Conference 7.286::digital

        Rob, I gather from your description of what you do that you're
        mostly involved with the physical security of Digital's facilities
        and with authenticating the personal identities of employees.
        
        That's an important function, and one that, in my experience, is
        usually carried out effectively and courteously by most of the
        people responsible. 
        
        You also mentioned information security.  While there is certainly
        a relationship between the physical security of the workplace
        and the concerns for information security, I suspect that many
        of us have different perceptions about the quality of Digital's
        response to the needs in the different areas.
        
        If you have no objection, perhaps we could focus this topic on the
        physical security aspects, and discuss information security (where
        it doesn't clearly relate to physical security) in other topics,
        or even in other conferences (such as HUMAN::SECURITY_INFORMATION
        and HUMAN::SECURITY_POLICY, to name just two).  I'm asking this
        not to stifle discussion of information security, but rather to
        try to focus discussion in this topic on the area of physical
        security, which I think is the major focus in your note. 
        
        Carry on!
        
        Tom

Re .0:

	You summarize all the positive aspects of security very well and what
    you cover is vital.  However, you skip the abuses that can arise out of a
    security system.  Most of the problems have been covered in other notes,
    but a brief summary of the other side of the problem might be appropriate
    here.  Some of the problems are --

    -	Selective enforcement of the badge or search rules, including searches
	based on mode of dress or other prejudices.

    -	Use of entry/exit records for other than safety purposes.

    -	Over reaction to slightly unusual situations.

	I, personally, have never had any serious problem with the security at
    my site or any other DEC site and really appreciate the security provided
    and do my best to cooperate with the security people.

    Re .0 (Rob) .2:
    
    Physical security is a necessity.  Since I've been here a l_o_n_g
    time (20+ years), I've heard of one or two instances where items
    have been "borrowed" by folk, and have been recovered by security.
    
    Compared to other companies I've worked for, the security at Digital
    is not very intimidating or restriction, while still doing its job.
    
    >............... However, you skip the abuses that can arise out of a
    >security system. 
    
    Abuses can manifest themselves anywhere.  We're all human, even
    security folk.
    
    Steve Kallis, Jr.

    Security at the various plants I've been in has varied significantly.
    
    At my current plant, DLB9, it has ranged from poor in some respects
    to excellent in others.  The good first...
    
    The receptionist/security guard always requires display of badges
    when entering the building.  This has varied to the extent that
    in some buildings, the guard is nowhere to be seen.
    
    The security guards are invariably courteous and helpful.
    
    The bad...
                                                
    The one concern I hear repeatedly has to do with the lack of security 
    personnel around here on the weekends.  This is an isolated site.  
    If something happens around here on the weekends to someone 
    (a rape, assault, heart attack, or whatever) the person could lie 
    around until another employee came in (Monday morning?).  I feel that 
    at the very least a security guard could be continually making rounds 
    between DLB8 and DLB9 (and inside DLB8/9), or optimally have a guard 
    in each building 24 hours.  But unfortunately security doesn't have 
    the personnel for either suggestion.   
                  

Security at Digital is not taken seriously. I remember being shocked by the 
laxness when I first started working in the Mill 11 years ago. More recently,
I had a meeting in the Mill (I now work in BXB1). I had forgotten my badge.
I walked up to the guard and told him that I had left my badge at home. He gave 
me a card to fill out with my name, badge, cost center, and supervisor's name.
When I completed the form he handed me my temporary badge without attempting to 
verify anything and I disappeared into the mill!

Dileep

I was told of a contest a few years ago to see who could flash the most
outrageous thing and have the receptionist/guard accept it as a Digital
badge.  Competitors' badges passed the test easily.

The winner




a can of tuna.

    re: .6
    
    When I worked at RCA's space center (gov't. contracts, etc.) I
    used to do something similar.  I would put my badge inside my
    pocket, but as I passed the security checkpoint, I would simply
    flip my coat lapel.  In 14 months at RCA, playing this game daily, 
    I only got challenged 3 times.

