limited need, tacit public expectation for all public institutions—due to limited external threat—and perceived limited internal hazardous context (save external fire, weather, earthquake—non-human threat). E.g., NASA; NOAA academic/analytical organizations. Key question: To what degree do leaders appreciate the steep increase of resource likely to be implied by public demands?

**Analytical Challenge:** Think of circumstances that exhibit these variations. Based on whatever conceptions of organizational dynamics you favor, predict several highly likely resolutions to the tensions that you have conjured.

Now, two central analytical questions: Given the analytical basis for your predictions, how straightforwardly were you able to call out dynamics that could be sought in field observation? Where are the analytical shortfalls, if at all?

Other operational contexts with different, more detailed levels of safety or security activities associated are likely. This suggests the second of the several shaping conditions noted above.

**Condition 2. Coping with escalating hazards and threats.** As intrinsic hazards and external vulnerabilities increase, we are likely to witness a series of *layered, increasingly stringent, and militant operational responses* to demands for integrated Saf and Sec capacities. These unfold as a function of increasing internal hazards and escalating external threat. Additional safety and security functions are levied within and **on top of** increased technical training and skill imperatives needed to enact core technologies and infrastructures. These additions vary from local, on-site safety preparedness programs to high alert, whole system protection from external attack. Schematic Fig. 8.2 indicates some examples of (i) increasingly demanding

<table><thead><tr><th>Safety First Priority:</th><th>Central Challenges</th></tr></thead><tbody><tr><td>... Work place -- Safety only – interior and on-site transport</td><td></td></tr><tr><td>... Local hazmat (chem-radiation prep and inventory)</td><td></td></tr><tr><td>... Firefighting capability</td><td><em>Challenges of operating reliably</em></td></tr><tr><td>... Drug watchfulness (testing...)</td><td><em>for a number of work generations.</em></td></tr><tr><td>... IT firewalls</td><td><em>To enhance trustworthiness in face of</em></td></tr><tr><td>... Physical intrusion –</td><td><em>system surprises and clever adversaries</em></td></tr><tr><td>... Imported hazard chem-bio</td><td><em>assuring (some) unpreparedness.</em></td></tr><tr><td>... Personnel breach- secure areas; boundary control 24-7 surveillance</td><td></td></tr><tr><td>... Attack teams 1<sup>st</sup> respondents, intel and counter-intel capacity.</td><td></td></tr></tbody></table>

**Security First Priority:**

(readers will know other operational challenges within this range of priorities)

<caption>**Fig. 8.2** Escalating challenges. Layered operational responses</caption>
hazards—from workplace to organization-wide risk responses (emphasizing “safety first”), and (ii) external security-evoking threats (and security priorities).

The specific safety hazards and security threats are evident in a number of modern organizations both public and private. Responses to them also amplify several central management challenges noted in the Figure. All of these items were evident in the operation of large nuclear weapons facilities. The reader will likely know of other hazardous/threatened settings that have introduced other forms/layers of response ... capacities and behaviors, by and large, invisible to most institutional observers. The phenomena are worthy of careful qualitative description.

Two additional conditions also shape operator experience and challenge managerial wisdom. These should be integrated into any serious field study.<fnref n="3" /> Analytical readers will see how the patterns above could be applied here as well.

**Condition 3. Variations in relative social scale.** The greater the social scale, the more complex, differentiated, and interactive/interdependent the organization **and** the more likely the emergence of triply nested—ops., saf., and sec.—authority patterns and latent resistance networks. We expect that when Operations are massive/highly complex, Safety is more diffuse, a moderate fraction of the whole, while Security is relatively limited, in the shadows (ready to emerge!).

Different operational steady states vary from Saf stable, limited regimes (with Sec mostly latent) to full integration of Saf and Sec regimes. Differences are evident in these brief examples:

* Education: Small Saf, Sec tiny.

* Air Traffic Con: Saf clear presence, Sec modest, latent ready to assume command.

* Aircraft Carriers: Saf modest, Sec modest, and lurking.

* Weapons Lab: Both Saf and Sec evident and fully manifest continually.

**Condition 4. Variations in public expectation.** Organizations attempting to increase the integration of security and safety systems do so in the context of the public's understanding of and insistence on effective safety/security programs and their usual unwillingness to fund these developments. These vary widely from (a) limited experience, high expectation with reluctance to fund (Lo), to (b) clear recognition of risks and willingness to carry the costs with some forgiveness and tolerance for the struggle involved (HI). "Best cases" are rare and include our experience with nuclear power plants, national weapons labs, and submarine operations.

<footnote n="3">³Editorial constraints result in only brief mention. Explication awaits more fulsome possibilities.</footnote>
## 8.5 Amplified Complexity and Operational Switching Regimes

Thus far we have argued that institutional policy and technical developments persistently result in **additional hazard-increasing functions** (to be safely done), many accompanied by the **increasing potential/costs of massive damage** (at physical/psychological scale). In consequence, public and overseer demands intensify for both safety- and security-enhancing measures with the explicit expectations of effectively negating untoward events and hazard-prompted damage.

These efforts are launched into operational domains already exhibiting extraordinary variety in (i) their established (entry) conditions; (ii) the range of emergent counter-threats; (iii) the heterogeneity of security response measures; and (iv) an array of operator-overseers demands and dynamics with considerable tension/incommensurable potential. These phenomena are quite variegated and analytical or empirical explication is relatively sparse.

There are likely to be patterns that have escaped, even attentive observers. An especially interesting one wants exploring—patterns whose subtlety and presence are likely to be overlooked without a relatively careful field study.

This is related to the first *central analytical and management challenge* posed at the outset: “Identify operational situations in which (Saf/Sec) **functional overlaps—when done effectively—negate each other.**”<fnref n="4" /> These are organizational maelstroms where norms and practices are mixed in ways that evoke contradictory suites of skills and interacting episodes. They confront operating teams and managers in niches of high tension and can be loci of unexpected modes of coping.

To put a sharper point on this, the piling up of well-performing safety and security augmenting functions and teams also comes with (requires) coordinating and regulatory assuring networks and personnel grafted on to or embedded in the existing operational community. In effect, social complexities are amplified in ways that often distort former relationships and harbor high “apraxic” potential [2]. This presents persistent challenges for operating personnel to evolve “on the ground” accommodations that reduce the destructive potential of intrinsically incommensurable activities.

Organizational skill groups exhibit dual or parallel Saf/Sec competences, each with potentially different operational rules. This situation could precipitate *planned and practiced regimes shifting* from (a) predominantly Saf processes to Sec ones, or from (b) predominantly Sec regimes to Saf emphases when conditions about which there is “high consensus” emerge.

<footnote n="4">⁴Posed here in a “what’s it like” thought experiment mode, it was initially framed as “To what degree do *safety/security*/ reliable *operations* re-enforce each other; conversely, impede each other sufficiently to prompt tension and conflict?”.</footnote>
There are persistent cases that demonstrate high consensus about conditions for *shifting from safety to security privileging conditions*, i.e., switching from **Safety-assuring to Security-enhancing** priorities. Tipping points are recognized by all operational and overseeing institutional/legal entities, thus smoothing the organizational grounds for actualizing operational changes.

*Imagine what could be expected from operators and managers in the face of such dissonant potential? An Assumption and two Hypotheses.*

**Assumption:** Due to increasingly heterogeneous hazardous operations across widely variegated service geographies, there is a growing range of different situations *known to experienced on-site operators* but *beyond the knowledge capacity of most superordinate managers* unless they have had direct, "close-to-hazards" operational experience in the relevant operational domains.

**Hypothesis 1:** Operators and "close to hazards" managers, in efforts to limit confusion in the face of rapidly unfolding safety- or security-threatening situations, develop high-consensus rules of engagement and operational activities about shifting from one to the other processes. Each set has activities and triggers that do not reinforce those of the other.

**Hypothesis 2:** "Switching" protocols from one set of priorities and procedures to the other activity are mainly the province of "close to hazard" working groups and supervisory management.

Managerial (and research) imperatives follow. As patterns of unfamiliar, risky situations and/or novel threats intensify, it increases the imperatives for senior leadership to (i) insist on the **adoption of new skills**, (ii) legitimate **the capacity for switching internal emphasis** (via facilitating personnel and team development and training); (iii) assure continued **support from overseers for such dual capacities**; and (iv) maintain/enhance public understanding and **forbearance for respective needs**.

At the same time, the conditions that produce the need to (i) intensify system safety, i.e., greatly reducing the experience of known hazards and (ii) fend off aggressive external attacks meant to cripple or destroy (i.e., assuring the absence of predatory suffering) **also increase** the operating social complexities **beyond careful comprehension**.

