Schneier on Security
A blog covering security and security technology.
« How to Negate the Security of an Access Token |
| AACS Cracked? »
December 28, 2006
Wal-Mart Stays Open During Bomb Scare
This is interesting: A Wal-Mart store in Mitchell, South Dakota receives a bomb threat. The store managers decide not to evacuate while the police search for the bomb. Presumably, they decided that the loss of revenue due to an evacuation was not worth the additional security of an evacuation:
During the nearly two-hour search Wal-Mart officials opted not to evacuated the busy discount store even though police recomended [sic] they do so. Wal-Mart officials said the call was a hoax and not a threat.
I think this is a good sign. It shows that people are thinking rationally about security trade-offs, and not thoughtlessly being terrorized.
Remember, though: security trade-offs are based on agenda. From the perspective of the Wal-Mart managers, the store's revenues are the most important; most of the risks of the bomb threat are externalities.
Of course, the store employees have a different agenda -- there is no upside to staying open, and only a downside due to the additional risk -- and they didn't like the decision:
The incident has family members of Wal-Mart employees criticizing store officials for failing to take police’s recommendation to evacuate.
Voorhees has worked at the Mitchell discount chain since Wal-Mart Supercenter opened in 2001. Her daughter, Charlotte Goode, 36, said Voorhees called her Sunday, crying and upset as she relayed the story.
"It’s right before Christmas. They were swamped with people," she said. "To me, they endangerd [sic] the community, customers and associates. They put making a buck ahead of public safety."
Posted on December 28, 2006 at 1:32 PM
• 102 Comments
To receive these entries once a month by e-mail, sign up for the Crypto-Gram Newsletter.
This is NOT about security, it is about safety. Wal-Mart willfully endangered its employees and customers. This all because of the all might dollar. In fact, I would say that because they thought about it, it makes it that much worse.
Agenda and security are independent of each-other. And if they aren't, tell me, what SECURITY benefits did Wal-Mart get because they didn't evacuate?
Wal-Mart received no security benefits for staying open. Security is a always a trade-off; you have to trade-off something for security. In this case, the trade-off was revenue, potential liability, potential bad press, and so on. The question Wal-Mart had to answer is: is the additional security obtained by closing the store worth the costs. They decided that it was not, and I agree with them. Of course, they decided based on their agenda: revenue is important. And, of course, the employees disagreed because their agenda is different: their own safety is more important than the company's bottom line.
@Reid: How far do you want to go with this? Wal-Mart willfully endangered its employees and customers by being in the retail business and thereby providing physical targets in the first place.
Of course, my agenda is more online sales... so you'd expect me to say something like that ;-)
In which of the following cases do you think they should have evacuated:
1) The bomb threat is for "a Wal-Mart in South Dakota".
2) The bomb threat is for "a store in Mitchell, South Dakota".
3) The bomb threat is for "a Wal-Mart"
4) The bomb threat is for "a store in South Dakota"
5) The bomb threat is for "a store".
Unless you answer "yes" to all 5 above, there is some point at which the risk to the employees and customers is lower than the benefit of keeping this particular store open.
In any case, if there is willful endangerment, it's by the person(s) who plants the bomb(s), not by an entity who decides whether or not to evacuate based on (presumably) little evidence of actual danger.
One downside to an evacuation is potential for panic and crowd control problems. Trying to evacuate a bunch of customers who may or may not want to leave ("I just need to get one more thing.."), could have been a major headache (and a golden opportunity for shoplifting), I've never worked for Walmart so I don't know if employees get any training on things like evacuations.
Not saying that it offsets the danger of customers (and employees) getting killed if the store explodes, but it's one of the issues with an evac.
How many phoned-in bomb threats are not hoaxes? WalMart is right to treat them skeptically.
I'm tired of post 9/11 CYA - diverting planes because somebody smelled a match or not letting people fly because they pray in public.
Someday some fool really will blow up a crowded WalMart. It will be a horrible tragedy. It will also be without warning.
Part of Wal-Mart's decision is they didn't want the goofball caller to get his jollies seeing Wal-Mart panic, shutdown, and have an emergency evacuation. It is reasonable for Wal-Mart to avoid the mode where this goofball can shut them down every day for an hour - just by calling from a different phone each time. The police have better things to do, too.
Managing the jollies is part of security.
> Wal-Mart willfully endangered its
> employees and customers
No, somebody called in a bomb threat, and Wal-Mart decided it wasn't credible, but had the police investigate anyway.
If Wal-Mart planted a bomb in their own store, that would be willful endangerment.
I agree with the basic premise of making a cost/benefit analysis based on a risk estimate, but I'm still not sure they made the right choice. It reminds me of a case involving an oil company a friend works in where the company chose to pay a 300 million dollar settlement instead of take to court a case they were 99% sure they would win, simply because if they lost the company would be toast. I'm sure a multi hour evac during the holidays would hurt, but I can't imagine how damaging 50 or 60 dead would be (remember, crowded), and that would obviously be nationwide.
I know there are a lot of bad tradeoffs being made on the side of pretending terrorist threats are bigger than they are, but even from a purely economic point of view I'm not sure this is an example of levelheadedness. But for all I know the bomb threat was called in by a giggling 12 year old. The article of course doesn't say.
"If Wal-Mart planted a bomb in their own store, that would be willful endangerment."
I think the crime would be much more serious than that.
The police "recommended" an evacuation and WalMart didn't comply. That's my problem.
If school officials "recommend" that parents do this or that and the parents don't do it the school blows them in.
I would say that WalMart is on the police "black list" and they will be more likely to ORDER and evacuation next time.
Your thoughts? Bruce, were you saying it's a good risk to ignore police warnings based upon the on-duty managagement's judgement?
I don't agree that declining to evacuate is the same as refusing to be terrorized. There is still an obligation to the safety of employees and customers, which should be taken seriously, but was ignored here.
This response to a bomb threat is no different from ignoring a fire alarm in a large office building or college dorm. Granted, 99 times out of 100 it's just some idiot smoking next to a smoke detector, and there's no real safety threat to the building residents. It's still irresponsible not to evacuate, for reasons not worth belaboring.
My guess is the reason for not evacuating has little to do with fortitude, and a lot more to do with not wanting to spook customers from returning after the alarm was over. I bet that if the bomb threat had targeted Wal-Mart's corporate headquarters, they would have evacuated in a heartbeat.
It's all fun and games until someone gets blown up!
Considering the security-tradeoffs you also have to consider the possibly higher risk of causing a dangerous mass-panic during an evacuation vs. the (most likely low) risk of an authentic threat. Of course, if the store had been England and the caller had given an IRA-codeword, the situation and the possible trade-offs would have been completely different, but in Mitchell, South Dakota? Always deciding to flee if someone says "boo" to you on the sidewalk might cause your death in a traffic accident.
Yes, this is about security. Security is principles and practices that protect the person or entity (corporation, in this case) from loss. From whatever source.
"In fact, I would say that because they thought about it, it makes it that much worse."
I am unaware of the concept that managers should not carefully consider various factors before making life and death decisions.
>> what SECURITY benefits did Wal-Mart get because they didn't evacuate?
1) Avoiding injuries and resulting liability from a (possibly panicked) evacuation. Even the announcement can cause people to get upset. Scared employees make matters worse. Wal-Mart is not well known for providing emergency response training to employees, either.
Consider the people who have been hurt from rushing into the store for sales. Multiply by everyone trying to rush OUT at the same time, because some employee botched the P.A. announcement. Just for fun, add armfuls of stuff grabbed on the way out.
2) Standing up to terror. Calling in a bomb threat is a terrorist act, pretty much by definition. There is substantial direct and indirect value to resisting an act of terrorism. Reduced likelihood that someone will call in a bomb threat just to see the disruption in the future, for one. Positive publicity from people like me, for another.
3) Profit. Yes, it may be a dirty word, but it pays the bills. If you choose to evacuate, you choose to not make money. In fact, you lose a chunk of change, from sales not made, shelves not stocked, and work not done. (No, we're not going to evacuate the customers and have the employees restock as usual . . . or are we?)
