag.
Anderson Cooper: If you had noted that that was an IED in that bag, would you still keep going for the shooter?
“People say, you know, ‘What is it that keeps you awake at night?’ It’s not all the things that we train for and we know about. It’s the one thing that we haven’t yet thought about. What is it that we’re missing?”
Raymond McPartland: Unfortunately, yeah. If we had to stop for every bag we found, then obviously we’d have a problem because we would never get to that guy.

A number of American cities have been retraining their police in a similar way. Washington D.C. Police Chief Cathy Lanier says their preparations have taken on new urgency since ISIS made a threat this week to launch attacks in Rome and Washington.

Cathy Lanier: People say, you know, “What is it that keeps you awake at night?” It’s not all the things that we train for and we know about. It’s the one thing that we haven’t yet thought about. What is it that we’re missing?
Anderson Cooper: We’ve now seen a number of people who are just ideologically motivated, who say they support ISIS, but may have no actual direct connection with a group like ISIS, but just they’ve watched some videos and they’ve decided to…
Cathy Lanier: Even scarier. Less trip–
Anderson Cooper: That’s even scarier?
Cathy Lanier: Less tripwires. Less opportunity for us to intercept.
Cathy Lanier: I don’t think you’re going to stop the shootings. I think that a person who’s committed to carrying out an act of violence like this is going to carry that act out. How successful they are and how many people they kill, we can try and intervene on.

Police departments started to take a serious look at how they respond to active shooters after the attacks at Columbine High School in 1999.

Anderson Cooper: Columbine was a real turning point, in terms of reassessing strategy in active shooter situation?
Cathy Lanier: Yes, it was huge. So, we based a lot of our training, for active shooter response, at the local law enforcement level. We based a lot of our training on Columbine.
In Columbine, two troubled teenagers freely roamed the school killing 12 students and a teacher…while outside hundreds of law enforcement personnel set up a perimeter and waited for 45 minutes before going in.
Cathy Lanier: And I very distinctly remember a parent being interviewed who said, “What were they waiting for? They have gun, my kids don’t have… none of our kids had guns.”

In the recent, Paris attack here at the Bataclan concert hall, police waited 35 minutes outside for the tactical team to prepare before going in. A U.S. law enforcement source described that as a “familiar old American model” that has been abandoned. Columbine taught police they had to get in fast despite the fact a SWAT team might not be there.

Cathy Lanier: This is a homicide in progress. You can’t wait for backup, you can’t wait for the SWAT team. You are the only thing that can stop that shooting. You have to get in there and do it.

That’s what Washington D.C. police did in 2013 at the Navy Yard when a mentally-ill employee began shooting his coworkers.
[Radios: ”We have an active shooter. A male with a shotgun. Multiple shots fired. Multiple people down.”]

Cathy Lanier: Our first call to 911 came in one minute and 36 seconds after the first shots (were) fired. We already had multiple people that were shot at that point.

Chief Lanier learned a number of lessons from the police response to the Navy Yard shootings. Some of the rifles police had were too big for the narrow corridors the shooter was moving through. And the sound of fire alarms made it difficult to determine where shots were being fired from.

Cathy Lanier: The flashes you see are the fire alarms. The fire alarm’s been pulled. The fire alarm’s going off. It’s loud. And they’ve got gunshots being fired, and they’re trying to narrow down where the gunman is so they can get to the gunman and stop the shooting. It took police an hour and nine minutes to kill the shooter.
Anderson Cooper: And of the 12 people who were killed, the first 10 were killed how quickly?
Cathy Lanier: Six minutes.
Cathy Lanier: That fast.

According to the FBI 60 percent of active shooter attacks are over before police ever arrive, so now law enforcement agencies throughout the country are trying to educate the public on how to survive on their own.