*While deep knowledge limits some *surprise*, internal scale and increasing complexity guarantee it. And hostile external efforts at deception and seeking destructive advantage brook persistent, inevitable unpreparedness.*

What if experiencing surprise and unpreparedness were to be expected, and experienced without blame and with some sympathy for those close to the hazard, what patterns could (perhaps should) become evident from analysts and leaders?
## 8.6 Preparing to Be (Legitimately) Surprised... to Be (Legitimately) Unprepared

An important **emerging analytical challenge** would (and should) be the development of credible skills, norms, and practices associated with “preparing to be surprised” during the deployment of measures expected to improve safety and/or security [3]. Surprises associated with each of these domains are likely to be systematically different. This a function of distinctive: (a) sources of *relative hazard* and technically/socially induced vulnerabilities and system complexities and (b) societal variations in public *awareness/acceptance* of surprises (forecasting incompleteness) and/or institutional unpreparedness, esp. in face of opponents’ aggressiveness and their success in finding weaknesses and vulnerabilities.

What overriding responsibilities and obligations for **mission and institutional leaders** would follow?

Capable senior leadership would facilitate (a) the **evolution of wary trustworthiness and empathy** for veteran safety and security first responders and stewards and (b) the emergence of **institutional cultures according to high salience to forbearance and forgiveness** as well as learning and blame-putting.

These would entail leadership **obligations** to

Resist calls for “efficient” spare-ness—the thinning of watchfulness with the resulting increase in social apprehension—and to explicate/highlighting the continuing dilemmas associated with short-term impatience and political tendency to under-resource conditions of watchfulness needed by subsequent work generations.

Assure organizational and public understanding of Saf/Sec stewardship roles and their fundamental contributions.

Enhance a sense of honor and resources—beyond operational costs—for safety and security stewards. And remind us of our underlining dependence on those who, in effect, have signed up to **take a bullet, suffer severe burns or serious injury on our behalf**.

**Afterword** Insisting on enhanced operations of both safety and security functions across the critical organizations and institutions is increasingly likely and imperative. Responding to these imperatives—the ken of institutional leaders, senior managers, and, especially, experienced supervisory veterans—is already challenging organizations across a wide spectrum of social life. Those responsible take up the tasks often with little preparation and limited experience. Making rapid progress in understanding the conditions of both their copacetic joining and potentials for disabling dysfunctions, especially, the sources of intra-operational conflict is essential. Seeking these improvements becomes a major challenge for us—the community of analytically acute observers of organizational life.

This essay touches on only some of the more obvious variations in organizational situations that will shape different outcomes. Reviewing the chapters of this book reveals something of the wider sweep of significant factors and the breadth of the
challenges of knowing. We are still just a little beyond the starting line. A detailed
sense of how these factors shape the outcomes and of the behavioral consequences
awaits a significant increase in empirical acquaintance and rigorous fieldwork—often
of the most demanding sort. It is also a work that is likely to be as intriguing and
interesting as it is important.

References

1. T.R. LaPorte, High reliability organizations: unlikely, demanding and at risk. J. Crisis Conting. Manag. **4**, 2, 60–71 (1996). (Special Issue on New Directions in Reliable Organization Research, ed. G.I. Rochlin.)

2. T.R. LaPorte, Observing amplified socio-technical complexity: challenges for technology assessment (TA) regarding energy transitions, ch 12, in *Energy as a Sociotechnical Problem: An Interdisciplinary Perspective on Control, Change and Action in Energy Transitions*, ed. by C. Buscher, J. Schippl, P. Sumpf, Routledge Studies in Energy Transitions, (2018), pp. 245–261

3. T.R. LaPorte, Preparing for anomalies, revealing the invisible: public organizational puzzles. Risk Hazards Crisis Public Policy **9/4** (2018). https://www.researchgate.net/publication/324111441

**Open Access** This chapter is licensed under the terms of the Creative Commons Attribution 4.0 International License (http://creativecommons.org/licenses/by/4.0/), which permits use, sharing, adaptation, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, provide a link to the Creative Commons license and indicate if changes were made.

The images or other third party material in this chapter are included in the chapter's Creative Commons license, unless indicated otherwise in a credit line to the material. If material is not included in the chapter's Creative Commons license and your intended use is not permitted by statutory regulation or exceeds the permitted use, you will need to obtain permission directly from the copyright holder.

<figure><img src="image_26.png" /></figure>
<figure><img src="image_27.png" /></figure>

Chapter 9
# Safety and Security: Managerial
Tensions and Synergies

Paul R. Schulman

**Abstract** The relationship between organizational safety and security is a concep-
tual and practical challenge. This paper focuses on the management aspects of this
challenge. Its argument is that we have yet to parse out the full range of contradic-
tory and complementary requirements of these two as managerial missions. Con-
sidering the requirements for high reliability management can provide a clarifying
lens for sorting out the contradictions and complementarities. Some overlapping
requirements from a high reliability perspective actually argue for an integration of
the two missions within one managerial framework with enhancements for “higher
resolution” reliability.

**Keywords** High reliability management • Safety management • Security management • Vulnerability

At a recent conference on safety management organized by a large public utility regu-
latory agency, the issue of infrastructure security came up for discussion. Addressing
the issue, the CEO of a large utility asserted: "If we're doing a good job of safety
management that should take care of security too". I took this to be a convenient
untruth at the time.

There is a strong debate among scholars and practitioners about whether the
same managerial framework within a single organization can accommodate both
effective and successful safety and security management [1, 3, 5]. Research on High
Reliability Organizations (HROs) has focused on a number of organizations (nuclear
power plants, commercial aviation and air traffic control centers, and electrical grid
management organizations, for example) with extremely well-developed reliability
strategies in both technical design and management systems for protection against
failures that can create catastrophic accidents [6, 7, 10, 11]. These organizations
notably, as critical infrastructures, are also potentially high-value targets for terrorist
assault. But it is not clear from this research that HROs are simultaneously addressing
both safety and terrorist security objectives in their reliability strategies.

<footnote>P. R. Schulman (✉)
Mills College and University of California at Berkeley, Berkeley, USA
e-mail: paul@mills.edu</footnote>
This essay will consider and compare major variables that have to be addressed and the strategy developed by an organization seeking high reliability management first, with a safety and then, a security mission.

## 9.1 Safety Variables and Strategy

The most prominent feature of HROs is that they are managing technical systems that can fail with catastrophic results—large-scale disruptions of critical services and potentially many deaths. “High Reliability” for an HRO means that there are protections against these failures or accidents in place to preclude them from happening—not just probabilistically, but deterministically. A key managerial feature of this reliability is the protection against errors that could lead to these “precluded events”, especially “representational errors”—mis-estimations, mis-specifications, and misunderstanding of the systems being managed that can lead to decisions and actions that invite failure and accidents. In this sense, reliability strategy is simultaneously a commitment to safety because you cannot ensure safety without reliability. But it is system safety, not individualized accidents such as slips, trips, and falls, that is the priority of HROs.

**Robustness of technical systems.** The technical systems under management are well understood in terms of operating principles and the maturity of technical designs. These are not frontier technologies whose operation is experimental in both underlying knowledge and operational experience. Much if not all of operations and maintenance is carefully analyzed, including careful risk analysis, and conducted under elaborate procedures. In the United States, for example, it is against federal law to operate a nuclear power plant “outside of analysis”.

Robustness is supported by technical designs that include redundancy of key components, back-up systems to compensate for the loss of primary ones, as well as planned and even automated shut-down protocols to stop operations in safe modes relative to potential major accidents. Non-operation is always a priority to continuing to provide outputs in the face of escalated risk.

The reliability of technical system components is often defined as how well their designs fulfill operational requirements and performance expectations, and within these designs how infrequently they fail. But reliability cannot be fully determined by designs alone. Components must be inspected, operated, and maintained within design specifications. This requires their protection by management from errors that could undermine these processes. Assuring the integrity of management information, decision, and control processes to prevent error is a major feature of managerial reliability.

**HRO managerial strategy.** A classical HRO management strategy for reliability and safety in managing technical systems is founded in the formula that low *input* variance (in external resources, supports, demands, and conditions surrounding the organization) coupled with low *process variance* (operations tied to procedures and careful prior analysis and planning) lead to low output variance (predictable and
reliable performance). Control over input and process variance are key elements in stabilizing performance.

Yet, ironically, this control is grounded in the recognition that a key to high reliability is not a rigid invariance in technical, managerial, and organizational processes but rather the *management of fluctuations* in task performance and conditions to keep them within acceptable bandwidths and outside of dangerous or unstudied conditions [12]. Many organizational processes that support high reliability, including high degrees of attention and care in specific tasks, lateral inter-departmental communication and trust, and shared sensemaking surrounding the execution of plans and decisions, are perishable in the press of day-to-day work and have to be continually monitored and renewed.

Supporting this narrow bandwidth management is the careful identification analysis, and exclusion of precursor conditions that could lead to precluded events. HROs begin with the core set of these unacceptable events, then analyze backward to conditions both physical and organizational that could, along given chains of causation, lead ultimately to significant possibilities of such events. This “precursor zone” typically grows outward to include additional precursor conditions based on more careful analysis and experience. These precursors are in effect leading indicators of potential failures and are given careful attention by operators, supervisors, and higher managers.