It costs nothing for the police or fire departments to recommend evacuation. They have to think about liability, too, and not recommending evacuation could cost the city a chunk at budget time if something goes *BOOM*. I wonder if there's guidance given to cities by the major commercial insurance agencies on this subject . . . have to do some research.
Wal-Mart self insures the majority of their losses, so they were playing (either way) with their own money.
I would be . . . irritated with a Wal-Mart manager who just happened to decide, "Let's not evacuate . . . but I'm going to take a long lunch break." I would fire them so fast they'd still be looking for their ass two hours later.
Out of curiosity, why do you (Bruce, I mean) agree that this was a good decision? Of course not giving in to scares is a good thing, but being reckless isn't, and since the story doesn't actually say anything about the threat, the only piece of data I myself have to judge the whole thing is the fact that the police recommended that the story be closed while the search was carried out.
So this actually seems like a bad decision to me: Wal-Mart decided that a comparatively small but guaranteed impact on their bottom line was more important than a relatively unlikely but very costly (in every sense) explosion, but the decision was based on their agenda, not the recommendation by a supposedly neutral third party.
It's a pity the story doesn't say how specific the threat was (as Fred P said above, there's a difference between, say, a bomb threat for "a store" and a bomb threat for "this particular Wal-Mart"), though - that would've made it easier to form an opinion on whether the police's recommendation was itself justified or not.
The goal of a terrorist is not to kill people. The goal of a terrorist is to cause terror. I'm no fan of Wal-Mart, but it's quite plausible that they had good evidence that the threat was a hoax, and made the right call in this case. By freaking out every time some fool says "boo," you support terrorism. Wall-Mart should spin its decision in these terms. Not only does it sound good, it's true.
Oh, my understanding was that Wal-Mart doesn't really listen to any government agency's advice unless forced to at great expense to the taxpayer, whether it be the police, fire, environmental protection, labor, etc.. Perhaps you could call it their default-deny rule.
It would be interesting to know if they had contemplated a safe way to alert people in the store about the threat, or if they had decided that there was no way they would ever inform their consumers and let them make their own decision about the risks.
I think the manager of Wal-mart made the right decision in staying open, however, they could have warned the customers about the threat, and allowed them to make their own decisions. I remember when a local Wal-mart refused to let customers leave during a tornado warning... I guess the threat was more eminent, and therefore justified?
When you consider the global view, I think it becomes obvious (but I could be wrong) that this is the right decision.
The standard policy of evacuating any building that gets a bomb threat allows anybody to shut down a building with almost no work and no risk. The ubiquity of public pay phones makes it trivial to call in a threat with basically no risk of being caught, and in return for your twenty minutes of travel (assuming you want to get reasonable far from where you live or work) and fifty cents of change, you can shut down a major store, mall, school, etc.
When somebody calls your house and asks if your refrigerator is running, do you check? When they say you'd better go catch it, do you run outside just in case? If they called about a bomb, would you leave your house? I'm sure nobody reading this would answer "yes" to that, but we have no problem answering "yes" if it's a store.
We absolutely must acknowledge that any reasonable policy will not place an infinite value on protecting lives. If such a policy were enacted, Wal-Mart (and any other store) would simply never open in the first place. Society would shut down. Unless you find that acceptable, you have to realize that there are going to be tradeoffs and you can't simply dismiss this decision out of hand because it supposedly endangered people. That doesn't mean you must think it's a good decision, but if you're going to argue that it's a bad one then you need better reasons than "safety first".
@JohnE: "I remember when a local Wal-mart refused to let customers leave during a tornado warning... I guess the threat was more eminent, and therefore justified?"
Wow! Now THAT's a gutsy management decision. Several hundred cases of false arrest, as well as the liability from assuming their facility would actually withstand a tornado.
It might well have been the right decision, in many ways, but it was still a very gutsy one by the standards of modern MBA groupthink.
Interesting isn't it.
Walmart is being accused in these comments of having poor judgement - but there wasn't a bomb!
Hysteria aside; how could they have been more right?
"From the perspective of the Wal-Mart managers, the store's revenues are the most important; most of the risks of the bomb threat are externalities."
If the store's revenue is the most important thing, how would making the wrong call be good for their revenue?
Does anyone here honestly believe that a day's operation is more important than a having a place to operate?
Do they expect their costs to go down or future consumer demand to incease as a result of making a bad call?
Did they suddenly stop paying insurance or something?
If revenue was that important to them, simply staying open would not have been a good decision, if they turned out to be wrong. It would also be a fateful decision for those managers that may wish to stay in their jobs.
The only extent that there is an externality is the extent to which the officials want to make it one, otherwise most of the costs associated with accidents are always paid by their victims, and their insurers, whether they be natural or man-made.
The cry about money-over-safety is ridiculous once evaluated property: profits-over-long haul IS more important than profits-today plus high risk of not making profits for a long time thereafter.
The real externality is being told to evacuate by an official who bears no risk either way.
@Andrew: "Calling in a bomb threat is a terrorist act, pretty much by definition."
I don't necessarily agree. There are many definitions of terrorism. Here is a popular one:
"Terrorism is a term used to describe violence or other harmful acts committed (or threatened) against those considered innocents by groups or persons for political, nationalist, or religious goals."
In this case, there are many people that could profit from this threat. The perp could have been an employee of the Walmart store, wanting this holiday off with pay. He could have been a manager at a nearby K-mart or Target, hoping to increase their business (and personal bonus). @dp already mentioned he could have been a shoplifter or team of shoplifters using the threat as cover to their exit.
Without knowing the intent, this cannot absolutely be classified as a terrorist act.
There are generally two kinds of bomb threats. Either there is a bomb and the caller wants it found. Or there isn't a bomb and the caller wants to cause a panic.
During the late 60's and early 70's it was almost routine for anarchist groups to plant real bombs and call in threats while giving the police plenty of time and enough details to find the bomb. Many more bombers accidently killed themselves making and planting bombs than there were bombing victims.
Today there are terrorist groups who do want to hurt people with real bombs, but they don't call with a specific threat.
The idea that someone would call in a specific bomb threat and intend for the bomb to explode is pretty much an invention of Hollywood.
"It's all fun and games until someone gets blown up!"
My mother used to say something like that.
WalMart did the right thing.
Are we going to hold a nation hostage over unsubstantiated school-kid aged threats?
Recently near me (Auburn, MA) a middle school kid accidentally brought some .22LR rimfire rounds to school. One fell out of his pocket, and was found on the hallway floor.
The School went into lock-down, the entire facility searched by the PD for the afternoon looking for a "gun".
It should come as no surprise that the following week there was a copy-cat incident exploiting this over-reaction.
Maybe most surprising is...the school and PD did the same routine all over again of lock-down and search.
They had given up any and all control of the situation -- their policies, and their lack of willingness to make rational choices in how to carry out those policies meant they no longer had control; instead that control would be given to any middle school student who chose to bring in a tiny object and drop it anonymously in the hall or bathroom or other common area. Uh oh, we found one...lock everyone down, start spending lots of time searching everywhere...
"were you saying it's a good risk to ignore police warnings based upon the on-duty managagement's [sic] judgement?"
This assumes that the police have a better idea of what a credible bomb threat is than the on-duty manager and frankly, in Mitchell, SD, I'm not sure that's a realistic assumption. I'm skeptical that the local police force there has any practical training in bomb threats.
When I lived in LA and was employed at a well-known software company, the police forced us to evacuate due to a bomb threat. When they let us in 40 minutes later in small groups, they told us that we should check around our cubicles for Walkmen or other similar devices. They were totally oblivious to the fact that there was already enough RF around to blow the building up 10 times over if that was what was going to trigger the bomb. And this was a police force in a major metropolitan area!
Suppose the caller had rung up the White House to say "There is a bomb on a plane somewhere in the United States." Should all planes immediately be grounded and evacuated? Suppose such calls come in every few hours, every day, for months on end? What should the policy be?
A bomb blowing up an airplane, or a Wal-Mart, is an extremely rare event. Far more common is midair collision, or a tornado striking a Wal-Mart. Both would cost many lives, but we have been managing these risks since Sam Wall was in short pants.