Cathy Lanier: Your options are run, hide, or fight–
Anderson Cooper: That’s what you tell people they should do?
Cathy Lanier: Yes.
Cathy Lanier: What we tell them is the facts of the matter is that most active shooters kill most of the victims in 10 minutes or less, and the best police department in the country’s going to be about a five-to-seven minute response.
Cathy Lanier: I always say if you can get out, getting out’s your first option, your best option. If you’re in a position to try and take the gunman down, to take the gunman out, it’s the best option for saving lives before police can get there. And that’s– you know, that’s kind of counterintuitive to what cops always tell people, right? We always tell people, “Don’t– you know, don’t take action. Call 911. Don’t intervene in the robbery”– you know– you know– we’ve never told people, “Take action.” It’s a different– this is a different scenario.
Anderson Cooper: You’re telling them that now though?
Cathy Lanier: We are. It is important to remember that as tragic and scary as these active shooter attacks are, it’s highly unlikely you’ll ever be caught up in one.
Bill Bratton: You have a very low chance of being a victim of an incident like this. But what we try to do is encourage awareness. The idea is to have an awareness without creating a fear.
Anderson Cooper: A person’s chance of actually having some sort of encounter with an active shooter is, like, one in two million. A person’s chance of being hit by lightning is one in 700,000. Do you worry about an overreaction? People getting too scared, fearful of something which in all likelihood they will never encounter?
Cathy Lanier: You can be prepared and you can have a society that is resilient and alert and conscientious and safer without scaring people.
Anderson Cooper: You don’t want people to be afraid?
Cathy Lanier: No, that works against you. If you educate people on actions they can take to reduce their risk, then you can save some lives. And I think it’s irresponsible for us not to do that. I’m not worried about an overreaction. I’m more worried about a numbness to what is potentially a reality.
Anderson Cooper: A numbness?
Cathy Lanier: Yes.
Anderson Cooper: How do you mean?
Cathy Lanier: Just ignoring it and not preparing yourself. That’s not an option anymore.

Make no mistake these cowardly terrorist attacks are similar in nature to active shooter situations and I can’t help but wonder if at least some of these unfortunate victims couldn’t have survived if someone had helped them have some level of preparedness. My goal here is to reach as many people as possible and provide them with the ability to develop a plan and gain at least some level of insight of how to respond if we find ourselves in any type of active shooter situation.

If you are not willing to lay your life on the line, which I can completely understand, at least ensure both you, your loved ones, coworkers or whomsoever may be important to you are prepared to take the appropriate steps to do what you can to survive! It’s unfortunate to say, but a harsh reality… The brave men and woman of our law enforcement, who prepare themselves to respond in these situations, have their hands full and are limited in numbers and we simply can not expect them to be everywhere every minute of every day and the further reality is that it will take them time to respond in the event of an incident. You can not count on the ability of the police to respond in time and more importantly you certainly can not count on the mercy of criminals.

I believe Milwaukee County Sheriff David Clarke, Jr. said it best, “You can beg for mercy from a violent criminal, hide under the bed, or you can fight back. You have a duty to protect yourself and your family.” I’ve attached the Department of Homeland Security’s Active Shooter Planning booklet, which provides an abundance of information for formulating a plan for a business. The same information, with a few modifications, can be used to formulate a personal or family plan as well.

Criticize me if you would like, cast that stone, then go make your plan! It could very well save your life or the lives of others!

DHS Active Shooter Booklet

The first thing to remember if you’re thinking about giving someone a gun is that . . . it’s a gun! You already know that ownership of a firearm brings with it some serious legal and ethical obligations that other consumer products don’t. So let’s look at some questions you may have about giving a firearm as a gift.

The first question you have to ask is whether the intended recipient can legally own the firearm where he or she lives. More than 20,000 different gun laws on the books, even the kinds of firearms that law-abiding citizens can own vary from place to place; for example, juveniles (under age 18) generally speaking are precluded by law from possessing a handgun. Check out the Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) website for an overview of local laws and, whatever you do, don’t forget that you can never under any circumstances transfer a firearm to someone you know — or have reasonable cause to believe — legally can’t own one. That’s a federal felony, so be careful.

There’s no federal law that prohibits a gift of a firearm to a relative or friend that lives in your home state. Abramski v. United States, a recent Supreme Court decision involving a “straw purchase” of a firearm did not change the law regarding firearms as gifts. The following states (California, Colorado, Connecticut, Delaware, New York, Oregon, Rhode Island, Washington State) and the District of Columbia require you to transfer a firearm through a local firearms retailer so an instant background check will be performed to make sure the recipient is not legally prohibited from owning the gun. Maryland and Pennsylvania require a background check for private party transfer of a handgun. There are exceptions, so it’s important to carefully check the law of your state or ask your local firearms retailer.

