As police were closing in on suspects in the bombings of four Madrid commuter trains, at least two of the alleged culprits blew themselves up in their apartment in Leganes, a southern suburb of the Spanish capital. Discovered amongst the rubble was a videotape depicting armed men, their faces covered by scarves. On the tape, a speaker suggests that Muslims have not forgotten their ouster from Spain in 1492: "We all know about the Spanish crusades against the Muslims, the expulsions from Al Andalus, and the tribunals of the inquisition," the speaker says, invoking the old Islamic name for Spain. Osama bin Laden has also referred to Spain by its ancient name in his official pronouncements. While these words may be mere rhetoric, they have raised concern among some observers that Muslim extremists have their sights set on Spain for the long term, not merely to punish the country for its alliance with the United States in the war in Iraq but also to settle a 500-year-old score.
Terrorism is but one of the top concerns that the Spanish government and businesses must address, however. Other issues include organized crime and the activities of antiglobalization agitators. Security Management traveled to Spain to talk with security and business professionals about how they are dealing with these old and new challenges.
Countering terrorists. Spain is no newcomer to terrorism--the Basque separatist group ETA (Basque-language initials for "Basque Homeland and Freedom") has killed more than 800 people in Spain since 1968--but it had never seen an attack of the magnitude of those carried out on March 11. While Basque separatists had, with notable exceptions such as a 1987 supermarket bombing in Barcelona, directed their fury and violence at the national government and its security and law enforcement apparatus, the Madrid train attacks indiscriminately targeted a cross-section of the Spanish public.
Given its indiscriminate nature, countering the Islamist extremist threat will require a reassessment of all current security plans, says Eugenio Morales, CEO of the Madrid-based consulting firm Plus-Quam.
As happened after 9-11 in the United States, the al Qaeda attacks in Spain have triggered a review of how government agencies coordinate with one another and how intelligence is shared and developed, says Morales.
For example, the new Spanish government, elected in the wake of the attacks on an anti-Iraq-war platform, has ordered the linking of databases maintained by the national police, which is a civilian force that patrols cities, and the Guardia Civil, which is a military and civilian federal police force responsible for activities such as border control and which covers much of the countryside. The government has also called for closer coordination by these two government agencies.
That costs money. On the private side, businesses are in the risk and threat analysis stage, says Morales. Plus-Quam, for example, has seen a surge in the demand for security audits among many types of companies and is witnessing a change in direction of security policies among some public and private businesses. But not all companies are yet at the stage where they would pay for additional security equipment or personnel, Morales says.
So far, security reviews haven't resulted in extra dollars for corporate security departments, agrees Roberto Hermida, a Spain-based security manager for a multinational company, as well as a professor of security at the Universidad Pontificia Comillas in Madrid.
In the aftermath of the attacks, he says, corporate directors asked their security departments to "guarantee the lives and assets of their businesses." But when told that increased security would require budget increases and capital investments, corporate brass balked. Instead, they asked their security departments to issue employees new security instructions, essentially "recommendations that would ease their fears," Hermida says.
Susana Marquez, security manager for Nike factory stores in Spain and Portugal, says that in her view, security "hasn't changed much" since March 11. Like Hermida, she sees little more than efforts to present a strong security face intended to placate the public.
The one aspect of security where activity appears to have increased is contract guard services. But the demand is mainly in sectors that have direct public contact, such as transportation, distribution, and entertainment, says Luis Posadas, an executive with Securitas Spain.
Chronic problem. Fulfilling the need for extra guards in those sectors that have requested it is a struggle, however. Posadas points out that the scarcity of qualified security officers is a "chronic problem" in the industry. He places much of the blame for the shortage on Spain's stringent private security law, which establishes certification requirements and details the types of people and businesses that can perform specific security services (see sidebar). Tweaking the law, he says, could make it easier to hire personnel for the 15,000 security positions currently unfilled throughout the country.
As Spain has prospered economically in recent decades, immigrants have poured in to fill jobs. For example, immigrants have helped fill jobs as "auxiliares" of security, a sort of sub-security officer who handles many security duties but needn't be licensed by the state. Miguel Rosino, security director for the Spanish retailer/restaurateur Grupo VIPS, says that the influx of foreigners has benefited his company, which employs immigrants from 70 countries in its approximately 200 locations.
Many analysts expect the level of immigration to increase in response to the May 1 entry of 10 Eastern European countries into the 25-member European Union, because EU member countries have open borders.
Rising immigration could exacerbate crime problems, security professionals say, because existing immigration has already fueled a thriving market in organized crime, which has resulted in increasing violence in the country. And Spanish law enforcement officials have warned of a likely increase in human trafficking as well.
Violence. As organized crime has proliferated, violence has shot up; according to a 2003 report on international crime prepared by the U.K. Home Office, violent crime in Spain surged 49 percent from 1997 to 2001. That rate outpaced the rise in the European Union as a whole by 27 percentage points. Compared to U.S. levels, though, the rate of violent crime in Spain is still very low. According to the U.K. Home Office, between 1999 and 2001, Spain averaged 1.12 homicides per 100,000 population. The U.S. average for the same period was five times greater--5.56 per 100,000 population.