Some precursors are in effect “weak signals” to which “receptors” throughout many levels of the organization are attuned and sensitive. Examples of precursors observed in HRO research included: operating equipment nearing the edge of maximum allowable conditions such as temperatures or pressures; too much noise or too many people in a control room; silence or edginess in an individual control operator; backlogs in clearing corrective action reports; a movement into “unstudied conditions” in any operations or maintenance activities. In its effectiveness, this process of precursor management provides a special kind of “precursor resilience” to these organizations. They can identify and move quickly back from the approach to precursor zones while still maintaining a robustness in performance and outputs [10].

Another important element in HRO reliability management is the existence of a great deal of lateral communication. This is important to maintain the system focus of reliability and safety management and prevent localized actions without consideration of their wider effects. There is a lot of inter-departmental collaboration in work planning sessions, incident investigations, procedural reviews and procedure revisions.

Additionally, there is a widely shared culture throughout these organizations that supports the features described above. This culture supports managing to worst-case possibilities and not simply probability, and in many decision-making and planning activities. There is highvalue and indeed much personal esteem accorded to individuals who can offer imaginative examples of potential causal pathways to worst-case possibilities. The culture within HROs also stresses widely dispersed individualized responsibilities associated with detecting error, such as speaking up to correct it, and promoting the identification of precursors and the improvement of procedures. In one HRO, many individuals down to the control room and maintenance shop levels,
for example, actively participated in the procedural revision process. In important respects, these individuals “own” the procedures. In one nuclear power plant personnel at different levels expressed the view that, without continual improvement, existing levels of reliability would likely not be maintained due to the onset of complacency [12].

One important example of the culture of responsibility for safety reaching down to the level of the individuals is the importance of people we termed “reliability professionals” to the successful pursuit of reliability and system safety in HROs [11]. Who are reliability professionals?

These are individuals who have special perspectives on reliability, cognitively and normatively. They mix formal deductive knowledge and experiential knowledge in their understanding of the systems they operate and manage. Their view of the “system” is larger than their formal roles, specializations and job descriptions. They internalize in their identity the reliable and safe operation of their systems. In this, they are “professionals” on behalf of reliability and safety, but are not defined by particular formal degrees or certifications.

We have found reliability professionals distributed in many jobs at many levels in HROs. We find them among control operators, line production or maintenance personnel, engineering and other technical personnel who support operators and maintenance, and among middle-level managers and supervisors, department heads, and CEOs or agency heads. Whatever their formal job, they focus on identifying precursor conditions that degrade safety, including their own performance capabilities. They can also help police their own departmental or unit movements toward a practical drift away from reliability and safety because in their larger system perspective they think about the system risks and consequences of changes they or others make in their own task domain [8].

All of these elements in reliability and safety management in HROs reflect the widely stressed idea that, despite all the prior anticipation and analysis, the elaboration of procedures, the redundancies, and shut-down protections, there is still the potential for surprises in their technical systems and a constant need for vigilance and organizational improvement.

But it is important to appreciate that in this recognition of the potential for surprises and their strategy of precursor resilience, HROs are hardly confronted with major uncertainty in day-to-day operations and performance. In their settled technology, elaborate planning, anticipation, and analysis, it is not “managing the unexpected” HROs are engaging in. Instead, in managing to possibility, and adding a worst-case slant to planning and analysis, they are enlarging expectancies—formalizing an approach to avoid complacency and add to the possible scenarios that are part of their prior analysis and anticipation.

Now let’s consider management challenges with respect to a security mission and what “high reliability” might mean in this context.
## 9.2 Security Management Variables and Reliability Strategy

**Failure versus Vulnerability.** One obvious difference between safety and security management is in the primacy of hostile intent. For example, while they may have been “hardened” to resist an external assault, and while their management systems were well organized to guard against unintended errors in operations and maintenance, HROs were not well prepared to protect against willful and strategic *internal* sabotage through actions of destructive intent.

This is a special challenge in “managing the unexpected”. It is one thing to identify and manage operational risks of failure, it is another to identify and manage vulnerability to destructive intent. There are always more ways that a complex system can fail than there are for it to operate correctly as designed. But hostile strategy, both external and internal, can add additional possibilities for disaster because of the treatment of vulnerabilities as strategic targets. Further, if attacks on these vulnerabilities do not have to include the survival of the attackers, the possibilities get even larger still. An example of this is the strategy adopted by airlines after 9/11 to harden the cockpit door of airplanes to resist external intrusion from potential terrorists among the passengers. Ironically and tragically, addressing this problem led to a reciprocal vulnerability: a saboteur already inside the cockpit. In fact, a suicidal co-pilot of Germanwings Flight 9525, with the pilot momentarily out of the cockpit, locked the door, thus making himself impregnable, and flew the plane into a mountain-side. Protecting the cockpit against external intrusion actually created a new vulnerability and an opportunity for a different form of assault. Achieving reliability and safety against nature or inadvertent human actions is hard enough. It becomes a different challenge when failure itself is part of a learning system with the ability to develop *counter-strategy* for its promotion.

**A special problem in “design-based” vulnerability.** Vulnerability itself can come in a variety of forms, giving many options to saboteurs. Vulnerability means risk exposure, but vulnerability also pertains to an *innate ability to be harmed*. One form of vulnerability is by willful design strategy plus by potential victims toward harm itself. In way, victims move to make an assault more likely and/or more consequential with respect to harm. An example is when housing developments are built in flood plains, increasing their vulnerability to floods or when tall buildings or roads are constructed on earthquake faults or individuals build homes in forest areas with increased exposure to wildfire. A spectacular example of design-based vulnerability lies in the internet and its vulnerability to cyberattack.

It has been argued that the internet can now be attacked from any location, at any scale, and across a wide range of precision [4]. No natural system on earth could survive to evolve such an extreme degree of vulnerability. But the internet is not a natural system. We have allowed, encouraged, and designed it to evolves to this high degree of vulnerability. Currently, the internet is certainly one of the most important critical infrastructures with simultaneously the most extensive social dependency and the highest vulnerability of any system humans have ever created.
Every new element we add to internet connectivity, or the extension of its functions and capacity, introduces additional vulnerabilities—often across multiple dimensions. This design perversity, in which each new design element adds an increased number of vulnerabilities, to viruses, hacking or fraud, is an enlarging challenge to our processes of forecasting and understanding. It is hard to see how, under these current challenges, internet security can be successfully managed by individual organizational strategy or effectively addressed in local or regional public policy. By extension, it would seem that controlling design-based vulnerability implies the need for larger-scale social regulation than organizational self-interest or even an industry-wide self regulation would fully address.

In addition, for a terrorist, not every target has to be of high value in terms of disruption and death. Terror is designed to induce public fear and uncertainty, as well as policy reactions in anger that may lead to the sacrifice of other values held by a society. In this way, targets can have symbolic value well beyond any physical destruction. Even attacks on targets of marginal significance, or attacks that fail, can induce fear and a sense of vulnerability within a population. Security management can hardly be the management of everything. As two analysts conclude, “Most sensible people would [...] agree that it is impossible to thwart each conspiracy and detect each and every lone individual or group harbouring evil intentions” [2]. So high reliability security management cannot realistically rise to the level of the precluded event standard sought for safety in HROs, nor is it likely to be pursued effectively by single organizations.

**Managerial control variables.** Strategic vulnerability adds additional challenges to reliable security management. Targets can be both external and internal. While an organization may have a set of controls it can use in internal operations (hierarchical authority, procedural requirements, training, hiring and firing, surveillance, etc.), it may have few control variables to cover the vulnerability of external infrastructures, or the loss of goods or service outputs from other organizations upon which it depends for operation. Further, those attacks that are not prevented may well require coordinated emergency response and recovery operations under conditions difficult for any single organization or set of organizations to manage effectively:

> Plans for crisis and disaster management tend to have a highly symbolic character, and often provide little guidance for those who must respond to unforeseen and unimagined events. In addition, plans are only useful if they are tested and refined and the people who work within the plan are familiar with their roles, responsibilities and interactions with others [2].

Also, consider the risks of risk assessments themselves applied to vulnerability. The purpose of risk analysis and assessment is to identify risks, rank them in terms of their importance and likelihood, and prioritize attention and resources devoted to them on the basis of this priority. Yet security vulnerability assessments, if known, might well undermine their own accuracy through counter strategy they might generate on the part of hostile strategists. They could in fact attract potential terrorists and add to the risk surrounding what are identified as vulnerable targets, or instead increase risk to low risk-assessed targets. Why not direct hostile action to what appear to be the *least* likely and possibly least defended targets?
The role of precursor management and the search for leading indicators and weak signals may also be limited in security management because perpetrators of attacks will make every effort to keep potential precursor actions and information secret or even disguise their intentions with false signals.

**Contradictions between security and safety management strategy.** Given the challenges associated with security management, it is not surprising that some of the approaches taken toward managing vulnerability might conflict with those dominant in safety management. The stress on anticipation and prior analysis appropriate to reliable safety management of settled technical systems may introduce rigidity and undermine the resilience and adaptability necessary for rapid responses to unexpected assaults. The need to contain the spread of information, about key plans, decisions, and priorities, within an organization to prevent counter learning on the part of internal or external enemies, may conflict with the system-level perspective, supported by extensive lateral communication, relied upon by HROs. Even the effort to harden targets against attack through guns, gates, and guards, as in the Germanwings example, may cause security protocols to conflict with the ease of access necessary for collaborative operations and decision-making [9]. The frameworks for physical and information security may also interfere with rapid inter-organizational coordination of emergency response operations after an attack.