'Better safe than sorry' is a sorry bit of thinking, just like 'all possible precautions'. When you have an infinite budget, you can be free with spending, but when your budget is finite, you have to make decisions. You choice is stupid versus clever.
I used to work in a place where one or more people called in bomb scares because they wanted to get off work early. (One was eventually caught, but we got bomb-scare training, bomb-scare report forms, and stuff I've since forgotten.) Taking every threat in dead earnest, without considering the probabilities and costs, is flat-out stupid behavior, making the organization vulnerable to systematic destruction by saber rattling when the sabers are imaginary and are wielded by pranksters.
I believe this is not a cost-benefit analysis, but in fact an example of something else entirely. Since when have you EVER heard of a bomb threat not leading to an evacuation? Sure, the managers were thinking about the lost sales during Christmas, and the whackos out there who love to mess with Walmart, but really this is about the boy who cried wolf. We've had so many security alerts, chatter, orange threat levels, evacuations, etc over the last few years, that we've become sanguine. There was no other data associated with this threat than the call, and yet some store manager decides it is false? No one would argue that it was the right decision if a bomb had gone off, but in fact we have started to *assume* that such warnings are not actually real...this is real danger in the opposite direction. And this is another danger in the hyped up "security" stance our government has placed us in.
I worked at a Wal-Mart.
They have plans in place that are taught to all employees that are put into effect with a two word message over the P.A.
They are effective and safe.
Why did this manager not bother to implement store policy?
"They have plans in place that are taught to all employees that are put into effect with a two word message over the P.A."
System-wide or store-specific? What are they?
Here's a recent case of the inverse: a fire broke out in a store and customers refused to leave (perhaps they figured they could end up with their "purchases" for free).
I heard about it on news of the weird (http://www.newsoftheweird.com/archive/nw061224.html) but found it online in a couple of places like (http://www.thenewsvault.com/cgi/news.pl?t=706). No connection to either site.
Something like that happened at the University of Southern Maine this past month or two - they've been getting repeated bomb threats, and have been evacuating every time. Finally they got one during final exams and they decided not to evacuate that time, figuring it was another false alarm. Which it was, of course, or you'd have heard this story by now.
Place I used to work had a great policy on Bomb alerts...
It was a Nuclear Physics Research lab and we were told (frequently) that in the event of a bomb alert going off then we could leave the building... But that the bomb might be in a car parked in the car park.
The particular lab I worked in had some large doors going out onto a canal bank. The one time that the bomb alert went off while I was there we all dutifully stopped what we were doing and spent an hour of work time sitting on the sunny canal bank enjoying ourselves... Finally someone told us that the bomb alert was over and we went back in.
Why do so many people think that they know something about security? Who *didn't* make the assumption that the bomb wasn't in a car parked in the handicap space, and the "terrorist" was going to set it off once he observed a sufficient number of people (or firefighters and police, worse yet) congregated outside after the evacuation? Really now, you didn't see 9/11 coming, so you're not going to see the next one coming. When your number is up, your number is up; or believe that your favorite deity has predestined you if that makes you happier. I thank mine that people like Bruce make rational decisions and try to educate others to do so.
"Terrorism is a term used to describe violence or other harmful acts committed (or threatened) against those considered innocents by groups or persons for political, nationalist, or religious goals."
Yeah, really? Can you put a few more qualifiers in there to satisfy whatever agenda you're trying to satisfy? Why don't we just all actually say out loud, "all terrorists are muslim."
Terror is knowing that you could die any time for reasons you can't control. Terrorists blow up buildings in Oklahoma, send people letter bombs, or snipe people on city streets. They don't call in threats at Wal-marts in South Dakota.
Bravo to Wal-Mart! If there's one thing I've observed for the last 3 decades, it's that real bombers don't call in a warning.
It might have been a good idea to get on the PA and inform the shoppers so they could make an informed decision on their own.
Most police are so clueless about terrorist risk and real danger posed, there's no point in listening to them.
Even the FBI seems to be a bunch of glorified security guards these days.
'"They have plans in place that are taught to all employees that are put into effect with a two word message over the P.A."
'System-wide or store-specific? What are they?'
You asked the same question I wanted to.
The code for a shopper-lifter alert at the Target store in Crystal, MN, was (a few years back, now) "Mr. Cook." So, "Mr. Cook, to sporting goods" meant, "Hey S/e/c/u/r/i/t/y/ Loss Prevention! Someone's stealing stuff in the sporting goods department!"
@ Bruce S.:
>>"They have plans in place that are taught to all employees that are put into effect with a two word message over the P.A."
>System-wide or store-specific? What are they?
It's been a while since I returned something to WalMart...but that time there were flip cards sitting right next to the customer service counter, and big enough type that I read a the one that was open while waiting in line. They tabs covered stuff like fires, I *believe* bomb threats, "ADAM" alerts, etc.
Frankly, I would say it's more important for the procedures to be absolutely easy to find for the staff then worry about the risk of someone learning their "flip card" procedures. But it did still raise an eyebrow they were so easy to obtain.
Speaking of good and not so good Public Announcement codes...
Twenty years ago, when my mom worked at a hospital, I remember reading their manual..."Dr. Rover" was a fire alarm -- that made sense to not worry patients on what is often a false alarm. "Paging Dr. Rover" gave the staff a pre-alert if you will without raising undue concern in patients and visitors...*IF* the alarm was verified then another message would initiate the fire procedures.
I was doing work in a nursing facility recently when that PA announced "Code Red" -- followed by "Smoke Detector Activation in Room 123"...makes you wonder why someone would use a "code word" and then provide information that makes it's meaning blitheringly obvious...
@Dave H - "Since when have you EVER heard of a bomb threat not leading to an evacuation?"
Of course, the ones you tend to hear about are the ones that lead to evacuation; why would you hear about the other ones? Even if this had always been true in the past (if bomb threat then evacuation), that does not mean that it was always the correct decision.
"They have plans in place that are taught to all employees that are put into effect with a two word message over the P.A."
Ah, is it "fire sale"? Or maybe "run now"?
But seriously, it appears the codes are posted online:
"CODE RED is for a fire. [...] CODE WHITE is an injury. CODE ADAM is a lost child CODE ORANGE is chemical spill. There are other codes for a shooting/firearm, a hostage and severe weather. If you hear BLACK, GREEN or BLUE, it might be a good plan to run the other way. I forget the exact order. I think BLACK is shooting, GREEN is hostage and BLUE is severe weather."
What, no bomb color? Interesting that one comment claims CODE 99 is for all men to report to a location. Another insightful comment:
"...there was one time when a tornado was spotted within a couple of miles of our store, the county had issued tornado warnings, and the store still wouldn't call Code Black because they didn't want to panic people, and also they didn't want customers looting. Rather useless code."
"This assumes that the police have a better idea of what a credible bomb threat is than the on-duty manager and frankly, in Mitchell, SD, I'm not sure that's a realistic assumption. I'm skeptical that the local police force there has any practical training in bomb threats."
That's a fair point. Wal-Mart was certainly earning kudos for their Katrina response, especially compared with fools like the one appointed by the US President for emergency response. But on the other hand, the theory is that you can elect a different representative, sheriff, etc. when you're dissatisfied with their work. If you're a citizen how do you change Wal-Mart's tornado and bomb lock-down procedures, particularly when they already say they disregard the opinion of law enforcement officers? Do you become a citizen of Wal-Mart?
If they had evacuated the store based on a phoned-in bomb threat, it would be like it was for a while at my school in 1972: If you had a quiz, you got someone to phone in a bomb threat. School evacuates, and the quiz is either canceled or postponed.
It's potentially worse than Blue Flu if, say, employees want to get off early for, say, Christmas Eve.
We've been fed a diet of Fear and Paranoia for too long. It's good to see a company choosing not to panic.
