Session No. 25

# Course Title: Business and Industry Crisis Management, Disaster Recovery, and Organizational Continuity

# Session 25: Crises of Malevolence 

##  Time: 2 hr

**Objectives:**

1.  Describe the general categories of "crises of malevolence."

2.  Discuss the strategies used by Gerber and Pepsi Cola in their
    product tampering crises and compare the strategies to those
    followed in the Tylenol product tampering crisis.

3.  Discuss the threat of corporate terrorism and the management of
    terrorist-related risks.

4.  Discuss the methods used to conduct economic espionage, the impact
    on corporations, and the means of managing economic espionage risks.

5.  Discuss the threat of internally (to the organization) generated
    crises of malevolence and the management of the associated risks.

**Scope:**

The material presented in this session supplements the reading
assignment from Lerbinger and Barton. The session starts with a general
description of "crises of malevolence," a term coined by Lerbinger, who
primarily focuses on those "crises of malevolence" precipitated by
external (to the organization) influences. Crises of malevolence caused
by internal (to the organization) influences such as sabotage, employee
violence, sexual harassment, and discrimination are added to Lerbinger's
categories of crises. The coverage of the Tylenol, Gerber, and Pepsi
Cola product tampering crises is expanded to facilitate, through class
discussion, a comparison of the different strategies employed.
Additional material related to corporate terrorism, particularly in the
area of "cyberterrorism," is included. Also, coverage of economic
espionage crises is expanded to facilitate a discussion of ethical
business-related behavior. The session concludes with coverage of those
"crises of malevolence" caused by internal influences. Lecture and
discussion material on employee sabotage is provided, and the students
will provide coverage of employee violence, sexual harassment, and
discrimination through their written assignments, small-group work, and
oral reports. The assigned reading in Lerbinger and Barton provides
adequate coverage of crises generated by rumors, extortion, and
disinformation. The instructor may choose to discuss the text
descriptions and case studies covering these categories of "crises of
malevolence."

**Readings:**

*Student Reading:*

Barton, Laurence. 1993. *Crisis in Organizations: Managing and
Communicating in the Heat of Chaos.* Cincinnati, OH: South-Western
Publishing Co. Pages 95--103.

Lerbinger, Otto. 1997. *The Crisis Manager -- Facing Risk and
Responsibility.* Mahwah, NJ: Lawrence Erlbaum Associates. Chapter 7,
pages 144--179.

*Instructor Reading:*

Barton, Laurence. 1993. *Crisis in Organizations: Managing and
Communicating in the Heat of Chaos.* Cincinnati, OH: South-Western
Publishing Co. Pages 95--103.

Caudron, Shari. 1995. "Fighting the Enemy Within." *Industry Week*
\[on-line\]*.* Vol. 244, No. 16. Start page 36. Cleveland, OH.
Electronic version 3 pages.

Greenberg, Keith E. 1993. "Pepsi's Big Scare." *The Public Relations
Journal* \[on-line\]*.* Vol. 49, No. 8. Start page 6. New York.
Electronic version 3 pages.

Lerbinger, Otto. 1997. *The Crisis Manager -- Facing Risk and
Responsibility.* Mahwah, NJ: Lawrence Erlbaum Associates. Chapter 7,
pages 144--179.

Naylis, Gerard J. 1996. "Corporate Terrorism: Managing the Threat."
*Risk Management* \[on-line\]*.* Vol. 43, No. 6. New York. Start page
24. Electronic version 4 pages.

O'Hare, Dean. 1994. "Target: CEO." *Risk Management* \[on-line\]*.* Vol.
41, No. 7. Start page 83. New York. Electronic version 6 pages.

**General Requirements:**

Complete the modified experiential learning cycle for objectives
25.1--25.5 at the conclusion of this session.

**Objective 25.1 Describe the general categories of "crises of
malevolence."**

**Requirements:**

Present the material by means of lecture and discussion as necessary.

Communicate the written assignment to be completed for the second hour
of this session to the students.

**Remarks:**

I.  Categories caused by **external influences.**

```{=html}
<!-- -->
```
A.  "Malevolence" is **defined** as "The quality or state of being
    malevolent" and "malevolent" is defined as "(1) Having or exhibiting
    ill will; wishing harm to others, and (2) Having an evil or harmful
    influence."[^1]

B.  Lerbinger (chapter 7) looks **outside the organization** for the
    causes of crises of malevolence (the causes are predominantly
    external to the organization, although each could be generated by
    internal sources) and has grouped malevolent acts into several
    categories. Each category should be considered in accomplishing the
    functions comprising the crisis management and organizational
    continuity process. The categories include:

```{=html}
<!-- -->
```
1.  **Product tampering.**

2.  **Terrorism.**

3.  **Extortion.**

4.  **Corporate espionage.**

5.  **Rumors.**

6.  **Disinformation.**

```{=html}
<!-- -->
```
II. Categories caused by **internal** (and other external) influences.

```{=html}
<!-- -->
```
A.  Added to the above are other categories caused by **predominantly
    internal** (and sometimes external) influences fitting the
    definition of malevolence. They too can lead to organizational
    crises and include:

```{=html}
<!-- -->
```
1.  **Workplace violence.**