The ATF recommends that if you want to give someone a new firearm, rather than going to a gun store, buying it on your own and giving it to, say your father, consider instead purchasing a gift certificate from that retailer and giving it to Dad as his present. That way he’ll get the exact gun he wants, and there’s no question about who is “the actual buyer of the firearm,” which is a question any purchaser must certify on the Federal Form 4473 at the time of purchase.

You can only ship a handgun by common carrier (but not U.S. Mail) and a long gun by U.S. Mail or common carrier to a federally licensed retailer, but not to a non-licensed individual in another state. With all carriers, federal law requires you to declare that your package contains an unloaded firearm. To be safe, always consult your carrier in advance about its regulations for shipping firearms.

What if you want to give “Old Betsy,” your favorite old deer rifle, to your son or daughter as a college graduation gift? Again, in most states, there’s no law that says you can’t, but some states require even inter-family transfers to go through a licensed retailer. Remember, you can never transfer a firearm directly to another person who is a resident of a different state. In that case, you must transfer the firearm through a licensed retailer in the state where the person receiving the gift resides. Using a gift certificate from a firearms retailer near where the recipient lives might be a good solution. Pre-1898 antique firearms are generally exempt from the retailer requirement. Be safe and check with your retailer or local law enforcement before you hand over your prized possession.

It’s often an emotional moment when a treasured family heirloom is passed down to the next generation. These moments are part of what our cherished enjoyment of firearms is all about and represent that unique bond that sportsmen have with their fellow enthusiasts.

So enjoy the holidays and do it right!

The principal partner and founder of PCI Services, LLC, a consultancy firm that provides small to mid-size businesses with sustainable solutions that positively effect growth and protect interests, Clark also serves as the Director of Asset Protection Operations for a major retail sporting goods chain with responsibilities spanning more than 450 individual retail locations. Prior to these positions, Clark served as an executive in a variety of public and private domestic and international businesses, where his responsibilities have included implementing risk and loss mitigation strategies, governmental compliance initiatives, business assessment and control functions and the implementation of corporate governance practices. He is a former U.S. Air Force non-commissioned officer, holds a B.S. in Criminal Justice Administration, an A.S. in Industrial Security Management, serves as an active member of the FBI’s Domestic Security Alliance Council and is a member of the Board of Directors for the Coalition of Law Enforcement and Retail.

“We are very excited to have John join our team of FFL Compliance Consultants,” said Patrick Shay, NSSF Director, Retail Development. “His experience in retail asset management and protection, his proven leadership abilities as an executive in both public and private enterprise and his extensive background in ATF compliance will bring a new and valuable dimension to the compliance consultations NSSF provides to its retail members.”

“Being invited to join the team of consultants supporting the NSSF mission and its member community is both humbling and extremely exciting for me,” said Clark. “This team has such a vast amount of knowledge. I look forward to the opportunity to partner with each of them to continue supporting this great organization and supporting the continued development of safety and security solutions for the NSSF.”

NSSF provides a team of FFL Compliance Consultants, most of whom are former ATF officials, to work with its members in an advisory capacity and aid them in issues of regulatory compliance. For more information on becoming a member of NSSF, email membership@nssf.org or visit nssf.org/join.

-30-

About NSSF
The National Shooting Sports Foundation is the trade association for the firearms industry. Its mission is to promote, protect and preserve hunting and the shooting sports. Formed in 1961, NSSF has a membership of more than 11,000 manufacturers, distributors, firearms retailers, shooting ranges, sportsmen’s organizations and publishers. For more information, visit nssf.org.

]]> http://www.pciservices.us/uncategorized/asset-management-professional-business-executive-john-clark-joins-nssfs-ffl-compliance-consultant-team/feed/ 0 http://www.pciservices.us/uncategorized/asset-management-professional-business-executive-john-clark-joins-nssfs-ffl-compliance-consultant-team-2/ http://www.pciservices.us/uncategorized/asset-management-professional-business-executive-john-clark-joins-nssfs-ffl-compliance-consultant-team-2/#comments Mon, 23 Mar 2015 17:24:48 +0000 http://www.pciservices.us/?p=6333

To: ALL MEDIA
For immediate release

March 23, 2015

For more information contact:

Bill Brassard
203-426-1320