Similarly, the average person doesn't really understand bombs, explosions, and their relative potential damage. They're used to seeing the explosions in movies, where a small car blows up major buildings. People forget that a van full of explosives *failed* to blow up the WTC in the 1990s. They just remember the damage caused by a jumbo jet with a full fuel tank. My guess is that your average backpack bomb wouldn't have much effect in a WalMart, especially if the perp left it in Housewares or Clothing. Bombs in big, open rooms like your typical WalMart don't have enough containment to kill a lot of people; even if the bomb went off, it's likely that only the people standing next to it would be killed; sprinklers would negate the fire threat; and there would be time to evacuate before a major disaster occurred.
Apparently the call *was* a hoax, and that just vindicates the WalMart position.
The definition you cite is close to the one used by FBI. Not surprisingly, state entities try very hard to keep people from thinking of acts of (legitimate) governments as terrorism.
A bomb threat for profit still fits the FBI definition. I could see the argument that targeting Wal-Mart can't help but be political. In this case, it's the nature of the _target_ (as an infrastructure component) that defines the act as terrorist. As other posters have commented ("citizen of Wal-Mart"), Wal-Mart is close to having the kind of power and influence one typically associates with governments and not with corporations.
>> Without knowing the intent, this cannot absolutely be classified as a terrorist act.
I agree completely that the distinction between criminal and terrorist acts has been a casualty of 9/11. From my admittedly arrogant perspective, the hijackings and subsequent deaths were a hideously expensive vandalism and mass murder. However, the President and Congress have chosen not to see it that way -- and thereby played right into the hands of the terrorists, helping them complete their objective of creating fear.
I am thinking that certain types of threats are closer to terrorism than crime, simply because of the aggressor's desire to instill fear to create a change in behavior. A difference of modality, rather than the identity or motivations of the aggressor.
Bruce, what do you think? Was the Wal-Mart threat a terrorist or criminal act? Does knowing the motivation of the instigator help answer that question?
Er, spoke too soon. Looks like Wal-Mart citizenship is not too far from some people's minds. Res ipsa loquitur:
For reference, here's another incident from last July with an even more interesting spin. Wal-Mart evacuated customers but asked their staff to help find the bomb:
"Yanik Deschenes, a Wal-Mart spokesperson, said in an interview with the Canadian Press news agency that the company was only helping police and not endangering employees. Deschenes confirmed that 40 sales clerks were asked to search for the bomb..."
Oh, and the Globe and Mail adds a bit of important detail to the discussion:
"According to police, the store didn't violate any laws and only had an obligation to evacuate the store if a suspicious object was found."
Thus, it appears by law (Canadian, at least) a notice/threat alone would not force Wal-Mart to call for an evacuation. The more I read about this, incidentally, the more bomb scares at Wal-Mart I discover. Here's one involving a suspicious object:
For the record, there are terrorists who call in bomb threats, and their threats are always real. They are the ETA -- 'Euskadi Ta Askatasuna' -- the Basque separatists.
As far as I know, they are alone in this.
One last comment before I go back into lurk mode.
I must say that security people in general have been able to point out many security failings in many aspects of our lives. Examples of this are the failings of airport "security", the security theatre "fixes" and the recent DMV example.
But, when examining these examples, a human factor is not directly present; it is there only indirectly. The people are just the one's carrying out the activities and any negative repercussions would be felt later.
IMO, the people in the US, for the most part, have failed to properly appreciate the human factor when it is *directly* in the equation.
This Wal-Mart story is a perfect example of this. If a bomb went off, 10's to 100's of people would have been killed and most likely 100's more (at least) would have been injured to one degree or another. But, Wal-Mart sides with money and as it seems, most of the people that participate here agree with this.
To provide a contrast to what I mean, if a bomb goes off, I'm not going to feel it a year from now, I'll feel it straight away. But, if I'm on a no-fly list, I only feel the repercussions IF I decide to fly i.e. the human factor is not *directly* in the equation.
I hope that the people in the US will be able to grow beyond this cold hearted "bottom line" analysis soon. Because the current mentality is certainly not socially responsible.
Both Jeff and Zwak mentioned something that I think was a little understated. Let me expand.
I believe a (modern day) terrorist is more likely to call in a bomb for one of two reasons: To terrorise when there is no bomb, OR, to get people to evacuate to NEARER the bomb - i.e the car park / muster area.
It would be far easier to locate a car bomb in the parking outside the store. Parking lots are also traditional places for muster areas. Additionally, A car bomb is likely to be more powerful than one carried into the store, and more likely terrorist method given the wide spread use of car bombs worldwide.
In the WalMart case outlined above, the lack of evacuation would actually save lives.
Whenever I've been evacuated due to a bomb scare (twice), I've always put myself as far from the 'muster area' and emergency vehicle access points as possible. (Why the tinfoil hat? A close friend was injured in the Bali Bombings (by the second bomb which targeted evacuees), and I grew up in Northern Ireland during the IRA active bombing years.)
>Not surprisingly, state entities try very
>hard to keep people from thinking of
>acts of (legitimate) governments as
That's because the proper term for those actions conducted by a state is, "Act of War." At least when directed against persons in another country. Not sure what it is domestically...
I prefer a pretty tight definition of terrorism:
Violence conducted by a non-governmental organization or individual, primarily directed against non-military targets, with the intention to create fear or terror in a civilian population in order to achieve political goals.
It may seem like semantics...but defending rights depends on good definitions -- dumb terms like "War on Poverty", "War on Cancer", "War on Drugs" have hurt the meaning that word...heck, one could honestly question if the tax-cuts-during-war philosophy of the current administration is at least partially rooted in comes from expecting "Wars" to just be metaphors used for expanding government spending.
>Wal-Mart evacuated customers but
>asked their staff to help find the bomb:
That's actually pretty standard practice / training for emergency services -- unlike something distinctive like a pistol, the Police have no idea what a bomb could look like.
You can make an educated guess a bomb threat called into a school or WalMart won't involve a long, phallic shaped metal object with fins on it. But what will it look like? You don't really know. If it had a bunch of wires and flashing lights on it, there probably was no need for a phone call...
The people who work there everyday -- janitors, teachers, clerks are most likely to recognize something that looks out of place in their normal work area whether it's a school hallway, classroom, or store department.
They're not being asked to poke and prod -- just take a look around for anything that seems unusual or out of place and report back.
>I've always put myself as far from
>the 'muster area' and emergency
>vehicle access points as possible.
There is a very strong argument made in the fire service that the FD should never leave quarters for bomb "scares," and if an actual device is found that staging locations are both different from normal "fire" calls *and* change again if there is another incident.
That's to fustrate efforts of a bomber making trial runs with false threats trying to figure out where the emergency vehicles "always" go. Of course, in the highly fragmented U.S. fire service, many departments still will respond to bomb scares and pull up and park in front of the building everytime :rolleyes:
Not that a lot of time is spent on training for these remote possibilities compared to the bread and butter of house fires and car accidents (I've been a volunteer for nearly 20 years, including time as Captain / Training Officer)...but enough when the first tower came down my immediate thought was that it was one heck of a big secondary device going off. That training, in my career, started after Oklahoma City. Some of the older members had similiar stuff back in the late 60s with the student anarchist movements.
Businesses make calculated decisions like this all the time.
The airlines are a perfect example of this. You didn't get TCAS and Doppler RADAR onboard until the cost of fleet-wide deployment was less than the cost of another 157 lawsuits from the families of passengers killed in the last mid-air or microburst-caused crash.
I guarantee you WAL-Mart was making the same calculation and decided they'd lose more money from closing than from any potential damage and wrongful death lawsuits if a bomb really did go off.
> I would say that WalMart is on the police "black list" and they will be more likely to ORDER and evacuation next time.
Maybe. It's also possible that the police gave the recommendation as a CYA measure, perhaps without any expectation that it would be heeded.
@Bruce Schneier wrote:
"In this case, the trade-off was revenue, potential liability, potential bad press"
They managed to get the bad press anyway.
I don't know how packed the store was, but I imagine that during Christmas, buyers already being frantic and nervous, it could have also caused injuries with people rushing out of the store. You see this with the sales, you're not going to see it with a bomb threat?