2.  **Employee sabotage.**

3.  **Sexual harassment.**

4.  **Discrimination** due to race, religion, sex, physical
    capabilities, etc.

```{=html}
<!-- -->
```
B.  The categories are **generally arbitrary** and depend on the chosen
    definitions of terms. For example, employee violence and sabotage
    could be considered as terrorist acts, and sexual harassment and
    discrimination as skewed organizational, management, and/or
    individual values.

```{=html}
<!-- -->
```
III. **Homework assignment** for the second hour of the session.

```{=html}
<!-- -->
```
A.  The assigned reading in Lerbinger and Barton provides extensive
    coverage of "crises of malevolence" caused by external factors. The
    remainder of this hour (first half of the session) will focus on
    these externally caused crises. During the second half of the
    session the focus will **shift to internally caused** "crises of
    malevolence" with the topic of sabotage covered through lecture and
    class discussion. The students will then be given 20 minutes to
    discuss their written assignments in their small groups to develop a
    short (three to five minutes) oral report of their collective
    efforts. These reports will focus on the causes, impact, and crisis
    management of malevolent acts associated with employee violence,
    sexual harassment, and discrimination.

B.  **Written assignment.**

```{=html}
<!-- -->
```
1.  Assign each small group a **topic,** either employee violence,
    sexual harassment, or discrimination.

2.  Each member of the small group is to **conduct research** on the
    assigned topic using the Internet and other available resources.

3.  Each member of the small group is to **individually prepare a
    two-page written report** covering the following points:

```{=html}
<!-- -->
```
a.  A brief **description or definition** of the topic.

b.  Specific **legal protection** for employees.

c.  Current **trends or issues.**

d.  A discussion of the **impacts** on the affected people and the
    workplace in general.

e.  What should be done to **prevent** events (preventive controls).

f.  What should be done if an **event occurs** (consequence mitigation
    controls).

```{=html}
<!-- -->
```
4.  The written assignment will be **turned in at the start of the
    second hour** of the session.

```{=html}
<!-- -->
```
C.  **Small-group work.**

```{=html}
<!-- -->
```
1.  Members of each small group will **discuss** their individual and
    collective ideas and prepare a short (three to five minutes) oral
    report.

2.  The small-group reporter will deliver the **oral report** to the
    class.

**Supplemental Considerations:**

There are numerous public sector, educational, and private sector
Internet sites that provide information on employee violence and sexual
harassment (search "employee violence" or "sexual harassment"). Several
interesting and informative sites include:

<http://www.cdc.gov/niosh/violrisk.html>

<http://www.lgu.com/em49.htm>

<http://www.smartbiz.com/sbs/columns/robin1.htm>

<http://www.de.psu.edu/harass/analysis/work.htm>

(Cited 10/19/99.)

Fewer Internet sites are accessed through a search of "discrimination"
or "workplace discrimination" but the information necessary to complete
the written assignment is available. Several interesting and informative
sites include:

<http://www.nolo.com/ChunkEMP/emp.index.html>

<http://www.eeoc.gov/eeoinfo.html>

<http://www50.pcepd.gov/pcepd/>

(Cited 10/19/99.)

Objective 25.2 Discuss the strategies used by Gerber and Pepsi Cola in
their product tampering crises and compare the strategies to those
followed in the Tylenol product tampering crisis.

Requirements:

Present the material by means of lecture and discussion as necessary.

The following statement/questions are provided to stimulate discussion:

> Contrast the strategies for dealing with the product tampering crises.
>
> What are the similarities and differences?
>
> What lessons can you take away from the case studies of these three
> crises?

Remarks:

I.  **Tylenol** product tampering crisis (1982).

```{=html}
<!-- -->
```
A.  The Tylenol crisis has been discussed several times during this
    course. To **compare the strategy** chosen by Johnson and Johnson in
    the Tylenol response with those chosen by Gerber and Pepsi Cola,
    several points are repeated.

```{=html}
<!-- -->
```
1.  The **immediate response** of Johnson and Johnson was an advisory to
    consumers not to consume any Tylenol products, followed immediately
    by a recall of all Tylenol capsules.

2.  Guided by the **Johnson and Johnson credo** that placed
    responsibility to the medical community and customers above all
    else, the Johnson and Johnson strategic crisis management team and
    supporting tactical teams maintained open communications directly
    with the public and through the media.

3.  Johnson and Johnson, though technically blameless for the Tylenol
    poisonings, voluntarily **instituted corrective measures**
    (triple-seal tamper-proof packaging) that became industry standards.

4.  Overall, the crisis cost Johnson and Johnson hundreds of millions of
    dollars in direct costs and short-term brand value, but in the long
    term, the Johnson and Johnson **public image was restored** and even
    bolstered by the response.

```{=html}
<!-- -->
```
B.  Johnson and Johnson had **no formal crisis management plan** in
    place at the time of the 1982 crisis. Ad hoc organizing,
    decision-making, and actions aligned with the company's credo and
    supporting a strategic view of their public image guided the overall
    crisis management effort.