## 9.3 A High Reliability Perspective on Both Safety and Security

**A case for overlapping management.** Even given the differences and potential contradictions between safety and security management, it could still be argued that there can be constructive overlap or “synergies” in the effort to achieve high reliability management of both missions. As noted in the workshop prospectus, failures in either can lead to “similar ultimate consequences” which may require similar emergency and crisis management approaches (although in terror attacks, first responders may also be part of the intended targets).

A major foundation for an overlap of high reliability management of both safety and security is the common need in both missions to identify and minimize error. Managerial reliability is founded on the management of error—including the errors of misperception, misidentification, and misunderstanding. The constant search for these forms of representational error, the continual questioning of assumptions, and accepting the possibility of surprise are underlying strategic and cultural features of high reliability management for safety. They are useful in warding off complacency and hubris, states of mind that could undermine the flexibility and imagination useful in foreseeing and preparing for terror attacks. The pattern recognition skills of reliability professionals are likewise useful for identifying quickly both unfolding system failures and progressing terrorist assaults.
The focus on precursor conditions and precursor indicators is also important to both missions. Learning to recognize potential precursors to terror attacks is already an important part of security management. Here again, the support given to reliability professionals in high reliability management is important. These individuals are often ones who look for and detect weak signals. In organizations with high reliability management, there is generally a receptivity to spokespersons for a neglected perspective. Terms such as "I find myself in uncharted territory" or "I'm not comfortable taking this action" are taken seriously, especially when those using them also have the ability to stop work or veto actions as part of their job authority.

**Challenges in safety and security management integration.** It will not be easy to bring both safety and security missions under a larger framework of high reliability management. This will require developing both a wider scope and longer time frame of anticipation and at the same time, a more distributed participation in error detection and precursor resilience. A higher resolution anticipation entails gathering a wider range of information and applying more imagination to the analysis of both external and internal threats over a range of scales, scope, and time.

Enlarged time horizons for anticipation and planning could uncover both slow motion safety and vulnerability issues, such as the design-based vulnerability described earlier, or even climate change, that are likely to grow over time. Enhanced anticipation will likely need to be matched by a wider range in the *scale* of reliability management to include recognizing inter-organizational and even international precursors of accidents or assaults and the ability to manage defenses and responses on these international scales.

Teams also can be important to enlarging the range of organizational *resilience* in the face of failure or attack. In many cases, reliability professionals in teams function effectively as first responders after failure or attack, bringing their experience and effectiveness at pattern recognition quickly to bear in guiding action to limit damage or speed recovery. The role of U.S. air traffic controllers in clearing the skies of all aircraft quickly after the onset of the 9/11 terror attacks is a good example of this emergency response role at the service of both safety and security. Organizations can train and support their reliability professionals to use their skills as a means to improve both the anticipation of vulnerability and the capacity for resilience to back-up reliability in the promotion of both safety and security.

## 9.4 Conclusion

It is possible, based on the argument above, that applying an overlapping high reliability management framework to both safety and security missions cannot only enhance both but will also actually protect *against their undermining one another*. The error sensitivity at the foundation of high reliability management can also apply to the identification of and reaction to leading precursor indicators of one mission undermining the other. It is important to think carefully about this enhanced reliability and how it might be lost to both safety and security objectives if these objectives were
to be treated as separate processes and managed in separate management domains
alone.

References

1. M.F.H. Abulamddi, A survey of approaches reconciling between safety and security requirements engineering for cyber-physical systems. J. Comput. Commun. **5**, 94–100 (2017)

2. A. Boin, D. Smith, Terrorism and critical infrastructures: implications for public-private crisis management. Publ. Money Manag. **26**(5), 295–304 (2006)

3. S. Coursen, Safety vs. security: understanding the difference may soon save lives. *Linkedin* (2014). https://www.linkedin.com/pulse/20140831152519-11537006-understanding-the-difference-may-soon-save-lives-safety-vs-security

4. P. Dombrowski, C. Demchak, Thinking systemically about security and resilience in an era of cybered conflict, in *Cybersecurity Policies and Strategies for Cyberwarfare Prevention*, ed. by J. Richet (ISI Global, Hershey, PA, 2015), pp. 367–382

5. S.H. Jore, The conceptual and scientific demarcation of security in contrast to safety. Eur. J. Secur. Res. (2017). https://doi.org/10.1007/s41125-017-0021-9

6. T. LaPorte, P. Consolini, Working in practice but not in theory: theoretical challenges of high reliability organizations. Publ. Adm. Res. Theory **1**(1), 19–47 (1991)

7. T. LaPorte, High reliability organizations: unlikely, demanding and at risk. J. Conting. Crisis Manag. **4**(2), 60–71 (1996)

8. K.A. Pettersen, P. Schulman, Drift, adaptation, resilience and reliability: an empirical clarification. Saf. Sci. **117** (2016). https://doi.org/10.1016/j.ssci.2016.03.004

9. K.A. Pettersen, T. Bjørnskau, Organizational contradictions between safety and security—perceived challenges and ways of integrating critical infrastructure protection in civil aviation. Saf. Sci. **71**, 167–177 (2015)

10. E. Roe, P. Schulman, *Reliability and Risk: The Challenge of Managing Interconnected Critical Infrastructures* (Stanford University Press, Stanford, 2016)

11. E. Roe, P. Schulman, *High Reliability Management* (Stanford University Press, Stanford, 2008)

12. P. Schulman, The negotiated order of organizational reliability. Adm. Soc. **25**(3) (1993), 353–372

**Open Access** This chapter is licensed under the terms of the Creative Commons Attribution 4.0 International License (http://creativecommons.org/licenses/by/4.0/), which permits use, sharing, adaptation, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, provide a link to the Creative Commons license and indicate if changes were made.

The images or other third party material in this chapter are included in the chapter's Creative Commons license, unless indicated otherwise in a credit line to the material. If material is not included in the chapter's Creative Commons license and your intended use is not permitted by statutory regulation or exceeds the permitted use, you will need to obtain permission directly from the copyright holder.
Chapter 10

The Interface of Safety and Security;
The Workplace

<figure><img src="image_28.png" /></figure>

Check for
updates

George Boustras

**Abstract** 9/11 had a great impact on the development and occurrence of high pub-
licity security-related incidents. One of the biggest impacts was that to public health,
due to an increase in psychosocial issues. Cybersecurity incidents and processes of
radicalization (either due to religious, political, or economic reasons) can have a
direct result on the workplace as well as at the organizational level, which in turn
can affect the worker. The aim of this chapter is to explain the main factors linking
safety and security, creating a new area for workplace health and safety, that of the
"interface of safety and security".

**Keywords** Safety in the workplace · Security · Safety culture · Security culture

**10.1 Introduction**

Many high-impact security-related issues have occurred since the turn of the mil-
lennium, both large-scale events such as the Paris, Brussels, Nice, London, and
Madrid attacks or with a smaller scale such as various knife attacks in Israel and
lone wolves. As a category of events, rare episodes of the early noughties (e.g., 9/11,
7/7 in London, Attocha in Madrid) are becoming increasingly “usual”. Episodes of
violence related to radicalization, cyberattacks, increased fear of a CBRN (e.g., dirty
bomb) attack creates a complex security environment also for workplaces. Radical-
ization [1], which is an emerging issue for workplace health and safety, illustrates
the difficulty of Western societies to explain a mechanism that brings to the surface
previously unknown forms of societal unrest. Cybercrime as well, which is a prod-
uct of the large-scale development of information technology, can result in new and
unforeseen interactions between previously unrelated places of work. The reliance
of modern societies and occupational environments on digital systems illustrates the

<footnote>G. Boustras (✉)
CERIDES - Excellence in Innovation and Technology, European University Cyprus,
Nicosia, Cyprus
e-mail: G.Boustras@euc.ac.cy</footnote>
potential impact of such attacks [2]. Both radicalization and cyberattacks have in common that they are driven by the human factor.

Moreover, the combined efforts at Critical Infrastructure Protection is a “test bed” to prove the interconnection between these new forms of security threats. These emerging risks have an impact on infrastructure as well as the occupational environment and the employee [3]. At the same time, safety-related issues have been highly affected by the still ongoing economic slowdown [4] and its byproducts (increased occupational psychosocial issues) [5]. Safety in the occupational environment, safety systems and competent authorities are victims of austerity measures, associated with the financial crisis. Financial uncertainty, increased security-related media hysteria result to yet more psychosocial issues.

As Beck [6] discusses the impact of new, globalized risks for individuals in society, it is obvious from the above that a new set of social conditions (cybersecurity threats, radicalization, economic crisis, etc.) that affect the workplace and the employee have been created. These are both a new set of conditions that bring safety and security tighter together and create a more complex and dynamic environment than before. This is a new narrative for workplace safety, constructing a causal link where security-related episodes impact safety, both at the occupational and societal levels. In other words, a new type of risk should be taken into account. A new type of risk that—by default—inherits a large element of uncertainty. In addition, this uncertainty is inherent due to its dependence on human behavior.