Thievery. Among the new members of the organized crime families operating in Spain are Albanian gangs, which rob businesses and homes and have a predilection for stealing luxury cars. Miguel Merino, a security manager with 21 years of experience with transportation and shipping companies, adds that, with its increasing wealth, Spain is receiving both an increased number of and more valuable shipping consignments, which are stored in local warehouses. These warehouses have become favored targets of crime rings.
Nike's Marquez says that Eastern European and South American gangs have been boosting (a term for organized shoplifting) goods from retailers. Her response has been to keep a visible security presence for deterrent effect. Electronic-article-surveillance tags don't work for the stores, because the gangs are proficient at defeating various systems, she says. But surveillance by trained staff is effective.
In many cases, the gang members are identifiable, so security personnel keep a close eye on them. "Against a large gang, the only elegant solution is for them to feel observed by every member of the staff and feel that they are constantly under surveillance," Marquez says. Attentive customer service also discourages shoplifting.
When any of the boosters makes a move, security personnel have them arrested and prosecuted. That drives gang members away, at least for a while, she says. Still, the number and intensity of physical threats against security personnel "is increasing dramatically," Marquez says, and police are not always available to intervene immediately, which puts a lot of pressure on store staff to defuse potential violence.
Drugs. Another problem is drug trafficking. Spain is a crucial point of passage for drugs flowing from North Africa and South America to Europe, points out Jose Luis Bolaños, CPP, security manager for power company Union Fenosa. Europol has estimated that 60 percent of the drugs reaching Europe get there via Spain. The drug trade has fostered the growth of criminal gangs, which have extended their activities, such as money laundering, into legitimate businesses, such as tourism, Bolaños says.
Drug trafficking is also believed to have assisted the Madrid train bombers. It's been widely reported that the terrorists used money from drug sales to rent an apartment, buy a car, and purchase cell phones to use as detonators. Reports say that the terrorists obtained explosives from petty criminals in northern Spain by trading drugs for them.
Also more evident in Spain nowadays are anti-American and antiglobalization movements, which are causes of concern for security professionals at U.S.-owned or multinational companies. Spain's participation in the U.S. war in Iraq exacerbated those tensions. Nike's Marquez observes that many Spaniards attribute the U.S. invasion to the Bush Administration's desire to gain access to Iraqi oil rather than to altruism or concern about the Iraqi people.
High-profile multinationals are one target of antiglobalist and anti-U.S. activists. Marquez notes that Nike stores have been targets of antiglobalization (and anti-American) graffiti. As big business replaces mom-and-pop shops and the Spanish cityscape loses some of its distinct flavor, some security professionals expect expressions of discontent to grow.
Against the backdrop of these evolving threats, the security profession in Spain is struggling to achieve greater authority and acceptance. In many ways, the situation is reminiscent of the problems security faced in the United States in the past and with which it still struggles. The issues include lack of status in the corporate world and difficulties in getting good security officers, which are exacerbated by the laws governing those jobs. Another concern is decentralization of the security function within the corporate structure.
Corporate status. When Jean Pierre Payat, a Madrid-based consultant who helps security companies find markets throughout Europe, arrived in Spain in 1975, "the security management function didn't exist," he says. A low-ranking middle manager in the insurance department might be assigned that role, Payat says.
Considerable progress has been made in recent years, however. Today, 70 percent to 80 percent of the top 100 Spanish companies have a director of security, although fewer than half of the medium-sized companies have such a position, says Juan Muñoz, CPP, president of Associated Projects International, a Madrid consulting firm.
"Companies are starting to recognize the importance of a security director," says Payat. In a few cases, he adds, security directors are even reporting to the CEO or chief operating officer.
Union Fenosa's Bolaños has seen "huge progress" in security professionalism in recent years, due largely to the education mandated by the private security law. As Bolaños sees it, a security director in Spain exerts more power in the boardroom than a French or Italian counterpart, though not as much as security professionals in the United Kingdom and the United States.
Taking their cue from these latter two countries, some Spanish security professionals are trying to become indispensable to their employers by showing how their departments contribute to the bottom line. "We have to speak in corporate terms, not in terms of guards and locks," says Hermida. "We don't need more training or electronics," Muñoz told security professionals at a conference in February. "We have to show we can save money, in some cases even make some money. It's the only way we can survive."
And the image of security after March 11 may be improving. Security professionals "are assuming a salient role in many organizations because, in most cases, they are the ones who are leading the corporate protection effort," says Morales.
But that progress has not hit all sectors equally. Nike's Marquez notes that very few retailers have a security management department, solely relying on guards. A corporate level security position, she says, is a "luxury." Rosino, of Grupo VIPS, agrees. At many companies, "there's no security professional," he says.
Spanish security professionals contacted for this story uniformly described a profession that is still more fractured and less developed than it is in the United States. Muñoz attributes the difference in part to the more established corporate structure in the United States. He notes that the first U.S. multinationals date back to the 1950s, while the first Spanish multinational appeared in 1995. Muñoz also notes that security professionals in the United States benefit from pressure exerted by U.S. insurance companies, which encourage policyholders to adopt security-related measures in some cases. Pressure is also brought to bear by corporate governance and shareholders, he says.