C.  The lessons learned were not lost on Johnson and Johnson, however.
    Following the 1982 crisis, formal **crisis management
    responsibilities and plans were implemented** within Johnson and
    Johnson.

```{=html}
<!-- -->
```
II. **Gerber** product tampering crisis (1986).

```{=html}
<!-- -->
```
A.  When faced with **widespread complaints** (227 complaints from 30
    states (Lerbinger p. 151)) that Gerber baby food contained glass
    shards, the Gerber CEO, William L. McKinley acted contrary to the
    Tylenol model described above.

```{=html}
<!-- -->
```
1.  **No product recall** was initiated.

2.  Mr. McKinley maintained a **very low profile** with the media and
    Gerber was widely criticized for the way it responded to the media.

> 3\. Gerber held to the position that it was being **victimized** by
> unsubstantiated claims by the public and the media and to some extent
> tried to pass the blame on to "malevolent individuals and the media"
> (Lerbinger p. 151).
>
> 4\. When the governor of Maryland intervened and **issued a recall
> order** within his state, Gerber responded with a lawsuit claiming the
> recall was unjustified, a response that further damaged Gerber's
> public image.

B.  Contributing to **Gerber's choice** of strategy were several
    considerations:

```{=html}
<!-- -->
```
1.  Just **two years previous** (1984), Gerber had responded to a
    similar product tampering crisis by initiating a voluntary recall.

```{=html}
<!-- -->
```
a.  Gerber internally viewed the **results of this recall** as harmful
    to the company.

b.  A 5.7% drop in baby food sales and a 20% drop in the market price of
    Gerber stock were **blamed on the publicity** accompanying the
    recall (Lerbinger p. 151).

```{=html}
<!-- -->
```
2.  Federal Drug Administration (FDA) tests revealed no danger due to
    the glass shards and **refused to issue a recall** order (something
    it had done almost 900 times in the previous year (Lerbinger p.
    152)).

```{=html}
<!-- -->
```
C.  Eventually, Gerber did respond to **the widespread consumer
    awareness and public image problem** that it was experiencing.

```{=html}
<!-- -->
```
1.  Slightly more than a month after the original glass shards reports,
    Gerber ran network television spots emphasizing the company's
    "primary responsibility for 58 years -- the health of babies"
    (Lerbinger p. 152). The company avoided mention of the glass shard
    contamination, however, in an attempt to **minimize the public's
    connection** of the problem with Gerber.

2.  Gerber also mailed almost **3 million** letters to households with
    young parents.

```{=html}
<!-- -->
```
D.  **Results** of the crisis for Gerber.

```{=html}
<!-- -->
```
1.  In the short term, Gerber's **market share dropped** to 52.5% from
    66% in the month following the initial reports of glass shards.

2.  The **market price of Gerber stock did not fall,** however, and
    within eight months, its market share had essentially risen to its
    precrisis level.

3.  In view of this rapid recovery, at least from a purely **financial
    perspective,** Gerber's strategy proved successful.

4.  Lerbinger, through his research, presents a **different
    conclusion,** however. He states that "Many government officials,
    corporate executives and editors, however thought that a recall was
    absolutely necessary" (p. 153).

```{=html}
<!-- -->
```
III. **Pepsi Cola** product tampering crisis (1993).

```{=html}
<!-- -->
```
A.  A June 10, 1993, report of a syringe found in a can of Pepsi Cola
    was rapidly followed by additional reports of **contamination** by
    foreign objects **--** including a wooden screw, a broken sewing
    needle, a crack-cocaine vial, and a bullet -- from more than 20
    states (Greenberg p.1).

B.  Given the fact that reports of contamination involved cans from
    multiple Pepsi plants, that two of the earliest reports involved
    cans produced six months apart, and that tampering during the
    production process was viewed as almost impossible by Pepsi, the
    string of reports were **viewed as unrelated hoaxes.** Accordingly,
    Pepsi made the decision not to conduct a product recall.[^2]

C.  By June 18^th^, 8 days after the initial report, the crisis had
    largely passed for Pepsi. A supermarket surveillance tape showing a
    person inserting a syringe into a can of Pepsi was shown on national
    television; three people had been arrested for falsely claiming
    product contamination; and five others had retracted their claims.

D.  In total, Pepsi **lost approximately \$15 million** in sales over
    two weeks, but by the end of June, sales had rebounded to precrisis
    levels.

E.  Pepsi's **success** in handling the crisis can be attributed to
    several factors:

```{=html}
<!-- -->
```
1.  A quick response supported by a **clearly defined policy on crisis
    management and a team set up** to handle it. Pepsi's chief customer
    officer, Rick Routhier, stated that "Without it (the CMT), we would
    have been dead in the water at the very first call."[^3]

2.  Pepsi concentrated on **open communications** with its employees,
    customers, and the media. A telephone and fax system to allow Pepsi
    plants to contact corporate leadership and a consumer hotline were
    set up and functioning as a matter of routine business operations.