The aim of this chapter is to illustrate the hypothesis that safety and security, although they can be seen from different perspectives, have a common interface in the workplace. This chapter takes an exploratory approach to underline and describe this interface. Due to the fact that the author comes from a safety background, forms and schemes related to safety are used. Existing safety science (stereotypes, metaphors, perceptions, theories, publications) still revolve around the basic narrative that stems from the industrial revolution that started in Western societies. Safety focuses on hazards, whereas security focuses on threats. Yet, more new risks and threats and more complex risks and threats are introduced. In this context, it becomes obvious that safety is becoming increasingly dependent on security and is affected by it. A new scientific domain emerges in the interface between security and safety.

## 10.2 Changes to the Physical Environment of Work

Security incidents have dramatic short- and long-term effects on the workplace. Physical injuries and life loss have a direct and immediate impact on day-to-day operations of the organization. Psychosocial issues can have a short, as well as a long-term impact on the organization. Post-traumatic Stress Disorder (PTSD), depression, and other stress-related diseases affect the workplace in an organizational manner as well as leading to financial implications. Stress-related diseases in the workplace have a direct cost to the social insurance system.
It is reported that, further to the collapse of the Twin Towers in New York (2001), a toxic cloud—made of various particles, among them asbestos—covered the wider vicinity [7]. Effects on the over 40,000 first responders and relief workers included short and long-term effects; it has been reported that at least four first responders’ deaths are linked to upper respiratory problems, and hundreds of fire-fighters have retired due to health effects [7].

At an organizational level, the effects are significant. Security incidents can be large scale (e.g., 9/11, 7/7, etc.) or small scale (possible security breach in the organi-zation's premises). Risk assessment is reformed to include security aspects as well, especially those linked directly to safety issues. An example of that is the (possible) development of a security policy and/or the establishment of a security recording mechanism (manual or automatic, manned or electronic) in order to avoid (or in response to) an attempted arson attack. Low-risk firms (e.g., office environments) increasingly attempt to consolidate the duties of security and safety officers.

As discussed above, a number of important terrorist attacks have occurred in the last few years such as attacks on the World Trade Center, the London transport system, Paris, Brussels airport and transport system. In addition to the effects described above, attacks on the workplace have further effects. While a security incident is a malevolent—usually preplanned—action, studies have reported that security incidents in the workplace have an impact on the way employees perceive trust toward their employer. The main achievement of the employee, that of the responsibility of the owner/manager to provide a safe and healthy workplace is put in doubt. It is crucial, therefore, to highlight the importance of the integration of security in organizational health and safety planning. The role of the leadership before, during, and after a crisis is crucial for an organization to respond, as well as be in a position to come back to a functional state.

Terrorists tend to choose emblematic employers and workplaces in order to achieve media coverage, also for ideological reasons. The literature suggests that personal preparedness is still at a low level, even in countries that have already faced emblematic security incidents and terrorist attacks [8]. Results suggest that less than half of the population have followed preparatory actions [9]. Security incidents in the workplace tend to create immediate issues with long-lasting effects, yet at the same time, society creates a “mechanism” where these events are eliminated not long after their occurrence. In other words, the emergence of the need for the establishment of a “security culture” similar to the alleged establishment of a “safety culture” at an individual, organizational, and national level becomes important. Based on this argument, one might argue that both security and safety cultures meet as they are targeted firstly to the individual. This is supported by Guldenmund [10] “most empirical studies of safety culture have focused on individual attitudes, perceptions and patterns of behaviours with regard to safety”, Mearns and Yule [11] “Having safety as a central value would be the defining moment for any organization embarking on the development of a positive safety culture, irrespective of the national context it is working in”, and the analysis of Smith [12] describing the switch of security (after the end of the Cold War) from the national level to the community and individual.
## 10.3 Cyber-Related Issues in Relation to Safety in the Workplace

Cyberattacks occur more and more often. Cyberattacks can have a significant impact on the workplace and the welfare of the employee. A possible attack on the workplace may mean loss of sensitive data that may lead to a temporary or permanent closure of the firm. High-risk operations may be affected by cyberattacks with the possibility of operational or physical damage. News titles after the 2016 Brussels attacks reported preparatory work for a possible terrorist operation in one (or more) of the nuclear installations in Belgium.

Cyberattacks can also cause serious damage at the societal level. Particular emphasis should be paid on the relationship between cybersecurity in the workplace and the safety and reliability of Critical Infrastructures. Energy Critical Infrastructure is the main supporting pillar of National and International economic activity. Possible interruptions can cause serious damage to the wider workplace [13]. Domino effects from possible interruptions to Critical Infrastructure can cause serious financial damage, among others. “Hundreds of shops across south-east London and north Kent were forced to close and commuters spoke of ‘incredibly frightening’ conditions on the roads as traffic lights failed” [14]. Modern infrastructures operate as a “system of systems” with many interactions, interconnections, and interdependencies among these systems. Thus, damage occurred due to cyberattacks in the workplace of one infrastructure system can cascade and result in failures and cascading effects onto all related and dependent infrastructures eventually impacting the broader economy and society [15]. Such interconnections and interdependencies can be digital, physical, geographical, or logical [16].

## 10.4 Radicalization Effects on Safety in the Workplace

An emerging risk about workplace safety and security is that of radicalization. Radicalization is a process where individuals are subjected to extremist material with a direct effect on their social behavior, perceptions about society and justice. Various mechanisms such as personal grievance/revenge, existing or developing psychological issues explain the emergence of radicalized individuals to terrorists [17]. Despite media reports that the perpetrators of the majority of the latest terrorist incidents were “homegrown, radicalized youth”, there is no literature highlighting the relationship between radicalization and the occupational environment. This chapter will attempt to underline the various parameters affecting everyday life in the workplace, in relation to radicalization; it will attempt to explain the common factors leading to the occurrence of occupational safety issues. The relationship between human behavior and safety in the workplace is straightforward [18]. Rational or irrational behaviors lead to accident occurrence. Human behavior in turn comprises a number of attributes.
Reports from captured terrorists mention various reasons that (allegedly) led them to become radicalized. Among the causal factors mentioned are various forms of discrimination (mainly dealing with religious or political issues) and bullying (because of the discrimination). Discrimination in the workplace has a long history associated with it. Huang and Kleiner [19] mention that “*In the 1960s and 1970s, blacks and women fought for their rights. In the 1980s and 1990s, it was gays and lesbians. Now it has turned into employers and employees and the battlefield is religion in the workplace*”. Religious discrimination [20] in the workplace can have a formal and informal way of occurrence. Religious jokes, exclusion due to religious issues, discounting of religious beliefs can create an environment where personal grievance and willingness to take revenge are cultured. Irrespective of the intensity of the comments or behaviors in the workplace, perceived discrimination [21] can have various effects. Whether discrimination is wide or covert, what matters most is how the employee will perceive it. The results of perceived exclusion can be felt in the workplace and the society. Exclusion and discrimination (as it will be analyzed in another part of this chapter) is a common factor leading to (among others) workplace issues. Verkuyten [22] emphasizes the role of discrimination as a leading factor to radicalization. Popular press describes terrorists as “normal” people until a certain age (prior to their actions) with informal, precarious, or formal types of employment. Bullying/discrimination due to (religious) discrimination has dual effects to the workplace (absenteeism, with obvious social and economic impacts) as well as to the victim (psychosocial issues).

## 10.5 Financial Crisis Influence on the Increase of Psychosocial Issues

The economic crisis that started in 2008 with the collapse of Lehman Brothers left an impact on specific parts of the Western World. Southern European countries suffered the majority of the impacts of the crisis [4]. For some countries, the economic crisis became a social crisis as well.

This chapter argues that the effects of the financial crisis can be a connecting factor between safety and security. Undoubtedly, the financial crisis has had an impact on the job market [23] and public health [24]. Changes in the job market meant an increase in unemployment, temporary and undeclared work. Lower wages, insecurity, informal working hours paint a dramatic picture with clear impacts on health and safety of employees. A direct impact is that of the increase of psychosocial issues in the workplace [25, 26]. Psychosocial issues in the workplace have direct effects on the organization and the workforce. Anxiety, bullying, mobbing, depression lead—among others—to an increase in occupational injuries. Insecurity, desperation lead to various forms of extreme behaviors, creating the background for potential attacks and aggression, which in turn leads to social exclusion. At this point, it should be noted that there are similarities with the process leading to
radicalization, as described above. Historical analysis shows that financial crises
cause political disruption and political radicalization [27]. The economic crisis has
been the driving force behind the rise of extremist political parties in Europe, which
marketed anti-globalization, anti-immigration, anti-foreigner rhetorics [28].
*Social exclusion surfaces as the connecting factor between potentials leading to safety- and
security-related incidents.*

**10.6 Conclusions**

The aim of this chapter was to describe factors that are redefining safety in the
workplace; the interface of safety and security. The chapter has presented arguments
that showed how specific factors and cases (cybersecurity, critical infrastructure
protection, radicalization, etc.) can be the “connecting dots” between security and
safety. Still, without the empirical analysis necessary to establish causal connections,
the factors explored indicate how the two (safety and security) increasingly meet at the
level of the individual worker, with both causal connections to and ramifications for
the organization. In this perspective, many workplace risks must be viewed as highly
dependent on human behavior and an outcome of various psychological processes
(e.g., developmental, cognitive). For example, psychosocial issues relate to security
incidents (and relevant media hysteria), agitating workers and creating prolonged
feelings of fear and anxiety. Also, as discussed in the chapter, political radicalization
and the financial crisis have been shown to have social exclusion as a common route
that can lead to security incidents. Consequently, we must consider how to approach
the participation of workers in safety and security, as workers previously are viewed
as part of safety efforts. Among other, formal ways of worker participation in the
development of safety policies, through the legally binding establishment of health
and safety committees, could be replicated toward the establishment of a security
culture in the workplace. Training, risk assessment, adoption of policies should be
typical for both safety and security cultures. However, a fundamental difference
between the two (safety and security) lies in the fact that with safety, there is a legal
requirement to the owner/manager—in other words, responsibility is personalized.
With security, this is not the case as the State authorities provide the backbone. This
again has consequences for strategic priorities and the development of incentives.