    Claude Bench
    

    I remember seeing a certain person show a different thing every
    day for 2 weeks to get into NR05.  It started innocently enough
    with a driver's license, then moved onto a dollar bill, a notebook,
    a necktie, and some other knick-knacks, until finally, this person
    gained admittance simply by waving an empty hand.
    
    I should mention that this was at the back entrance, where one must
    show the badge through a locked inner door to a TV camera.  Security
    then buzzes the door open.
    
    -Monty-

While security at DEC is compatible with our overall openess (it's
the culture, let's not suggest they are incompetent) it is probably
better than these anecdotes suggest.

The guard doesn't have to verify a request for a temporary badge
on the spot ... s/he knows the odds are probably 1000 or even 10,000
to one that you are an employee ... if the check they run _after_
you walk away (and they do in ZK) turned up a fraud they will locate
you in the building, or when you try to exit.

I believe security very conciously tries to be as low-key and non-
intrusive as possible in keeping with the corporate clime.  I, for
one, am grateful for this, and think they keep a little sharper
eye on things than the stories suggest.

Checking badges at the door is merely the most visible thing they
do, but hardly the most important.

Twice I have alerted security to a physical hazard, in both cases
they responded in _seconds_ to correct the problem.  They take our
safety seriously.  I like 'em.

- greg

re .9:

>The guard doesn't have to verify a request for a temporary badge
>on the spot ... s/he knows the odds are probably 1000 or even 10,000
>to one that you are an employee ... if the check they run _after_
>you walk away (and they do in ZK) turned up a fraud they will locate
>you in the building, or when you try to exit.

    Hmmm, my experience (in ZK1) has been that they *do* check before
    giving me a temporary badge.  Guess I must look suspicious.

    DIGITAL Security does a good job in my estimation. And they do it
    pleasantly as well. We should be grateful.
    
    There are some companies where the paranoia begins at the guards'
    desk! Rumor says that DG has color coded badges and halls - you'd
    better not get caught in a hallway if your badge does not have that
    color!! In some companies you even have to pass thru a metal detector
    - both ways!
    
    Before the picture badges, I found that my John Hancock card (blue)
    was sufficient for admission, but not these days. :-)
    
    	Rick
    	Merrill
                                                         

RE: < Note 725.9 by STAR::ROBERT >

>The guard doesn't have to verify a request for a temporary badge
>on the spot ... s/he knows the odds are probably 1000 or even 10,000
>to one that you are an employee ... if the check they run _after_
>you walk away (and they do in ZK) turned up a fraud they will locate
>you in the building, or when you try to exit.

You don't have the right perspective. Whether 9999 out of 10000 are genuine 
cases is not important. Our practice ensures that an unauthorized person who 
wants to get in will get in with close to 100% success. I will bet that 99.999% 
of login attempts are by authorized users of accounts, yet we use passwords, 
don't we! There is no way that a person can be traced once he/she enters the 
mill.

Dileep

    Are there any known cases of any damage of any sort occurring from
    unauthorized people getting into the building?  There may be, but I've
    never heard of such a case. I've heard of plenty of problems from
    authorized people, be they regular employees, contract cleaners, or the
    guards themselves. (This is NOT a swipe at the guards! Every group has
    its small percent of bad apples.) 
    
    I think the risk is far higher from properly authorized "inside"
    people. It makes more sense to spend money, time, and effort on the
    high risks and ignore the really low risks.
    
    (I often wonder how a person unfamiliar with a Digital facility could
    enter and find anything worthwhile. And how would he know if it was
    worthwhile?) 

    And if a person unfamiliar with Digital enters the Mill, there is no
    way he is going to get out by himself :-) 
    
    - Vikas

RE: < Note 725.15 by SERPNT::SONTAKKE "Vikas Sontakke" >
                                  -< Dungeon >-

>    And if a person unfamiliar with Digital enters the Mill, there is no
>    way he is going to get out by himself :-) 
    
Uauthorized does not imply unfamiliar :-) :-)

Dileep

>Uauthorized does not imply unfamiliar :-) :-)
    
    Of course, since you have to work in the Mill for about 18 months
    in two or three building before really *knowing* the Mill, it's pretty
    good odds that a breakin in the Mill is going to be toned down more
    than at a site such as ZK.  Problem is *finding* the intruder...
    