3.  On a daily basis, the president of Pepsi North America provided a
    situation **update to the 1,200 employees** at Pepsi headquarters.
    Consumer relations and sales personnel received constant updates.

4.  By June 15^th^, Pepsi was providing **video news releases** (VNR) to
    national television. The first VNR, including an interview with
    Pepsi's president, and showing the Pepsi bottling process, was
    viewed by over 165 million people, breaking all previous VNR
    records.[^4] Additionally, Pepsi's president appeared on national
    news programs including Larry King Live, the McNeil/Lehrer Newshour,
    and Nightline.

5.  While initial media reports focused on the allegations, after the
    first few days the media stories started to answer the why and how
    of the crisis. Even without a product recall and demonstrated
    corrective measures, Pepsi was **portrayed as working in the
    public's interest.**

6.  As Rebecca Madeira, Pepsi's vice president of public relations,
    stated a "crisis can only be in your control if you **cooperate with
    the media,** invite them in, and furnish them with facts. Your only
    defense when your company is on trial is to be a participant in that
    trial" (emphasis added; Greenberg p. 3).

```{=html}
<!-- -->
```
IV. **Comparison** of strategies.

```{=html}
<!-- -->
```
A.  In his article "The Hoax that Failed," Weinstein makes the statement
    that "Just as there are many wrong ways for companies to respond to
    crises, there is **no one right method for responding."**[^5]

B.  **Ask the students to** contrast the strategies for dealing with the
    product tampering crises. What are the similarities and differences?
    What lessons can you take away from the case studies of these three
    crises?

Supplemental Considerations:

Three articles are cited for the Pepsi case study. The factual content
of the three is consistent, and it is sufficient for the instructor to
read only one to prepare for this session. The Greenberg article is
recommended.

Objective 25.3 Discuss the threat of corporate terrorism and the
management of terrorist-related risks.

**Requirements:**

Present the material by means of lecture and discussion as necessary.

**Remarks:**

I.  **Genera**l considerations.

```{=html}
<!-- -->
```
A.  The **definitions of terrorism** presented by Lerbinger (page 145)
    focus primarily on the use of terrorism to achieve political or
    social objectives.

B.  An **alternative definition** expands terrorism to include "the
    systematic use of fear, violence or intimidation,...employed by
    individuals and groups as a means to an end" (Naylis p. 1).

```{=html}
<!-- -->
```
1.  Terrorism stems from the Latin verb "terrere" -- **"to frighten."**

2.  Regardless of the target of a terrorist act or the terrorist's
    motivation, terrorist acts are committed for the common purpose of
    **gaining power** over others.

3.  Under this expanded definition, all of the categories of crises of
    malevolence outlined earlier could be **considered acts of
    terrorism.** The categories are maintained, however, for
    presentation and discussion purposes.

```{=html}
<!-- -->
```
C.  **Trends.**

```{=html}
<!-- -->
```
1.  The use of **incendiary devices,** explosives, and bomb threats as
    terrorist acts in the United States increased by 55% between 1990
    and 1994 (Naylis p. 1).

2.  **Major incidents** such as the World Trade Center bombing (1993)
    and the Oklahoma City bombing (1995) have raised public awareness of
    the threat of international and domestic terrorist attacks on
    organizations and individuals.

3.  The relatively new term, **"cyberterrorism,"** referring to attacks
    on computer information systems, was introduced by Barry Collin in
    his 1997 article "The Future of Cyberterrorism: The Physical and
    Virtual Worlds Converge" in *Crime and Justice International*.

```{=html}
<!-- -->
```
a.  Originally, acts of cyberterrorism were conducted by **"hackers"**
    -- people who derived joy from discovering ways to exceed current
    limitations to solve problems (in computer information systems)
    through trial and error and personal ingenuity.[^6]

b.  Hackers have given way to **"crackers,"** who are malicious in their
    attempts to intrude into computer systems to view data and use
    other's property without the legal right to do so.[^7]

c.  The newest breed of cyberterrorist, titled the **"cyberpunk,"** goes
    beyond cracking to use technology to damage, destroy, or capitalize
    on others' data by various means, including the introduction of
    viruses.[^8]

d.  Indicative of the growing threat of cyberterrorism to individuals,
    organizations, and the entire electronic information infrastructure
    is the existence of the **Computer Emergency Response Team
    Coordination Center (CERT-CC).** (The CERT-CC Web site at
    [http://www.cert.org](http://www.cert.org/) provides amplifying
    information.)[^9]

```{=html}
<!-- -->
```
(1) Founded in 1988 under the sponsorship of the Department of Defense,
    CERT-CC is part of **the Survivable Systems Initiative** at the
    Software Engineering Institute, a federally funded research and
    development center at Carnegie Mellon University.