Of course there's always the possibility that the bomb threat is actually called in by a guy waiting in the parking lot with a machine gun to take out as many of the evacuated customers as possible.
I'm in two minds about thus. I grew up in Britain where the IRA often called in warnings about bombs, sometimes on time and sometimes not. Warnings therefore had to be taken seriously. I think working out how to rationally evaluate the risks of various courses of action as a result of a bomb threat is quite tricky given a) the uncertainties involved and b) the possibility that your decision might affect future hoaxers and/or bombers in an unpredictable way.
In Barcelona, in 1987, the Hipercor "Hypermarket" managers took the same decision.
A car bomb exploded in the underground car park killing 21 civilians and injuring 45, amongst them several small children.
I think it should be the police who decides if the place has to be evacuated. They should be the ones with the knowledge to evaluate the credibility of the call, the amount of people at risk, the risk of evacuation, etc.
And they (should) have the agenda that better serves the public interest.
I'd be interested to know some history about wallmart and security alerts, particularly for that particular store. A decision to not close would either be driven by aggressive adherence to profits over risks or based on previous experience of the management with hoax bomb threats.
It would be great to get some insight into the risk analysis behind this - without it, it's hard to have a decent discussion.
I think balancing out the risk against the threat. Are there real explosives? Or is it just a call to scare people?
If it was just a call, shutting the store for inspection is enough to reach the goal of terrorism (economic/social damage by scaring people off). Calling 200 companies troughout the country saying there is a bomb results in chaos. Mission accomplished.
No. WallMart took the risk not shutting down the store. If there would have been a bomb without the call, it had go BOOM with injured people and maybe even casualties. You don't know that, you can't. Danger is everywhere, every minute. But we learned to be not afraid since the chance is so small. We learned to use our mind and not our heart.
The chance that there was a bomb is smaller than loosing income (it could have been your meal at stake). Economic disaster is worse (we've seen that post 9/11). Some people die, yes that is terrible. Look at Africa or South-America, they know what hunger is. To not let the same happen in the West, we have to prevent economic damage.
- Unomi -
To make a point:
Let's say I'm your colleague and I don't like you. I call you up from a distance and say that your kid and better half are in danger. They are kidnapped.
The first thing you do is going home or whatever to find out nothing has happened. You think the danger is present, that the story is believable.
Besides the call being traceable in most accounts it is possible.
But the chance that a real kidnap is happening is very very small. No, you can't take the risk not believing it. But what you could do is call to your home to see if everything is OK. Rationalize. Think before acting. Mind over heart.
Terrorism is not about casualties it is about fear. Danger present or not present. If you believe it is present while it is not, you loose control and the mission is accomplished.
That is why I don't fear terrorism. It is bogus. I could choke in my meatloaf, that is danger to. So I'm not eating? Bogus.
- Unomi -
I applaud the decision to stay open. There has been good commentry to that effect already, so I won't repeat it.
There seems to be a number of people who equate Wal-Mart with evil and have automatically assumed the worst.
We have no evidence that the decision to stay open was anything to do with maximising revenue. If you read the (linked) article revenue is not mentioned - it was Bruce's presumption.
In fact there is scant information in the article.
You have different groups with different goals here. The police will ALWAYS recommend evacuation, because it CYAs them and costs them nothing. It might even justify a larger budget. WM pays a price either way and therefore needs to make an actual decision and will be held responsible for it either way. If they evacuate and someone gets trampled, they're at fault. If the threat is not credible, not evacuating is the correct answer.
If you call the FAA for flight weather prediction and there are clouds anywhere in the US (picture how often that's not the case!)they say "VFR (visual flight - which is relatively free as opposed to instrument flight requiring huge government infrastructure) not recommended" because it costs them nothing and that way they have satisfied the lawyers. Of course, it also eliminates the utility for which the government has spent our money in the first place, but in the modern US, liability far outranks utility or functionality in the priority list.
Reading about Business Continuity and Disaster Recovery, we are told to secure human life first. Human life is the most important asset, not revenue. For those doubting revenue was the cause to stay open, what else would have been the trade-off in closing? Employee boredom? Which is a bigger trade-off if Wal-mart (who is suddenly a security expert firm?) was wrong - revenue or human life? Maybe they should think of it in terms of the lawsuit if they are wrong next time. They'll be closed and penalized for grief for every customer and employee.
Police are security experts, not Wal-mart.
I don't even think "the almighty dollar" was being placed before safety. It's reasonable to say "it's a pain to evacuate all these people for nothing." That has nothing to do with profit motive. It's the same pain to evacuate a school building or an office building. What are the profit motives there?
I actually don't know how I feel about this. On the one hand, the movie-plot thinker will say, "Well, now a terrorist knows he can plant a bomb, call in a bomb threat, and stores will not evacuate, causing mass carnage." Really? When do these plots result in actual bombs going off? Don't bombings happen without warning?
Oft repeated mantra: "The goal of a terrorist is not to kill people. The goal of a terrorist is to cause terror."
Eh, maybe... I can't figure out the goal of the supposed "Al-Qaeda", the tightly organized network that hasn't caused any terror in this country for years. There isn't the mass hysteria about going out in public or going to public events. I know after 9/11, I thought about the danger of going to an NHL game. It'd be a good target, I thought... approximately 20,000 people. I still went, and so did a lot of people, but you _thought_ about it.
Nobody thinks about it anymore.
Perhaps whatever "terrorist network" is out there really is out there just to kill people (which explains why it takes so long to plan truly devastating plots), or they are not very good at terrorizing. If these are suicide-willing terrorists, there should have been more acts committed in this country. What, is it hard to get in the country?
Or perhaps, there's just a lot of loosely connected people who hate/envy the West and will kill people a) for their religion b) to get money (bounties) for their family c) insert other stupid reasons here.
We don't know... no one who might know says.
@Fred Pat: What if the call is directly to the store, and the threat is: "There is a bomb in your store"?
"If you're a citizen how do you change Wal-Mart's tornado and bomb lock-down procedures"
Don't shop there if you don't like their policies. What gives you the right to force the policies you prefer on your fellow citizens?
I think the only rational move Walmart should have made to maximize its business profits and show respect for its employees and customers would be to announce over the intercom that a bomb threat had been made and people are free to either evacuate or continue shopping (or working).
By withholding that information Walmart forced people to behave in a context that differed from reality - had there actually been a bomb people would have died whereas if given proper information they could have behaved differently (i.e., evactuated).
@RichV: There are substantial costs involved in evacuation that have nothing to do with mere lost revenue. I am assuming that around christmas time the store was fairly full, and that the customers were average people, not a trained team of evacuees like the athletes hired to "prove" that 500 people can get off an Airbus 380 in 4 minutes. Once WM announces that people need to evacuate, with enough urgency that they actually do try to leave without buying something, people will definitely get trampled and injured and quite possibly get killed. I mean people fight and push just to get something on sale, just picture how they will behave if they think their lives an in danger. And once they get to their cars, they will instantly wreck, blocking the parking lot exits. And WM will get at least 1 lawsuit for every 20 people that were in the store when it occurred. Might be better to let the bomb go off and be seen by juries as the victim rather than evacuate and be blamed as the cause.
@bob: Everyone remember - the police were present. SWAT was present. Trained professionals in security situations were present. Wal-mart managers overrode the recommendation of the professionals capable of handling crowds and making security assessments.
Do we prefer the advice and skill of first responders or Wal-mart managers?
>Police are security experts, not Wal-mart.
The police officers who would be responding are trained primarily to do things like hand out speeding tickets and diffuse domestic violence situations. They're not trained to evaluate the seriousness of a threat. By the time you reach people in law enforcement who are, the bomb if there was one probably has gone boom.
In that, they're no more or less qualified then the store management in reaching a the same decision a reasonable man would -- and I used that term specifically due to it's implications in a court of law.
Had there been evidence of an actual emergency situation, the police would have arrested the manager and initiated an evacuation.
>would be to announce over the
>intercom that a bomb threat had been
>made and people are free to either
>evacuate or continue shopping (or
Two, perhaps opposing comments:
1) People routinely ignore fire alarms in shopping malls and stores and keep on doing what they're doing.