**References**

1. S.A. Høyland, Exploring and modeling the societal safety and societal security concepts—a systematic review, empirical study and key implications. Saf. Sci. (2017). ISSN 0925-7535. https://doi.org/10.1016/j.ssci.2017.10.019

2. B. Wilpert, Impact of globalization on human work. Saf. Sci. 47(6) (2009), 727–732. ISSN 0925-7535. https://doi.org/10.1016/j.ssci.2008.01.014
3. M. Nilsen, E. Albrechtsen, O.M. Nyheim. Changes in Norway's societal safety and security measures following the 2011 Oslo terror attacks. Saf. Sci. (2017). ISSN 0925-7535. https://doi.org/10.1016/j.ssci.2017.06.014

4. I. Anyfantis, G. Boustras, A. Karageorgiou, Maintaining occupational safety and health levels during the financial crisis—a conceptual model. Saf. Sci. (2016). ISSN 0925-7535. https://doi.org/10.1016/j.ssci.2016.02.014

5. H.H.K. Sønderstrup-Andersen, E. Bach, Managing preventive occupational health and safety activities in Danish enterprises during a period of financial crisis. Saf. Sci. (2017). ISSN 0925-7535. https://doi.org/10.1016/j.ssci.2017.03.022

6. U. Beck, *Risk Society, Towards a New Modernity* (Sage Publications, 1992)

7. EHS Today, 9/11: Safety and Health Lessons Learned (2006). http://www.ehstoday.com/fire-emergencyresponse/ehs_imp_38472. Visited on 28 February 2018

8. M. Kano, M.M. Wood et al., Terrorism preparedness and exposure reduction since 9/11: the status of public readiness in the United States. J. Homeland Secur. Emerg. Manage. **8**(1) (2011)

9. J.L. Gin, J.A. Stein, K.C. Heslin, A. Dobalian, Responding to risk: awareness and action after the September 11, 2001 terrorist attacks. Saf. Sci. **65**, 86–92 (2014)

10. F.W. Guldenmund, The nature of safety culture: a review of theory and research. Saf. Sci. **34**(1), 215–257 (2000)

11. K. Mearns, S. Yule, The role of national culture in determining safety performance: challenges for the global oil and gas industry. Saf. Sci. **47**, 777–785 (2009)

12. S. Smith, The increasing insecurity of security studies: conceptualizing security in the last twenty years. Contemp. Secur. Policy **20**(3), 72–101 (2007). https://doi.org/10.1080/13523269908404231

13. C. Varianou Mikellidou, L.M. Shakou, G. Boustras, C. Dimopoulos, Energy critical infrastructures at risk from climate change: a state of the art review. Saf. Sci. (2017). ISSN 0925-7535. https://doi.org/10.1016/j.ssci.2017.12.022

14. P. Dominiczack, A. Nassif, 60,000 homes are blacked out as vandal fire causes huge power cut, Evening Standard (2009). https://www.standards.co.uk/news/60000-homes-are-blacked-out-as-vandal-fire-causes-huge-power-cut-6746359.html. Last visited 19 March 2018

15. European Climate Adaptation Platform, Adaptation information, January 2018. http://climate-adapt.eea.europa.eu/adaptation-information/general

16. S.M. Rinaldi et al., Identifying, understanding, and analyzing critical infrastructure interdependencies. IEEE Control Syst. **21**(6) (2001)

17. C. McCauley, S. Moskalenko, Mechanisms of political radicalization: pathways toward terrorism. Terror. Polit. Violence **20**(3), 415–433 (2008). https://doi.org/10.1080/09546550802073367

18. T.B. Sheridan, Forty-five years of Human-Machine systems: history and trends. Keynote Address, in *Proceedings of 2nd IFAC Conference on Analysis, Design and Evaluation of Human-Machine Systems. Varese, Italy, September 10–12, 1985* (Pergamon, Oxford, 1986)

19. C.C. Huang, B.H. Kleiner, New developments concerning religious discrimination in the workplace. Int. J. Sociol. Soc. Policy **21**(8/9/10) (2001), 128–136. https://doi.org/10.1108/01443330110789880

20. B.R.E. Wright, M. Wallace, J. Bailey, A. Hyde, Religious affiliation and hiring discrimination in New England: a field experiment. Res. Soc. Stratif. Mob. **34** (2013), 111–126. ISSN 0276-5624. https://doi.org/10.1016/j.rssm.2013.10.002

21. J.I. Sanchez, P. Brock, Outcomes of perceived discrimination among Hispanic employees: is diversity management a luxury or a necessity? Acad. Manag. J. **39**(3), 704–719 (1996). https://doi.org/10.2307/256660

22. M. Verkuyten, Religious fundamentalism and radicalization among Muslim minority youth in Europe. Eur. Psychol. **23**, 21–31 (2018). https://doi.org/10.1027/1016-9040/a000314

23. N. Drydakis, The effect of unemployment on self-reported health and mental health in Greece from 2008 to 2013: a longitudinal study before and during the financial crisis. Soc. Sci. Med. **128** (2015), 43–51. ISSN 0277-9536. https://doi.org/10.1016/j.socscimed.2014.12.025
24. M. Karanikolos, P. Mladovsky, J. Cylus, S. Thomson, S. Basu, D. Stuckler, J.P. Mackenbach, M. McKee, Financial crisis, austerity, and health in Europe. Lancet **381**(9874), 1323–1331 (2013). https://doi.org/10.1016/S0140-6736(13)60102-6

25. N. Mucci, G. Giorgi, M. Roncaioli, J. Fiz Perez, G. Arcangeli, The correlation between stress and economic crisis: a systematic review. Neuropsychiatr. Dis. Treat. **12**, 983–993 (2016). https://doi.org/10.2147/NDT.S98525

26. V. Sedano de la Fuente, M.A. Camino López, I. Fontaneda González, O.J. González Alcántara, D.O. Ritzel, The impact of the economic crisis on occupational injuries. J. Saf. Res. **48** (2014), 77–85. ISSN 0022-4375. https://doi.org/10.1016/j.isr.2013.12.007

27. M. Funke, M. Schularick, C. Trebesch, Going to extremes: politics after financial crises, 1870–2014. Eur. Econ. Rev. **88** (2016), 227–260. ISSN 0014-2921. https://doi.org/10.1016/j.euroecrev.2016.03.006

28. G. Calhoun, G. Derluguian, *The deepening crisis: governance challenges after neoliberalism* (New York University Press, New York and London, 2011)

**Open Access** This chapter is licensed under the terms of the Creative Commons Attribution 4.0 International License (http://creativecommons.org/licenses/by/4.0/), which permits use, sharing, adaptation, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, provide a link to the Creative Commons license and indicate if changes were made.

The images or other third party material in this chapter are included in the chapter's Creative Commons license, unless indicated otherwise in a credit line to the material. If material is not included in the chapter's Creative Commons license and your intended use is not permitted by statutory regulation or exceeds the permitted use, you will need to obtain permission directly from the copyright holder.

<figure><img src="image_29.png" /></figure>
<figure><img src="image_30.png" /></figure>

Chapter 11

Exploring the Interrelations Between
Safety and Security: Research
and Management Challenges

Corinne Bieder and Kenneth Pettersen Gould

**Abstract** This chapter discusses some of the research and management challenges related to the safety and security nexus. In the first part, we address the conceptual connections between safety and security and discuss how different perspectives on how they come together allows for characterizing the complexity and ambivalence of their interrelations. We then go on to identify tradeoffs between safety and secu- rity and show that these exist both in theory and practice. Managing both safety and security means tradeoffs and power relations between internal entities and profes- sionals, but also beyond its own boundaries since some vulnerabilities escape the organization’s scope. In the final part of the chapter, we argue that addressing the interrelations between safety and security poses managerial and research challenges that call for global approaches to apprehend the multiple facets of the issue. We explain that little has been done on how the global trends of the risk society bring with them unanticipated and “hidden” effects on organizations safety and security practices and that it is here, as a macro-global oriented approach to organizational safety and security research, that the two fields of safety and security confront a shared research agenda.