(2) CERT-CC provides **cyberterrorism** response and training and
    researches the vulnerability, system security, and survivability of
    large-scale networks.

```{=html}
<!-- -->
```
II. **Managing** terrorism crises (see Naylis article).

```{=html}
<!-- -->
```
A.  The "Crisis Management and Organizational Continuity Model" used
    throughout this course provides the basic framework for preventing,
    planning for, responding to, and recovering from a terrorism crisis.
    Particular emphasis is placed upon **safety and security management
    and training** as control measures.

B.  **Risk assessment.**

```{=html}
<!-- -->
```
1.  The starting point is to assess the risks **(vulnerability,
    probability, and impact)** of attacks against employees, products,
    and property.

2.  In addition to considering the organization's business, customers,
    and stakeholders, terrorist threats require an accounting of any
    individuals and groups that are **angered or offended.** As we have
    seen in the *Brent Spar* (session 9) and A.D. Little nerve gas
    (session 10) cases, sensitive environmental issues and public
    outrage can trigger terrorist acts.

3.  Risk assessment should also **extend beyond the immediate
    organization** to include physical proximity to other organizations
    (especially those in the same building) and supplier/customer
    relationships with other organizations.

```{=html}
<!-- -->
```
C.  **Risk management.**

```{=html}
<!-- -->
```
1.  **Physical and electronic safety and security** measures and
    training provide both preventive and consequence mitigation controls
    for terrorist threats.

2.  These controls should be **matched to the risks** with particular
    attention to:

```{=html}
<!-- -->
```
a.  **Access control:** physical measures such as check points,
    identification badges, and controlled spaces and escorts, and
    electronic measures such as security layers, encryption, and
    passwords.

b.  **Security:** Security patrols, surveillance systems, checks of
    deliveries and mail.

c.  **Awareness:** Employee training on identifying, avoiding, and
    responding to terrorist threats.

d.  **Key system protection:** Alarm systems and fire fighting and
    suppression systems.

e.  **Essential utilities protection:** Backup utilities and emergency
    lighting systems.

```{=html}
<!-- -->
```
D.  **Terrorist threat and act** **response.**

```{=html}
<!-- -->
```
1.  The **mere threat** of a terrorist act such as a bomb threat
    generally necessitates a response. Building evacuation plans should
    be exercised regularly and strictly adhered to insure a rapid and
    complete building evacuation.

2.  Organizational **plans and actions must be coordinated** with local
    emergency response and law enforcement agencies and with people and
    organizations in close proximity.

```{=html}
<!-- -->
```
E.  The **challenge.**

```{=html}
<!-- -->
```
1.  The threat of corporate terrorism presents a **unique challenge.**
    On one hand, the work environment must be free and open enough to
    allow people to function and business to proceed. On the other hand,
    people, equipment, and property must be adequately protected -- a
    requirement that necessarily restricts the environment.

2.  Effective management and response to terrorist threats requires a
    **balance** of safety and security with individual and
    organizational openness and freedom -- a challenge we continually
    face in a free society when weighing individual rights against the
    public good.

```{=html}
<!-- -->
```
III. **Kidnapping** as a terrorist act.

```{=html}
<!-- -->
```
A.  Lerbinger provides very thorough coverage of **kidnapping** as a
    terrorist act (pages 154--155 and 173--179).

B.  Once targeted predominantly at government organizations and public
    officials, terrorism aimed at **corporate targets and individuals**
    has steadily risen in recent years. Attacks against businesses and
    other private interests located in foreign environments currently
    account for 75% of anti-American terrorist acts worldwide, and the
    trend is increasing. (O'Hare p. 1.)

```{=html}
<!-- -->
```
1.  Many terrorist acts involve kidnapping **high-ranking corporate
    officers.**

2.  Corporations are **targeted** due to their collective track record
    of quietly paying ransoms for the safe return of their employees and
    their desire to avoid publicity.

```{=html}
<!-- -->
```
C.  The kidnapping of corporate officers **within the United States** is
    also on the rise but accurate statistics are not available due to
    the desire to minimize publicity. (O'Hare p. 1.)

D.  Kidnapping **risk management.**

```{=html}
<!-- -->
```
1.  The best defense against kidnapping lies in **prevention,**
    particularly training including cultural awareness, maintaining a
    low profile, avoiding high-risk environments and situations, self
    defense, etc.

2.  Private consultants such as the Control Risk Group, mentioned by
    Lerbinger, provide a variety of services including **consulting and
    training** to help minimize the risk of corporate kidnapping. (The
    Control Risk Group Web Site at <http://www.crg.com/index.htm>
    provides amplifying information (last cited 11/11/99)).