    I had a small episode in ZK2 a few months ago where there was a guy who
    was trying a card of some sort through the security door (it was late).
    I came up and said "Can't get your card to work?", glancing at his
    card.  Looked like a DEC NCS card to me.  So I carded us in and waited
    while he wrote his vital statistics in the log.  I glanced at them as
    well, noticing that his badge number was over 300,000.  OK, that all
    fits, so I let him go.
    
    Silly me.  DEC security comes running down the hall and this guy gives
    me a hard time, acting as if I didn't have brain one.  Perhaps you
    agree after reading the brief account.  But the point was that I
    satisfied myself that he was a DEC employee - without seeing his badge.
    He had a DEC NCS card, wrote in a high badge number, a valid cost
    center (which wasn't the cost center of anyone on the same page that he
    wrote on), looked bewildered while trying to get in, etc.
    
    Security wrote something up on me (I guess I got a ticket) and then
    went to find the guy who came in.  They found him in his office.
    
    Now I know that I should have asked to see a badge (next time it
    happened, I did), but I was annoyed in the way that the security guy
    handled things.  He was pretty nasty and attempted to be pretty
    arrogant about the whole thing.  "You stupid employee"  He didn't use
    those words, but that was his temperment.  Point was, I wasn't blithely
    letting people into the building...
    
    During this small scene with the security guy, he produced an Apollo
    badge with an NCS card.  He was trying to point out that DEC's not the
    only one with NCS security entrances.  The cards aren't really the
    same, but that's not my point.  It looks like they were really psyched
    to catch somebody after, perhaps, someone tried to get in with an
    Apollo ID.  Which they may or may not have caught.
    
    So security has its ups and downs.  I always found the security team at
    the Mill was courteous and efficient.  I'm less than thrilled with ZKO.
    Some sites out west are pretty silly.  I was taking a mag tape into
    the Albuquerque site and tried to show a property pass for it.  The
    security guy wasn't having any of it.  Waved me on.  Same thing going
    out.
    
John

Re: .17

I'm confused. Where was the security person when this guy was signing in?

Lee

>I'm confused. Where was the security person when this guy was signing in?
    
    At ZK, they only staff the ZK1 lobby after 6pm or so (far as I know). 
    The ZK2 lobby has a key card entrance (thus all the hoopla about key
    cards).  It was about 7 or 8pm when all this happened.
    
John

        RE: .14 -- There may be a problem with cases of damage occurring
        where it's hard to pin it down.  The obvious sort of damage is the
        destruction of physical equipment, theft, and so forth, but there
        is also a significant risk of damage due to the theft of
        proprietary information.  Unfortunately, the theft doesn't even
        require that anything (documents, etc.) be physically taken from
        Digital property -- just that someone have the chance to see the
        wrong stuff. 
        
        Tom

         
         	
         
         Is DEC Security strictly a negative from the point of the
         individual employee, or can they ever be helpful ?
         
         One day this week I found a *BIG* dent in the fender of my
         car in the DEC parking lot. Whoever did it didn't leave 
         a note - but did leave some blue paint. 
         
         I reported this to Security, and they made out an 
         "incident report", and told me to report it to the local
         police department and the DMV.  I then asked, "If I should
         find a blue car in the parking lot (belonging to a DEC
         employee) with a matching dent", what would you do ?
         The answer; "Nothing - If no DEC-owned vehicles are involved,
         then it's between you and the other guy's insurance company."
         
         Now I would think if the guy that hit my car and ran were ever
         found, that DEC Security would get involved - after all, the
         guy did something illegal (leaving the scene of an accident)
         and did it on DEC property.  Does anyone have any experience as 
         to how DEC Security at other plants reacts to this kind of 
         situation ?