Legal restrictions. Spanish private security law is governed by legislation passed in 1992, la Ley de Seguridad Privada (for more on the law, see sidebar on page 47). It explicitly states that private security is a function of the state that can only be carried out by the grace of the government. A company that creates an internal security department must notify the Ministerio del Interior, which oversees the execution of the law.
Security professionals and officers must meet minimum requirements and be certified by the state. Security product and service providers, including installers and private detectives, must be licensed by the state as well. Duties of guards--such as alarm response--spelled out in the statute as well, notes consultant and professor Manuel Hernandez.
The law permits only Spanish citizens to be private security guards, which has led to a labor shortage, since the job is not highly sought after and is more of an attractive entry-level position for an immigrant. National security organizations have been trying to have the nationality requirement lifted. Meanwhile, companies have resorted to creative options to comply with the letter of the law.
For example, a whole service subsector--the "auxiliares" referenced earlier--has sprouted to circumvent certification requirements, including the mandate that personnel be of Spanish nationality. The "auxiliares," are essentially staff who, in a thinly veiled fiction, don't officially act as security officers, although they perform many of the same duties. This practice helps relieve the security labor shortage, and it thereby keeps down guard prices, says Hermida.
In addition, some companies carry out security-like functions in other departments. Since they don't have a security department per se, they walk a fine line with the law by not notifying or registering with the Ministerio del Interior.
Patchwork status. Another reason for security's low status in the corporate hierarchy is that it hasn't been seen as a single holistic discipline but rather as the sum of many disparate concerns such as employee safety, facility management, and data protection. One chemical company familiar to Hermida and Hernandez, for example, has separate departments for storage and transport of dangerous materials, IT security, safety, and corporate security.
This decentralization of the private security function is common in other countries as well. In Spain, it is largely attributable to the private security law, which requires a separate specialist for designated specific functions that might otherwise fall under a unified corporate security department.
At some businesses, these departments work at cross-purposes and create conflict. The conflict is most pronounced with regard to IT and physical security, a problem not unique to Spain, of course.
The fragmentation of responsibilities has made it that much harder for security professionals to gain general prominence among business professionals when businesses seek expert security advice. At a security management conference in February, for example, Muñoz showed attendees one of the premiere Spanish business magazines, which contains a column that poses security problems and asks experts for advice. The advice comes from human resources professionals, headhunters, and various other experts. Everyone, it seems, except for security professionals.
But here, too, some progress has been made. For example, Muñoz says that when he was with a worldwide transit company in the 1990s, he helped merge security and insurance into a single risk management department. After performing risk assessments throughout the business, the department set up security standards for facilities and processes, and managers were queried about compliance twice a year. The department ended up establishing the position of security "nominees," nonsecurity workers such as loaders who would receive brief security training and would process, handle, and track sensitive shipments. Nominees are now at every site, and the company's insurance premiums now better reflect the true risk profile.
Security officers. Security officers have their own image problem. "Ten years ago, guards were well respected," says Rosino of Grupo VIPS. That's no longer true, he says. Getting good-quality guards is difficult, especially in retail, Rosino says, where attention levels must be high at all times.
In one case with which Hermida is familiar, government officials were visiting a hotel and wanted a security presence, but not a visible one. The guard was told to stand behind a date palm tree in the lobby. The example is emblematic of the low esteem bestowed on guards, Hermida suggests.
But Alfonso Bilbao, general manager of marketing and development at Securitas Spain, says that the poor image of officers is unjustified. He emphasizes that Spanish law requires 240 hours of classroom instruction for guards, plus 20 hours of practical training. Officer candidates must also pass a certification exam, and they must maintain that certification by taking 75 hours of further classroom training every three years. In an attempt to generate more interest in the field, Securitas provides this training for free, Bilbao says.
Security consultants. Security as a consulting specialty is not as prominent in Spain as elsewhere. In the minutes of a national conference on private security in Spain held last fall, says Plus-Quam's Morales, there is no mention of consultants. He explains that even when a company wants to outsource a security job, it does not necessarily look for a security consultant. There is little consumer awareness of what consultants can offer, Morales says. For example, he says, companies that wished to outsource security measures at explosives-storage facilities would traditionally contract mining engineers for the job, not security experts.
To the extent that consultants do exist, they are not regulated and "there's a profound lack of interest in controlling unlicensed practice of security consulting," Morales says, the result being that incompetence abounds. "The authorities are not paying attention to us, so there are unqualified people doing this in this country."
On March 11, Spain officially became a target of Islamic extremists, bringing unprecedented international attention to the country's antiterrorism efforts, including those of the private sector. Spanish security professionals hope they can leverage the new level of attention and concern into increased authority and funding. But as in the United States, corporate willingness to pay for better private security has thus far not matched the rise in public fears of the next attack.
Michael A. Gips is senior editor of Security Management.