Travel

Sometimes when individuals leave their familiar surroundings, they fail to recognize the risks present in the new locale. These risks may include threats to personal security, changes in information security controls, and even foreign governments' interest in your business activities and intellectual property.

Properly assessing and responding to risks before, during, and after travel is an important part of a personnel safety program.

Security concerns and risks differ depending on location. Fortunately, most countries share information with their citizens who are traveling abroad.

Organizations and travelers should research a destination's record for petty crime, governmental surveillance, legal frameworks, statutory and regulatory differences, local customs, and practices.

A few examples should illustrate the risks of international travel:

• Most westerners are surprised to learn that, in many countries, kidnapping is a well-established business model. Many organizations doing business in these locations purchase insurance policies to provide ransom payment. Organizations that send people into high-risk areas are well-advised to determine beforehand how such circumstances will be handled.
• In many countries, foreign intelligence services will track every traveler to determine their actual purpose for visiting. This includes interviewing locals who have contact with

the traveler; copying passports, documents, and electronic devices at the border or surreptitiously at the traveler's lodgings; and searching travelers' rooms or actively monitoring rooms with cameras and microphones. In some cases, travelers "serendipitously" find a local national who speaks the traveler's language and is coincidentally traveling to the same places, at the same time.

• In many countries, the electronic surveillance network is very robust, taking advantage of facial and other biometric recognition tools to identify and track people in public places. Reporting on a traveler's movements by hotel staff is also a common practice.

You are not exempt from this sort of attention simply because you are a private citizen or working for a private firm. From a personal security perspective, this level of attention can be disconcerting. However, if you have proprietary information that you must bring with you in your travels, additional thought should go into protecting it from disclosure.

Some security aspects to consider when personnel are traveling/working remotely:

• If you do not need it, do not take it with you. Whether it is information, money, or electronics, if it is at home, it is probably safer than on your person in a foreign country.
• If you have to take it with you, consider the ways of legally protecting the information. Devices and data that are physically moved to any location outside the organization's control can benefit from the additional protection of encryption. This can protect the organization from loss of data due to interception in transit or physical theft/loss of a device. However, if personnel are traveling internationally, encryption options may be limited by law in some jurisdictions.
• Secure remote access. If personnel are going to connect to the organization's environment from offsite facilities, the organization needs to create a secure mechanism for doing so. As with encryption, this may be limited within certain jurisdictions.
• Additional jurisdictional concerns. Data moved across borders may be subject to different statutory/ contractual regulations.
• Personnel protection. Personnel need to be protected according to the specific security conditions of geographic areas where they may be traveling. The organization should provide location-specific orientation material for travelers, additional personnel training, medical/life insurance, and physical protection elements as needed.
• Condition monitoring. When personnel are traveling, someone remaining at the organization's primary operating site should be monitoring their location and condition on a regular basis and ensuring daily check-ins. Determining if the individual is acting under duress (see below) must be performed as a part of the condition monitoring.