**Keywords** Safety · Security · Management · Risk · Societal safety · Societal security

**11.1 Introduction**

Following recent events and disasters, and as threats and hazards are defined more
and more as systemic risks and products of modern society, safety and security are
coming together both in regulation and the ambitions of management. What does

<footnote>C. Bieder (✉)
ENAC (French Civil Aviation University), University of Toulouse, Toulouse, France
e-mail: corinne.bieder@enac.fr</footnote>

<footnote>K. Pettersen Gould
University of Stavanger, Stavanger, Norway
e-mail: kenneth.a.pettersen@uis.no</footnote>
it means that safety and security become mixed in the management of hazardous technologies and activities? Despite their apparent or intuitive proximity when considered conceptually, safety and security reveal some nuances and differences when leadership and practices are analyzed [1]. Technologies and activities also differ in the number and types of threats and hazards they have to deal with. Answers to the question are thus more complex than the initial conceptual similarities indicate. Looking at synergies and tensions between the two, in this final chapter, we come back to some main insights derived from the previous chapters and discuss challenges of addressing such a multi-faceted issue from both research and management viewpoints.

## 11.2 Implications of Definitions

From both a research perspective and an angle of management, defining safety and security seems a natural place to start in order to address their interrelations. Many seem to expect a unified understanding of definitions. This could allow both different scientists and practitioners across sectors to “speak the same language”, in order to better understand each other and work together. However, merely based on the various outlooks represented in this book, conceptual agreement is easier said than done. Brooks and Cole (this volume) also identify clear distinctions in the underlying body of knowledge between the safety and security professions, even though some overlap exists around the management of risks. Perhaps shared definition is not a sensible goal to pursue at all, as safety and security knowledge vary to a large degree depending on, among other, hazards/threats, disciplinary approach, regulatory context, and practice.

### 11.2.1 Defined as What We Want to Prevent

Both safety and security are seen as the freedom from harm. Indeed, when successful as management strategies, both safety and security lead to prevention or minimized unwanted consequences for people, the environment, and/or property. In other words, both share a common goal in loss prevention. However, when focusing on unwanted events and the associated causal factors that are eliminated and constrained, safety and security differ. In all the chapters, it is acknowledged that the involvement of human intent as a cause marks an important difference in how events are considered, managed, and prevented, justifying a clear distinction between safety and security. Although here again, there are some nuances. Where Blokland & Reniers, Leveson, Bongiovani, and Boustras (this volume) put intentionality forward as the main distinction, Jore, Brooks & Cole, Wipf, and LaPorte (this volume) are more nuanced, arguing that the difference is most clearly defined by malicious intent or the “primacy of hostile intent” (Schulman this volume) as a criterion for a security event.
### 11.2.2 Risk as an Overarching Framework for Management

According to Leveson and Bongiovanni (both this volume), conceptual exercises around the terms safety and security are not what really matters. In Leveson's approach (this volume), safety and security are both considered as sources of a system's loss of control, with no need for any distinction in the way they are considered and managed. Security events have an equivalent status to that of technical failure or human error. In this approach, the theoretical, methodological but also practical consequences of considering both safety and security are minimized. The two aspects smoothly combine by adding security threats to safety hazards and the associated failure scenarios to that already identified in a safety risk analysis. Eventually, from system engineering and design thinking perspectives, or more specifically, from the perspective of how to design controls in a system, addressing safety and security together and in the same way, seems natural and achievable. However, defining both safety and security as a dynamic control problem is a way of framing the issue of their interrelations that makes the solution already available and implemented for safety applicable to security as well. As stated during the workshop, we must be careful of "defining the problems based on our solutions".

Blokland and Reniers (this volume) apply a broadly used definition of risk as a reference to define safety and security. A key challenge in the movement from safety/security to risk is that both safety and security may improperly communicate an absolute degree of freedom from risk that is not implicit in risk science [2]. Many of the biggest safety and security risks we currently face are, although different in their causes, all products of human activities seen as being necessary. Thus, risks emerge from activities that we have to or want to undertake and cannot be "managed away" by science. Political demands for both safety and security may confuse both the politicians themselves and regulators, creating unrealistic and unwarranted expectations for action. The margins of error may be changed but the risk will remain as long as the activities continue. This has influenced and broadened approaches to uncertainty in risk research [3]. A significant issue for the assessment and management of risks is whether uncertainty is positive or negative. For example, in terms of nuclear power plants or airlines, is it good or bad to have uncertainties? Is it different depending on threats and hazards? A growing body of work has acknowledged that uncertainty plays a significant role in our understandings of safe and secure systems and societies [4–6]. In addition, how much an activity means for us is strongly associated with our judgment as to whether the risk is worth taking [7]. Consequently, both the risk appraisal and risk management of threats and hazards are influenced by individual and social factors. For situations where there is a rise in demand for safety and security, such as after a major disaster or a terrorist attack, we should expect the perception of risks to be amplified and standards to become more stringent than compared to direct estimation. However, for situations where demands for safety and security are low, such as for activities that produce large short-term ben-
efits where consequences are uncertain, for example, mobile digital communication technologies, we can expect risks to be attenuated and standards to be more relaxed [2, 8].

### 11.2.3 In Safety We Trust, in Security We Distrust

Security management, whether through its interrelations with safety or not, induces some organizational challenges from both a research and a practical viewpoint. Whereas safety, at least in principle, has reached a state where openness and sharing of information are acknowledged as criteria of improvement, security is rather a world of secrecy, both for attackers and for the potentially targeted organizations, which avoids increasing their vulnerability by unveiling characteristics. One of the categories of security threats that have received increased attention is insider events, as sadly illustrated by the Germanwings catastrophe in 2015 where the crash was caused deliberately by the co-pilot. The possibility of having employees that are on the one side trusted for their contribution to safety and at the same time distrusted as potential security threats represents a challenge for organizations [1], both conceptually and in practice as advanced by Jore (this volume) on the relevance of how to develop a security culture in organizations. Moreover, gaining access to the field for researchers, or even exchanging information with experts, becomes a challenge as soon as security is involved.

Consequently, addressing the interrelations between safety and security is not as simple as “mixing” the two using a broad risk approach or extending the scope of existing either safety or security approaches. As illustrated by Schulman (this volume), security involves vulnerability variables that are outside the boundaries of organizations. This observation has several implications: practical and managerial ones within an organization, but also methodological when it comes to describing, analyzing, and understanding the interrelations between organizations and their increasingly global environment. Addressing the interrelation between safety and security thus requires some caution not to be blinded by conceptual elegance or methodological solutions already available.

## 11.3 Tradeoffs Between Safety and Security

Exploring the synergies and tensions between safety and security allowed for recognizing the respective professions associated with safety and security, the resources that they both strive for, and lastly some conceptual and methodological rivalry between scientific frameworks and communities. These issues highlight the point that although organizations need a degree of both safety and security, there may be some important tradeoffs between them.
The security world, in terms of the industries, the actors, and the tasks involved, has significantly changed. "It used to be a police concern, classified information (...). Today, security is something a lot of people are doing (private companies, civil society...). It encompasses the security guard at the hotel, at the airport" (Jore, this volume) as well as others like the corporate security officers in companies. The spreading of security as an activity has been accompanied by the structuring of security as a profession (Jore, this volume), with tasks, underlying body of knowledge, and professional communities distinct from safety (Brooks & Cole, this volume). With security becoming an increased concern for hazardous industries, safety and security are now more than ever competing within organizations in terms of attention, resources, and power. As advanced by LaPorte (this volume), the form these managerial challenges can take depends on the historical path of the organization with respect to safety and security. Particularly, challenges are formed by which one existed first in the organization and what mix is already established. Introducing a new management function, whether safety or security, involves allocating dedicated resources that may also change the existing power balance and share of voice between the respective functions within organizations.

Beyond these areas of potential tension, the apparent proximity between safety and security can make it tempting for researchers to extend the scope of concepts and methods from one area of expertise (whether safety or security) to the other. As an illustration, one can take the evolution of the European Commission's research agenda for aviation. Safety was historically the core topic of the Advisory Council for Aviation Research and innovation in Europe (ACARE). Over the past few years, the safety working group has become the Safety and Security working group, and the 2017 version of the Strategic Research and Innovation Agenda<fnref n="1" /> deriving from the ACARE vision includes a large security section with a research budget emphasizing security. Although safety and security are close enough to appear in a shared research agenda, the intersection between safety and security is still largely addressed by experts in one or another domain, using concepts, theories, and methods coming from either safety or security. What we may be forgetting, ironically enough, is that doing so leads to transferring not only research approaches but also their (tacit) foundational premises that often remain implicit. For example, safety strives for everybody within the organization sharing information. Also, safety research is based on many well-developed researcher-practitioner collaborations. Looked through a security lens, the same premises do not seem to be considered foundational. Consequently, although transferring and adapting safety approaches to security may be tempting, understanding the underlying premises may be essential for this work to be successful. Of course, a parallel rationale applies for the opposite move from security to safety.