2) However, would announcing a bomb threat in a store be tantamount to shouting fire in a crowded movie theater? Is an isolated, anonymous threat sufficient to shout "bomb" and accept the losses in injuries, possibly death, and economic impact?
>Everyone remember - the police were >present. SWAT was present
SWAT in a town of 14,500 = "Hey look, we have military surplus gear!" The reality is a town that small, in a state that rural is highly unlikely to have the resources to train a first class SWAT team. They are most likely good guys, they most likely have some additional training, but situations like this come down to using common sense evaluation of the situation.
To emphasize what I said above -- if it was a real emergency in the minds of the police, they could've arrested the manager. They could've acted entirely outside of the control of WalMart management by having cruisers block the entrance to prevent additional shoppers from arriving (how many people spend 2 hours inside WalMart?).
The fact that they didn't exercise additional powers the Police had at their disposal is pretty good indication their "recommendation" was just a CYA move that they weren't taking this too seriously, but couldn't recommend not to, and couldn't just refuse to conduct a search.
The police are not the experts.
Look at the increasingly common 'lockdowns', where the cops treat a neighborhood as if it is a prison, they are the guards, and the public are the inmates. There is no due process of law, zero. As a rule, these 'lockdowns' come up empty, so there cannot be any argument of 'probable cause'. The people's liberty is stolen from them by an armed gang, and when they get their liberty back they have no legal recourse.
Note that there are never 'lockdowns' in rich neighborhoods, where a few phone calls would get the police chief summarily fired.
The police like to assert their authority, intimidate and dominate people. Besides being fun, it helps reinforce fear of the police.
Look at the evacuation of New Orleans as ordered by the police, which put all traffic on the same escape route at the same time, resulting in a six-hour traffic jam. They also forced people -- at gunpoint -- to abandon their pets.
The only expertise the police have seems to be abusing their powers.
Maybe what we need now is a Superpatriot Act stripping all authorities of nearly all their powers. (Salted with sarcasm.)
Plus the only person who knows EXACTLY what the "bomber" said (wording, sincerity, attitude, background noise, etc) is the poor guy/gal who answered the phone. (Thats why the DoD posts "bomb threat cards" by all phones with a list of questions you should answer during or immediately after receiving a bomb threat call.)
@Roy: dont forget SWAT teams serving warrants for nonviolent or even trivial offenses by kicking doors down with no warning at 3AM and screaming their heads off (out of sync with each other so no one could possibly understand what they are saying) at people who were deep asleep 30 seconds before. The more police there are in the country (or anywhere), the more they become a society all their own and the non-police law abiding citizens are lumped into the same "them" as the criminals they are supposedly being protected from.
When I lived in the UK, I remember hearing references to IRA bomb threats with known code words. Presumably, the idea was that everybody knows the IRA really does have bombs, and really will use them, so they're taken more seriously than random terrorist wannabes off the street.
I also seem to remember hearing the police criticizing some of the warnings as giving them too little time to evacuate. It seems like the IRA wanted to give the police enough time to evacuate people, but not enough time to actually find and disable the bomb. "IRA bomb found, disabled" is not as frightening as "IRA bomb blows up as last people leave Harrod's"
Regardless of the purpose and motive, I did find it somehow discordant to hear the police saying that these particular people hiding bombs in public places cared less about peoples' safety than _other_ people bombing public places...
"They have plans in place that are taught to all employees that are put into effect with a two word message over the P.A."
System-wide or store-specific? What are they?"
System-wide. They are taught as part of a learning module
And you will excuse me for NOT giving them as they would lose their effectiveness as a safety measure (there are a number of codes for different events). This is not to say you would do so intentionally, but news does travel quickly on the net.
You probably know the story about the guy who got the PA access number and was phoning in "Five Minute Sales" from one side of the store to the other?
"What gives you the right to force the policies you prefer on your fellow citizens?"
ROFL. Oh, the irony of suggesting WalMart should be free to force the policies it prefers on fellow citizens but citizens have no equal right...
The "do not shop there" argument would only work if the market weren't already so unbelievably broken. Are you really making a free-market decision when a giant company like WalMart uses its power of coercion to coddle you for profit -- how do you respond when you discover a corporal entity (person or otherwise) is actively preventing you from knowing what risks you face?
Just add that conundrum to the fact that the highest ranking officials may be in WalMart's pocket. This story broke following a settlement regarding violations of child labor law:
"'I am very concerned about this secret arrangement between Wal-Mart and the Bush Administration,' said Miller, the senior Democrat on the House Education and the Workforce Committee. 'This is a company that has been accused of a lengthy list of labor violations. Wal-Mart does not have the credibility to serve as an impartial investigator of accusations of labor violations against itself. I intend to find out how this arrangement was reached and, if appropriate, I will consider asking Congress to rescind the agreement if it cannot be justified.
'Once again, it looks like the Bush Administration is doing a favor for a powerful friend and contributor at the expense of workers who do their jobs and still cannot get fair treatment in the workplace.'"
I think this is a clear case of Wally making a negligent decision. If the building was on fire, they would not have allowed people to enter - because it would have been negligent, and they would have been sued.
Same applies here - WalMart were lucky nobody was hurt, as their action (or inaction) would be clear negligence in operating a safe shopping environment.
They could have announced it over the intercon, which would have absolved them of blame, putting the risk back on the customer - but they didn't....wonder why!!!
they could have told their customers there was a bomb threat and let them decide for themselves.
Their actions were about money; nothing more.
Walmart is a dodgy company at best and not a place you should be offering any support to.
I _think_ that the point Bruce Schneier was trying to make is that it's nice for a change for somebody to be willing to look at a situation and not say, "I know the risk of is really, really small, but my ass is on the line so I'll treat it as likely to happen."
It is _terrible_ for security if people treat every risk, however remote, that is brought to their attention as if it were virtually guaranteed to happen. That's what I see happening too often.
It may be that this guy made the wrong decision; I don't know. But it's good to see that people are willing to see it as a decision.
many of you on wal-mart's side are evaluating the decision from the perspective of what we know now - no bomb. decision analysis requires that the decision be evaluated from what was known at the time. the decision and the outcome are two different things; i'm happy that there was a good outcome.
there's gonna be a cost anytime someone phones in a bomb threat. on the one hand, major casualties, humongous liability - discounted by the likelihood that there's no bomb. on the other hand, certain loss of sales, possible casualties if there's a panic.
i don't think we have enough information here to evaluate the decision. i'm not a fan of wal-mart's business model and policies, but with a mighty effort, i'll spare you the rant.
Here is what was known at the time:
-Bomb threats are called in all the time.
-Bombs typically are not accompanied by phoned in bomb threats.
If it wasn't so logical.
Now, do all bombs have to go unaccompanied by a phone-in bomb threat? No, of course not. However, it does seem to make the bomb less useful (unless the goal is to make sure innocent people do not get injured or killed and still inflict economic, psychological and physical damage).
Some say that "terrorists" want to kill people (so they would not phone in a bomb threat).
Others (like Bruce) say that "terrorists" want to cause terror (which I guess implies that they merely have to disrupt daily life and they wouldn't even need to plant a bomb. I think this is thinking way too abstract for the kind of terrorism we supposedly face, but it is a valid point).
Neither of these cases match phoning in a bomb threat. Combine that with the history of bomb threats versus actual bombings... and you are beginning to come to an analysis that supports a low probability that there was even a bomb.
Change Wal-Mart to... oh anybody that might not be instantly associated with evil and make the same analysis. How about a university? About a decade ago, my university was evacuated once over a bomb threat (and iirc, bomb threats to universities were in vogue at the time).
It seems likely the police asked for the evacuation so that, in the remote chance there was any kind of injury, they wouldn't be held civily liable later. When you live in a society that hands out civil judgments against people who are doing the very best they can at a public service job, then you can expect the servants to properly overreact, inconvenience, and disturb in order to make sure they aren't liable in the future. That's not even a knock on the fine men and women who protect and serve us. I don't blame them. It would end someone's career to be wrong just once, no matter how reasonable the decision was... and they have a family to think about.