3.  **Consequence mitigation** of kidnapping and other terrorist acts is
    essential since preventive control measures cannot guarantee that
    such acts will not occur. O'Hare's article "Target: CEO" makes the
    point, "Perhaps the most important thing a company can do before a
    kidnapping, or any other terrorist threat, is to make sure the
    company has a crisis management team in place and that the team
    creates a communications infrastructure to ensure immediate
    reporting of an emergency" (p. 1).

```{=html}
<!-- -->
```
a.  The **first few hours** immediately following a kidnapping are the
    key to a successful resolution.

b.  Decisions are best made at the **corporate level,** where access to
    specialized consultants (such as the Control Risk Group) is
    available.

c.  Ultimately, decisions will be made by the **corporate CMT;** but
    consultants who have specialized knowledge and skills in the
    esoteric arena of hostage situations and negotiations can be
    critical to obtaining the kidnapping victim's release.

Supplemental Considerations:

None.

# Objective 25.4 Discuss the methods used to conduct economic espionage, the impact on corporations, and the means of managing economic espionage risks. 

**Requirements:**

Present the material by means of lecture and discussion as necessary.

The following questions are provided to stimulate discussion:

Which, if any of the above methods (methods of obtaining information) do
you consider ethical?

What are some of the possible controls for protecting information?

**Remarks:**

I.  **General** considerations.

```{=html}
<!-- -->
```
A.  According to FBI records, **industrial espionage** costs United
    States companies between \$24 and \$100 billion annually.[^10]

> B. According to a *Security Magazine* poll, 14% of United States firms
> had experienced

B.  some type of serious, quantifiable breach in **information
    security.**[^11]

> C. Large corporations are not the only **targets** of economic
> espionage. Studies show that companies of all sizes, from
> multibillion-dollar corporations to small businesses, are the victims
> of economic espionage.[^12]

D.  The nature of economic espionage is obtaining an **organization's
    information,** by legal or illegal means (Lerbinger limits his
    discussion to only illegal means), to either inflict harm on that
    organization or to benefit the organization obtaining the
    information. Although emphasis is generally placed on computer-based
    information, information targeted through economic espionage resides
    in many forms and places including:

```{=html}
<!-- -->
```
1.  **Formal documents** -- e.g., business contingency plans, contracts,
    production reports.

2.  **Draft documents.**

3.  **Scrap paper and notes.**

4.  **Internal correspondence** including e--mail.

5.  **Regulatory and legal filings.**

6.  Meeting (formal and informal) **agendas and minutes.**

7.  **Press releases** and other publicly disseminated information.

8.  **Casual conversations** conducted in public places or overheard by
    electronic listening equipment.

```{=html}
<!-- -->
```
II. Methods of **obtaining information.**

```{=html}
<!-- -->
```
A.  Methods are generally categorized as **legal or illegal** with legal
    methods further categorized as **ethical or unethical.** The
    dividing line between what is ethical and what is unethical is
    certainly subject to interpretation.

B.  **Legal** methods.

```{=html}
<!-- -->
```
1.  Reviewing **public records** such as media coverage, public filings,
    reports, and proposals.

2.  Consulting some of the thousands of **databases** available on the
    Internet that contain information about companies.

3.  **Hiring** former and current employees for the primary or secondary
    purpose of obtaining information they posses concerning their
    previous employer.

4.  **Dumpster diving** -- sorting through trash to retrieve documents.

5.  **Eavesdropping** on employees at restaurants, on airplanes, etc.

6.  Engaging an employee in an apparently **innocent conversation** and
    then guiding it to obtain desired information.

```{=html}
<!-- -->
```
C.  **Illegal** methods.

```{=html}
<!-- -->
```
1.  Computer "**hacking," "cracking," and "cyberpunks."**

2.  Physically **stealing** hardware, software, records, documents,
    memos, etc.

3.  Placing an **agent** inside a company to obtain and pass
    information.

4.  **Bribery.**

5.  Buying **proprietary information** form a current or past employee.

```{=html}
<!-- -->
```
D.  **Ask the students,** Which, if any, of the above methods do you
    consider as ethical? It might be interesting to mention that in
    1997, the United States government spent \$26.6 billion on economic
    spying and intelligence gathering.[^13]

```{=html}
<!-- -->
```
III. **Economic espionage** risk management.

```{=html}
<!-- -->
```
A.  As with terrorism (some forms of economic espionage can be
    considered terrorist acts), risk management is best accomplished
    though **proactive training and preventive control** measures.

B.  Ira Winkler's book, *Corporate Espionage: What It Is, Why It's
    Happening in Your Company, What You Must Do About It,* includes a
    66-page discussion of economic espionage risk controls, most of
    which focus on electronic and physical security considerations.
    **Ask the students,** What are some of the possible controls for
    protecting information? A sampling of the controls listed by Winkler
    include:

```{=html}
<!-- -->
```
1.  **Awareness training.**

> 2\. **Drills and exercises.**
>
> 3\. **Classifying information.**

4.  **Security alert systems.**

5.  **Verifying identities** and purpose for information access.

6.  **Nondisclosure/noncompete** employee agreements.

7.  **Monitoring** Internet activity.

8.  Employee **background checks.**

9.  Computer **pass words** and encryption.

10. **Physical access** controls.

11. **Regular safety** and security inspections.

```{=html}
<!-- -->
```
C.  As a control both for preventing and for mitigating the consequences
    of intellectual theft, Congress passed the **Economic Espionage Act
    of 1996** which provides for a long prison term for this crime.