<footnote n="1">¹https://www.acare4europe.org/sites/acare4europe.org/files/attachment/acare-strategic-research-innovation-volume-1-v2.7-interactive-fin_0.pdf.</footnote>
## 11.4 The Societal Convergence of Safety and Security

Returning to the chapters of the book, this volume shows that the management of safety and security in organizations is not isolated from social expectations and societal changes. As stated by Brooks and Coole (this volume, p. 64), “society becomes more complex and its members more risk averse”, whether the risk is associated with safety or security. Whereas the level of safety and security has increased over time, perceptions of risk have evolved differently [9], and overall acceptability of risk has decreased. The safest assumptions for the future seem to be that technology but also society will increase in complexity, uncertainty will abound, and new vulnerabilities will emerge. We believe that safety and security in organizations are not disconnected from the wider patterns of neo-liberal influence [10] characterized by extensive deregulation, privatization, and outsourcing. Today individuals have a lot more objectives and a lot more to lose than in the past, while at the same time their trust in institutions has decreased. These developments of the risk society are quite well described within European sociology [11] and in risk research [12]. Also, there are some issues that we can associate with the risk society thesis that have been picked up by safety and security research. One such issue is the acknowledgment that it is impossible to anticipate and control everything *a priori* and that other (complementary) strategies are needed. This line of thought recognized and addressed by HRO theory [13] in the late 80s and early 90s, the mindful organizing developments [14] and the resilience engineering research strand more recently [15], challenge management models based on logics of hierarchical control and converge on shared issues such as: How to be prepared to be surprised? How to manage the unexpected? What would it take to acknowledge uncertainty and evolve accordingly at a societal level, but also at the various organizational levels? However, as several scholars have already pointed out in relation to safety [10, 16], little has been done on how the global trends of the risk society bring with them unanticipated and “hidden” effects on organizations’ safety and security practices. It is perhaps here, as a macro-global approach to organizational safety and security research, that the two fields more fully confront a shared research agenda and to which several of the authors in this volume propose key contributions. For example, LaPorte (this volume) provides an interesting angle in the obligations of leadership to reach beyond the boundaries of their own organizations to avoid the “thinning of watchfulness”, “assure organizational and public understanding of safety and security stewardship roles and their fundamental contributions” as well as to “enhance a sense of honor and resources—beyond operational costs—for safety and security stewards” (p. 84). The theoretical developments in safety science during the 90s [17–19] underlined the impact of organizational and institutional aspects, with timeframes that went significantly back in time and upstream from operations. With security, threats such as terrorist attacks may for both explanatory and protective purposes have to be related to even longer-developing phenomena, such as radicalization as advanced by Boutras (this volume), with timeframes that go beyond technological design, organizational decisions, regulations, and laws.
## 11.5 Developing a Global Approach to Organizational Safety and Security Research

As indicated by several of the considerations in this volume (Schulman, Boustras), if we are to develop a global approach to study organizations, we need to consider different scales at the same time. Even more so, the range of scales needed to understand the interactions between safety and security may be even greater than when addressing safety or security alone. Pettersen and Bjørnskau [1] pointed at the impact of EU security regulations on aviation organization employees' working conditions and influence on safety in the field. Schulman (this volume) underlines the limitations of focusing exclusively on organizations when addressing security, for these organizations have little if any control on external vulnerability variables. Also, Boustras (this volume) discusses the need for multiple scales related to the link between radicalization as an international issue and workplace risks at an individual level. Conversely, with ever more interconnected systems and critical infrastructures, an individual malevolent act can have significant worldwide safety consequences, either direct, indirect, or both. These interactions between phenomena and actors at very different levels raise questions. For example, what is the motivation (even before the question of the means) for a company to prioritize and dedicate its own resources to preventing a malicious attack that may be high on the agenda as societal issues but with a very low probability for incidents in a specific company? Also, in the example of the Brussels airport attack in 2016, for example, the Head of Brussels airport security reported that members of his crisis team had a hard time getting to the crisis room from outside the airport for security at the site was under government responsibility. The scope of responsibility and leeway to manage safety, security, and their interrelations during a crisis is thus another issue.

In addition to the challenge of multiple scales, another issue is the need to address a multitude of actors at the same time, as well as being clear on what actors and at which levels research will be conducted. Taking a macro approach also suggests the inclusion of actors that are not so commonly considered in safety and security research. For example, Brooks and Cole (this volume), by addressing synergies and tensions through the lenses of the associated safety and security professions, suggest that both these distinct professional communities need to be considered as such. Likewise, as illustrated by Wipf (this volume), the attacker, that doesn't "exist" as such from a safety viewpoint, becomes an actor to be considered. Another actor suggested by Bongiovanni (this volume) to be considered is the end-user. Although central to the design thinking approach through which he looks at safety-security convergence, the passengers are largely absent from safety management approaches within aviation.

As a final remark, relevant empirical descriptions of how global trends bring with them unanticipated and "hidden" effects on organizations' safety and security practices are still few. Part of the reasons may be the research environment that needs to be created to have access to security-related aspects, or the tradeoffs between safety and security research topics and communities. Others may be, as discussed above,
related to the challenges of addressing multiple scales, dimensions, and aspects. In order to minimize “biases”, empirical research would best be framed and conducted by research teams involving both safety and security researchers. Bringing them together will (hopefully) allow for better definitions of scales, timeframes, and actors that are relevant for revealing how global trends bring with them unanticipated and “hidden” effects on organizations’ safety and security.

## References

1. K.A. Pettersen, T. Bjornskau, Organizational contradictions between safety and security—Perceived challenges and ways of integrating critical infrastructure protection in civil aviation. Saf. Sci. **71**, 167–177 (2015)

2. J.F. Short, *Organizations, Uncertainties, and Risk* (Westview Pr, 1992)

3. K.A. Pettersen, Understanding uncertainty: thinking through in relation to high-risk technologies, in *Routledge Handbook of Risk Studies*, ed. by A. Burgess, A. Alemanno, J.O. Zinn (Routledge, London, 2016)

4. G. Grote, Management of Uncertainty: Theory and Application in the Design of Systems and Organizations (Springer Science & Business Media, 2009)

5. N.N. Taleb, *The Black Swan: the Impact of the Highly Improbable* (Random House, New York, 2007)

6. T. Aven, *Risk, Surprises and Black Swans: Fundamental Ideas and Concepts in Risk Assessment and Risk Management*. (Routledge, 2014)

7. B. Ale, *Risk: An Introduction: The Concepts of Risk, Danger and Chance* (Routledge, 2009)

8. R.E. Kasperson, O. Renn, P. Slovic, H.S. Brown, J. Emel, R. Goble, J.X. Kasperson, S. Ratick, The social amplification of risk: a conceptual framework. Risk Anal. **8**(2), 177–187 (1988)

9. N. Pidgeon, R. Kasperson, P. Slovic, *The Social Amplification of Risk* (Cambridge University Press, 2003)

10. N. Pidgeon, Observing the English weather: a personal journey from safety I to IV, in ed. by J.C. Le Coze, *Safety Science Research: Evolution, Challenges and New Directions*, (CRC Press, 2019), pp 269–280

11. U. Beck, *Risk Society: Towards a New Modernity* (Sage, 1992)

12. K.L. Henwood, N. Pidgeon, *Risk and Identity Futures. Future Identities Programme* (Government Office of Science, London, 2014)

13. T.R. LaPorte, P. Consolini, Working in practice but not in theory: theoretical challenges of high-reliability organizations. J. Public Adm. Res. Theor. **1**, 19–47 (1991)

14. K.E. Weick, K.M. Sutcliffe, *Managing the Unexpected*, vol. 9 (Jossey-Bass, San Francisco, 2001)

15. E. Hollnagel, D.D. Woods, N. Leveson, (eds.), *Resilience Engineering: Concepts and Precepts* (Ashgate Publishing, Ltd., 2006)

16. J.C. Le Coze, Globalization and high-risk systems. Polic. Pract. Health Saf. **15**(1), 57–81 (2017)

17. T.R. LaPorte, High reliability organizations: unlikely, demanding and at risk. J. Contingencies Crisis Manag. **4**(2), 60–71 (1996)

18. J. Rasmussen, Risk management in a dynamic society: a modelling problem. Saf. Sci. **27**(2), 183–213 (1997)

19. J. Reason, *Managing the Risks of Organizational Accidents* (Ashgate, Aldershot, 1997)
**Open Access** This chapter is licensed under the terms of the Creative Commons Attribution 4.0 International License (http://creativecommons.org/licenses/by/4.0/), which permits use, sharing, adaptation, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, provide a link to the Creative Commons license and indicate if changes were made.

The images or other third party material in this chapter are included in the chapter's Creative Commons license, unless indicated otherwise in a credit line to the material. If material is not included in the chapter's Creative Commons license and your intended use is not permitted by statutory regulation or exceeds the permitted use, you will need to obtain permission directly from the copyright holder.

<figure><img src="image_31.png" /></figure>