"When you live in a society that hands out civil judgments against people who are doing the very best they can at a public service job, then you can expect the servants to properly overreact, inconvenience, and disturb in order to make sure they aren't liable in the future."
By that logic, why wouldn't WalMart also have been more cautious than not? I don't follow how you differentiate.
Could it be that WalMart has no fear of citizen action (civil judgments) and therefore can afford to throw caution to the wind, while public servants can not?
I mean check out the fact that WalMart paid a $135,000 settlement for violating child labor laws in three states over a multi-year period. That's like the same as one week's peanut sales for them. Peanuts. Or, in other news, it is a tiny fraction of what the US government just awarded WalMart in tariff reductions:
Granted, they do pay more sizable penalties, like the 14.5 million in fines for illegal firearm sales in California alone...
"Change Wal-Mart to... oh anybody that might not be instantly associated with evil and make the same analysis."
We could, but don't forget that WalMart always trumpets the fact that they are unlike any other store on earth.
If we give that to them, then we can't then use the "oh anybody" analysis. And even if we don't give them that, we must take into account that they are second only to Exxon-Mobil in total revenues, employ more than 1.5 million people, and the founding Walton family has a net worth equal to Bill Gates and Warren Buffett combined.
It does make you wonder what they could do to make sure they are not held civilly liable, compared to what a small-town American police force could.
For Davi O. The codes for walmart are the following: White=accident
Blue=Bomb, Red=fire, Black=weather, Green=hostage, Orange=chemical, Adam=Missing child, Brown=shooting situation. Did you notice there is a color for Bomb
The thing I find objectionable about Walmart's behavior in this case is their taking the choice away from the customer. Unless I'm mistaken, they didn't put up a sign outside the entrance stating "A telephone bomb threat has been made against this building. We regard this threat as not credible, but please enter at your own risk." Alternatively they could have the management personally inform the customers in the store that there had been a threat, that they thought it insignificant, and that they themselves weren't leaving the building.
If they'd done something along these lines, I guess I wouldn't have much of a problem with keeping the place open for business. But I'm not comfortable with a large commercial corporation with its own motives making this sort of determination for me without giving me the information up front, any more than would I trust them with my medical records.
Bombs are not going off in this country, so there's no real reason to believe one will be. There's no terrorist organization doing this, so these calls are rarely credible.
Most crimes are not called in beforehand.
Most bomb threat calls in the US are not real.
America no longer is the land of the free or home of the brave.
How about I call in and say a hundred will die in car crashes (which of course I don't need to orchestrate since drunks, speeders or the sleepy take care of this by themselves)? At least that threat is more likely to come true, but nobody ever seems afraid about going for a drive.
Risks are not measured. Fear is the game of the day. Freedom is willfully traded for perceived safety. How lame is that, America?
Agreed. But this type of thing went on before 9/11. It is important not to use 9/11 as a scapegoat for it (and you didn't).
The threat may not have been credible. The article does not say (and the reporter may not have access to) details about the threat. The reporter may also not have details about how the police encouraged an evacuation. Perhaps it was, "Standard procedure is to evacuate, so that is my advice. We'll search the store regardless if you wish."
We simply don't know.
We don't know if the manager was being brash or had good reason not to fear a problem (and therefore a civil judgment as mentioned earlier). We do know that a police officer has to fear that erring on the side of the most extreme caution means his or her family will not live without a career's worth of income. There is a difference.
The second quote was taken out of context to merely provide a red herring.
It doesn't matter what WalMart or any store trumpets itself as. What matters is the reasons why the store didn't close. Many of the comments on this post make an analysis that can only be taken as, "Well, WalMart is evil, so it must have been out for money or non-caring about its customers." There is no logic or evidence that this was the case, and merely saying it had to be the case because it is WalMart is a form of ad hominem.
@ C Gomez
"We don't know if the manager was being brash or had good reason not to fear a problem (and therefore a civil judgment as mentioned earlier). We do know that a police officer has to fear that erring on the side of the most extreme caution means his or her family will not live without a career's worth of income. There is a difference."
I'm sorry, but that doesn't make sense to me. Sure, we can't know everyone's reasons for deciding one way or the other (motives, if you will) but we can say that the people working in the store strongly disagreed with the manager's decision and were probably even more in disagreement when they discovered that the police had recommended an evacuation.
From the original article:
"The incident has family members of Wal-Mart employees criticizing store officials for failing to take police’s recommendation to evacuate. Voorhees has worked at the Mitchell discount chain since Wal-Mart Supercenter opened in 2001. Her daughter, Charlotte Goode, 36, said Voorhees called her Sunday, crying and upset as she relayed the story."
Ok, so maybe the store manager was an ex-bomb disposal expert just back from three tours in Iraq and decided his/her employees should not be notified of the risk and the police recommendation should not be followed. Even then it seems the situation could have been handled better, at least so generations of employees might not feel that they have to publicly complain that management made a high-risk decision they strongly disagree with.
Why would you say it does not matter what Wal-Mart or any store trumpets itself as? Aren't those part of the reasons the store didn't close (e.g. "we put the customer first"). Furthermore, how do you come to trust them if you think their words have no value? You can't go on experience alone, since you might not have any, especially as it relates to bomb threats. Or if you do in fact go on experience, you may find a list of violations that could preclude you from ever trusting them again. Shouldn't you be curious what the company says about things?
Seems like an important decision point to me, and judging by their marketing dollars I bet they think trumpeting matters quite a lot.
"Bombs are not going off in this country, so there's no real reason to believe one will be."
Granted, the risk may be low, but to say it doesn't exist at all or never existed...what possible basis could you have?
"Federal authorities charged a 21-year-old college student Tuesday in connection with a five-day spree of pipe bomb incidents from Illinois to Texas that injured six people and prompted a manhunt across the heartland of the country."
"Eric Rudolph left 250 pounds of dynamite hidden in western North Carolina that could have killed "more people after he was imprisoned or executed than he ever did when he was free" had the government not agreed to a plea deal, the top federal prosecutor in Atlanta said Wednesday."
Here's a good article on how people helped with the investigation:
It's important when conducting analysis to ignore what is irrelevant. Many people go for attacks that have no basis in critical thinking. It's important to ignore those attacks and focus on what is important.
What is important is that it is highly unlikely that there was any risk at all in this scenario. My hypothesis is that, if research on bomb threats in the United States (or perhaps in a reasonably defined "Western world") and actual bombings were conducted, there would be found a low probability of them being connected to actual bombings.
Allow me a slight digression to come back to the point:
In other words, starting with common statements such as: "90% of car accidents occur within ten miles from home" (not a scientific statement). Even if this were proved scientifically, it might also be found that 90%+ of car trips take place within a ten mile radius of the home, making such a claim valid, but dubious in its usefulness in further analysis.
"You are more likely to be killed by a drunk driver than killed in a terrorist attack." (Again, not a scientific statement, but similar ones are oft-repeated). This may be very probable. Still, it doesn't mean we can't find links between what activities do tend to indicate imminent attacks.
Finally, let's bring this to our example. I firmly believe that if such a scientific study were conducted, it would be found that the safest place to be when a bomb threat is made is the purported target of the threat.
Bruce is right that you are needlessly terrorized when you evacuate a school, a public building, or a WalMart because of a simple phone-in threat. Perhaps if there were more credible threats (perhaps the phone in to a university is traced to a phone of a known expelled student), you can make a proper risk analysis.
Just because it's WalMart doesn't mean they did the wrong thing. Perhaps what it does is let us think about when we take security theater too far. Just as most of what is done at the airport is truly security theater, evacuating on a non-credible threat is probably also security theater.
My claim is that it's not irresponsible to refuse to be terrorized. This is one case where, upon several days of reflection, I've come to agree with Bruce.
C Gomez> My claim is that it's not irresponsible to refuse to be terrorized.
That might apply if the potential victims of terror had refused to be terrorized. As it was, it was the management who refused, not the potential targets. I don't think that demonstrates anything useful.