D.  Additional controls are afforded by **patent, copyright, trade
    secret, and trademark laws,** which will be covered in a subsequent
    session.

Supplemental Considerations:

None.

Objective 25.5 Discuss the threat of internally (to the organization)
generated crises of malevolence and the management of the associated
risks.

**Requirements:**

Present the material by means of lecture and discussion as necessary.

Rotate assignments in the small groups.

Provide the small groups 20 minutes to complete their work.

Provide the group reporters three to five minutes each to report of the
work of their group.

Complete a class discussion of the lecture- and student-presented
material covering the following topics:

> Similarities between the acts, causes, and impacts of sabotage,
> employee violence, sexual harassment, and discrimination.

Similarities and differences of managing the risk of each.

Complete the modified experiential learning cycle for objectives
25.1--25.5 at the conclusion of this objective.

**Remarks:**

I.  **General** considerations.

```{=html}
<!-- -->
```
A.  As discussed at the start of this session, crises of malevolence can
    also be generated by sources primarily **internal** to the
    organization. Such crises include:

```{=html}
<!-- -->
```
1.  **Employee sabotage.**

2.  **Workplace violence.**

3.  **Sexual harassment.**

4.  **Discrimination.**

```{=html}
<!-- -->
```
B.  All require **preventive and consequence mitigation controls**
    following from the risk assessment function, with particular
    attention to human resource management issues and programs.

C.  Additionally, sabotage and violence prevention and detection should
    be considered in the accomplishment of the **safety and security
    management function,** while harassment and discrimination are more
    closely connected to overall **organizational culture and
    leadership.**

D.  The topic of employee sabotage will be covered in the following
    lecture/discussion with coverage of violence, sexual harassment, and
    discrimination accomplished through presentation and discussion of
    the **students' individual assignments and small-group work.**

```{=html}
<!-- -->
```
II. Acts of **sabotage.**

```{=html}
<!-- -->
```
A.  Incidents of employee sabotage are **on the rise** and are generally
    traced to employees who are feeling resentful, alienated, fearful
    about their long-term job security, and wary of their fellow workers
    and management (Caudron p. 1).

```{=html}
<!-- -->
```
1.  **Business practices** of the 1990s, including downsizing,
    reorganization, virtual work groups and environments, and dashed
    expectations of employee empowerment from failed efforts to
    implement philosophies such as Total Quality Management, have eroded
    trust and loyalty between management and workers.

2.  Shari Caudron's 1995 article "Fighting the Enemy Within," published
    in *Industry Week,* states that only 35% of employees claim to
    **have a positive attitude** toward top management (p. 1).

3.  Added to the above statistic are the findings of a 1994 Wyatt Work
    USA study that 44% of workers report that changes in their company
    have had a negative effect on the **work climate and morale,** and
    42% complain of work overload (p. 1).

4.  These feelings are creating a breed of workers, named **"get even
    employees"** by Caudron, who by outward appearance seem to be doing
    a good job, but secretly are doing what they can to sabotage their
    company. Frighteningly, the "get even employees" feel little or no
    guilt and actually feel justified in their actions because of
    overall dissatisfaction with the work environment, their fellow
    workers, and management.

```{=html}
<!-- -->
```
a.  Contributing to the ability to rationalize one's behavior is the
    depersonalization of the workplace with physical design, new work
    processes, and work overload decreasing the level **of interpersonal
    relationships** amongst workers and between workers and management.

b.  With the growth of virtual work groups and meetings, telecommuting,
    flexible work hours, and communications via e-mail, fellow workers
    and the organization are becoming **anonymous.** "Before, employees
    knew who they were hurting, but not anymore" (p. 2).

```{=html}
<!-- -->
```
5.  The "get even employees" represent a **shift from the threat** from
    the laid-off worker who is seeking revenge (perceived as a major
    threat during the initial downsizing trend of the early 1999s) to
    the threat from disgruntled current employees.

```{=html}
<!-- -->
```
B.  Along with increases in the amount of sabotage, the **variety of
    acts** is also growing.

```{=html}
<!-- -->
```
1.  "Get even employees," fearful of being laid off, will initiate acts
    of sabotage to **prolong their job** and will particularly target
    areas where they have specialized skills and knowledge that make
    them "indispensable."

2.  With increased expectations of **quality and customer service,**
    employees can passively ignore customers or even act in a rude or
    abusive manner, confident that their actions will drive the customer
    to a competitor.