I imagine every day CIA analysts are digging through information that could terrorize the rest of us, and deciding what to act on. We're not aware of any of it, so when they disregard some particular datum as non-credible, it has no relevence to how terror-prone we are as a society. If we all were looking at the same information and making the determination ourselves what to react to, then we would see how we are faring.
Terror is about the hoi polloi, not the ivory tower.
My knowledge of the liability on the States is limited but, as it happened on the Hipercor bombing (mentioned by Albert) the responsible is the store' manager (decision maker), not the Wal-Mart Corporation. So, the store' manager is the final looser in this decision game (bad if I do not evacuate, worse if I do).
I do not believe this decision (gambling?) had anything to do with the position of 'not being terrorized by terror', although it may look very brave now. I am quite sure the Hipercor' manager does not think the same.
I worked at a CompUSA that did something similar.
I answered the phone and was told a bomb was going off in 15 minutes in a men's room. I yanked the GM and Sales managers off a conference call and they checked where the caller told me the bomb was. When the police arrived they actually refused a search. The store never closed.
Interesting that Walmart thinks it is a better judge of bomb threat credibility and public safety matters than the police, and given that Walmart has no expertise in those areas I believe it was quite a foolish and reckless decision on their part to go against advice.
I would not expect Walmart to make public safety decisions any more than I would expect the police to make retail sales or revenue decisions.
I agree with Bruce that we shouldnt give the terrorists what thay want, but there still has to be a "trade off" not only in security but in public safety. Corporate revenue should NEVER outweigh public safety.
At the very least they should have informed customers of the threat and let them decide if they still wanted to shop - oh wait, thats probably the same as an evacuation.
Imagine how many grieving families would be suing Walmart right now if it had not turned out to be a hoax?
They got away with it this time, but perhaps in the future in this post 9/11 world, they wont be as lucky.
This is corporate greed in the worst possibe way - puting lives at risk to make a buck.
Just my 2c.
There is no possibility of rational discusion around the word "terrorist".
The word has multiple meanings almost all of which are emotive and its overuse in various propaganda have rendered it meaningless.
You may as well have a discusion on whether the Wall-mart manager in question was a "Capitalist Running Dog".
No one wakes up in the morning and thinks "I am a terrorist, I will commit a terrist act".
They think "I am poor/oppressed/a victim/a champion of my people/a patriot/an agent of god/the emperor Napoleon I will make myself rich/revenge myself/kill my tormentor/further my cause/free my people/glorify god/glorify myself" -- choose any permutation you like.
To illustrate how vauge this can get congress does not think planting bombs and shooting civilians is a terrorist act worthy of extradition to an allied country -- if the bomber is Irish; and is currently refusing to ratify a new extradition treaty with the UK.
People keep asking why the police and fire department recommended the building be evacuated. They must have thought the treat credible right?
Nope. It is easier for them to search the store when it is empty rather than when there are people in it. In short, their decision was made based on their agenda - to get this highly unlikely bomb threat dealt with and get back to the station or the Tim Horton's (or whatever the US equivalent donut shop is) ASAP. Its about them trying to use their authority to try to make their jobs as quick and easy as possible.
In other words, public safety is NOT really their number one concern in recommending and evacuation - they know as well as anyone that REAL bombers simply don't call in a threat, they just leave the bomb to go off or strap it to themselves.
Want to evacuate a Walmart and have the car-bomb go off in the parking lot? Don't phone in a bomb threat, pull the fire alarm. Or set off the sprinkler system. Management will not even need to make an announcement then...
As much as I hate Walmart for their business practices, they made the correct decision. No one will call a bomb threat into that store again, because they got no thrill out of it. The possibility that a called in threat is real is almost nil.
--"By that logic, why wouldn't WalMart also have been more cautious than not?"
Different costs, of course. It costs the police department nothing at all to recommend the evacuation. Their only cost is opportunity cost; the officers involved in the search aren't doing something else somewhere else. The cops themselves get paid the same either way. However, by recommended the evacuation, they protect themselves from a fairly likely and large cost (the lawsuits), one which will almost certainly cost them personally rather than just the force in abstract.
Wal-Mart, on the other hand, faces direct costs whichever decision they make (lost revenue vs. lawsuits). Of course their cost-benefit analysis is going to be different than someone who only sees the cost on one side of the equation.
--"but we can say that the people working in the store strongly disagreed with the manager's decision"
Eh, this is Wal-Mart. How often do employees get paid to take the rest of the day off? Of course they'd rather evacuate, regardless of the credibility of the threat. Their reaction doesn't really add to the analysis.
--"There is no possibility of rational discusion around the word "terrorist"."
Or the word "Wal-Mart", apparently.
you've take the quote completely out of context. why?
the logic that i referred to, which you can plainly see in my comment, is how people under the threat of public litigation will respond. in other words, is the public servant more at risk of litigation than the wal-mart manager? i think some might say people are less likely to litigate against a police officer who does not order an evacuation (good samaritan theory, and such) than a wal-mart manager who does not (bad manager, and such). instead you strangely swapped in that old tired thread of "it costs wal-mart money to be cautious, but the public servant has no accountability"
you also said "Of course they'd rather evacuate, regardless of the credibility of the threat. Their reaction doesn't really add to the analysis."
again, the point i was discussing was related to the reaction (e.g. litigation) by the people affected by another's decision on risk. thus it is clearly adds to the analysis.
you may as well have said their reaction doesn't add to the analysis of water quality on the moon either, but that's not what my comment was referring to.
interesting to see your preferred approach to "rational" discussion...
> Interesting that Walmart thinks it is a better
> judge of bomb threat credibility and public
> safety matters than the police,
In fact, they are. They have an incentive to be capable of judging risks accurately because they lose their money if they're not good at that. They lose if they are overly cautious (lost sales), and they lose if they are not cautious (hint: lawsuits are costly).
The police has no incentive to make good judgements about risks whatsoever - the money they waste is not theirs, and the unnecessary scares bring rewards to them "for being cautious" from the appropriately scared sheeple.
Is this hard to understand?
I will trust a Wal-Mart security guy more than any government flunkie in a uniform - any day.
Oh... and if anyone remebers 9/11, the death toll was signifcantly larger than it could be *because* of the government actions. A lot of people are alive today simply because they listened to their guts instead of stupid FD announcements. So much for the "experts".
My, there seem to be a lot of experts here. It's just like TV.
@supersnail: No one wakes up in the morning and thinks "I am a terrorist, I will commit a terrist act".
I don't think this is actually true. Sure, the "foot-soldiers" who actually carry out the attack probably think the way you say, as "freedom fighters". However, a competently implemented terrorist campaign REQUIRES acknowledgment of its terrorist nature and objectives, in order to plan it in the first place. The leadership (at least, the strategic/tactical planners) must know that they are deliberately fostering and engaging in terrorist acts - and thus, that they are terrorists, even if they try to deny this to themselves.
"I will trust a Wal-Mart security guy more than any government flunkie in a uniform - any day."
Don't you mean you would trust a Wal-Mart store manager? Or do you really think their security guy gets to call the shots at the store level let alone convey their opinion directly to the customer(s)? Are you sure you're talking about retail security...?
I have nothing but questions and one suggestion.
Why did Wal-Mart management even bother to call police if they planned to ignore the police suggestion to evacuate?
Why was it a suggestion to evacuate made by the Police, rather then a Police order to evacuate given? Making a bomb threat is a crime and Wal-Mart was the crime scene, Police have jurisdiction at a crime scene, not Wal-Mart Management?
How did Wal-Mart management or Police for that matter, know that a customer would not stumble across an explosive devise and by picking it up set it off?
How did Police procedures allow customers to be anywhere near where an Officer may be searching for an explosive devise?
Homeland Security should hire all of those Wal-Mart managers , it appears that Wal-Mart managers can divine whether a bomb threat is real or not.
hi i live in birmingham United kingdom where the IRA carried out most of their bomb scare in the UK and i think it is reckless what wal-mart have done playing with people lives it just show how dumb the americans are really
Schneier.com is a personal website. Opinions expressed are not necessarily those of Co3 Systems, Inc..