3.  **Information systems** are extremely vulnerable to acts of
    sabotage.

```{=html}
<!-- -->
```
a.  Unless afforded **appropriate safeguards,** employees with only
    limited computer skills and knowledge may be able to access critical
    data and information for the purpose of sabotage or industrial
    espionage.

b.  More sophisticated computer "hackers," "crackers," and "cyberpunks"
    have the potential to penetrate even the best information system
    security controls and can introduce a variety of **"malicious
    codes"** such as viruses, Trojan horses, and worms.

```{=html}
<!-- -->
```
III. **Managing the risk of sabotage.**

```{=html}
<!-- -->
```
A.  As with other crises of malevolence, the primary focus of risk
    management should be on **prevention.**

B.  several **physical and electronic security measures** mentioned in
    the context of terrorism and economic espionage can help by
    decreasing the opportunity to commit acts of sabotage. **Rules and
    policies** aimed at deterrence can also help. These same controls,
    if viewed as overly restrictive, and demonstrating a lack of trust,
    can also serve to exacerbate the problem by further alienating
    employees.

C.  The key to prevention lies in interventions and changes targeting
    **root causes.**

```{=html}
<!-- -->
```
1.  "Reducing the risk of employee sabotage is not that difficult. All
    it takes is a willingness to **respect and pay attention** to the
    needs of the workforce" (Caudron p. 1).

2.  Creating a **corporate culture and climate** where employees do not
    have any motivation to "get even" is being proven as the most
    effective means for reducing the risk of sabotage.

```{=html}
<!-- -->
```
a.  Research conducted by the University of Florida in cooperation with
    Loss Prevention Specialists (LPS), Inc., a firm specializing in
    corporate crime reduction, confirms the assertion that **solid human
    resource policies and programs** can help reduce sabotage (p. 3).

b.  Read Hayes, a security consultant with LPS states, "There is a
    strong **correlation** between the treatment of people and the
    extent of a company's loss, with the single greatest variable being
    how close employees feel...to the company" (emphasis added; p. 3).

c.  **Solid human resource policies and programs** which help develop
    and maintain close feelings within an organization include:

```{=html}
<!-- -->
```
(1) **Formal grievance** procedures.

(2) **Competitive** pay and benefits.

(3) **Management-level training** in areas such as effective
    communications and human relations.

(4) Open **communication channels** facilitated by employee-executive
    visits and discussions, newsletters, videos, and periodic climate
    assessment surveys.

(5) A proven record of management decisions that seek to **avoid
    negative employee actions** (such as layoffs or degradation of
    benefits) to the maximum extent possible. When such actions are
    necessary, open, and honest communication can help minimize the
    negative impacts.

```{=html}
<!-- -->
```
D.  All of this is not to say that management should loose sight of the
    **strategic goals of organizational survival and profitability.**
    The design and implementation of policies and programs that threaten
    these goals is not expected. What is expected is a culture and
    environment that provides deserved respect throughout the
    organization and realistic policies and procedures that support
    organizational survival and reasonable profitability.

```{=html}
<!-- -->
```
IV. **Managing the risk** of employee violence, sexual harassment, and
    discrimination.

```{=html}
<!-- -->
```
A.  **Rotate group** assignments.

B.  Within their assigned small groups the students should **discuss
    their responses** to the written class assignment and prepare a
    short (three to five minutes) oral report of their collective
    efforts.

```{=html}
<!-- -->
```
C.  Following all the oral reports a **class discussion** should be
    conducted to discuss:

```{=html}
<!-- -->
```
1.  **Similarities** between the acts, causes, and impacts of sabotage,
    employee violence, sexual harassment, and discrimination.

2.  **Similarities and differences** of managing the risk of each.

Supplemental Considerations:

None.

[^1]: The American Heritage College Dictionary. 1997. Boston, MA:
    Houghton Mifflin Co.

[^2]: Weinstein, Steve. 1993. "The Hoax that Failed." *Progressive
    Grocer.* Vol. 72, No. 8. Start page 17. Stamford, CT. Electronic
    version page 1 of 2.

[^3]: Arnott, Nancy. 1993. "Punching out a Hoax." *Sales and Marketing
    Management* \[on-line\]. Vol. 145, No. 12. Start page 12. New York.
    Electronic version page 1 of 2.

[^4]: Weinstein p. 2 of 2.

[^5]: Weinstein p. 1 of 2.

[^6]: Gattiker, U.E., and Kelley, H. 1997. "Techno-Crime and Terror
    Against Tomorrow's Organization: What about Cyberpunks?"
    \[on-line\]. Lethbridge, Alberta, Canada: university of Lethbridge,
    Centre for Technology Studies. \[Cited May 11, 1999.\] Electronic
    version page 1 of 8. Available at ICSA Web site:
    <http://www.icsa.net/library/research/tecnoc.shtml>.

[^7]: Gattiker and Kelley p. 1 of 8.

[^8]: Gattiker and Kelley p. 1 of 8.

[^9]: Cited on 10/19/99.

[^10]: Winkler, Ira. 1997. *Corporate Espionage: What It Is, Why It's
    Happening In Your Company, What You Must Do About It.* Rocklin, CA:
    PRIMA Publishing. page xvi.

[^11]: "Economic Espionage Explosion." 1998. *Security* \[on-line\].
    Vol. 35, No. 5. Start page 14. Newton, MA. Electronic version page 1
    of 4.

[^12]: Winkler p. xv.

[^13]: "Economic Espionage Explosion" p. 3 of 4.