         In general, can anyone say what is the policy and the practice 
         of DEC Security regarding protection of employees and their 
         property:
             A. In the DEC facilities ?
             B. On the grounds of the facilities (eg. parking lots) ?
             C. Elsewhere (eg. the public highways) ? 
	
         
         
         
         
         

    I register my car with security so they can find me when I inevitably
    leave the lights on. I do it about twice a year, and they always find
    me. 

    Re: .22
    
    Unfortunately for you, I agree with what Security told you.  It may
    indeed be against the law for the person who dented your car to
    "hit and run", depending on the amount of the damage, but that isn't
    the responsibility of Security, any more than it's a supermarket's
    fault if someone hits you in their parking lot.
    
    I have found Security to be helpful under many circumstances, and
    have never had an occasion to be upset with them.
    
    			Steve

    Re .22:
    
    If you found a matching car, what would you want Security to do?
    
    
    				-- edp

Security is helpful when appropriate, such as when you left your lights on
and they were able to tell you, or when you left your lights on and they
weren't able to tell you, but were able to show up with jumper cables to
get you going.

I suspect that security would be glad to tell you the name of the owner of
the car with the matching dent.  But in matters involving personal property,
security rarely gets involved.  Security should be there to protect the assets
of the company, not to act as an extension of the local police force.

I don't believe that it is illegal (immoral maybe, but not illegal) to leave
the scene of an accident occurring on private property in which no one was
injured.

In many places, the local police won't even get involved in accidents that
happen in places such as shopping center parking lots.

/john

    Re .22
    
    DEC security thank God are not a police force therefore I'm glad
    they'd do nothing if you found the car that hit your car. As they
    said that is a matter between you, that person and maybe the judicial
    system. It is nought to do with DEC or DEC security.
    
    Dave

    A coworker here at LKG recently got mail from Security, asking for
    a meeting to discuss "an incident" that had occurred the previous
    week.  It sounded grim and serious.  Turns out the "incident" was
    a parking-lot accident, which my friend had nothing to do with. So
    to answer the previous query, at LKG Security seems to get more
    involved.
    
    On another point, though, I'm disturbed by the implications of [.26]
    (John R. Covert):
    
    >> Security should be there to protect the assets
    >> of the company, not to act as an extension of the local police force.

    I don't believe this is true, and I don't think it OUGHT to be
    true even if it is.  What are the security cameras for?  To get advance
    warning if the forces of the competition decide to storm the facility?
    To look for local youths skateboarding in the parking lot?
    
    To a small extent, we employees are "assets of the company," at least
    while we're on the premises, and as such we should be protected.  By
    extension, that protection should include our property.  I support this
    claim by looking at the opposite case. If I were mugged in the parking
    lot, I would not accept a hypothetical Security response such as,
    "Yeah, we saw you get hit on the monitor, but it's none of our business
    what happens to you once you leave the facility."  If I were a woman
    raped in the parking lot, I wouldn't accept such a response, either.
    (In fact, I suspect if such a terrible event ever happened, and any
    security person were foolish enough to take that position, the victim
    would end up owning the facility.) If personal property were stolen
    from my desk, I wouldn't accept a Security response such as, "You're
    not supposed to have personal property in the building.  What happened
    was your own fault, and none of our concern."
    
    I think you'll agree that these (wild) scenarios are absurd, and
    that security should properly take some role in protecting employees
    and their possessions on company property.  Here's a more plausible
    scenario, based on our local parking situation.  Let's say I'm a
    sociopath with an old car.  I come to work late often, and I'm incensed
    by the sloppy parking of certain people who take up two spots, thus
    forcing me to park on the other side of the complex and walk half
    a mile.  I'm fed up with their thoughtless driving, and I start
    forcing my car into "legal" parking spaces.  In the process, I scrape
    the sides of a number of cars, though I disregard the damage to
    my own car.  Someone in security matches the damage to a new Saab
    and the damage on my car.  What should they do?
    
    Some might argue that this matter is none of Security's business.
    I think a more active response is called for.
    
    Let me give one more scenario, this one entirely true.  Some people
    have "double-double-parked" in the lot, off the end of the marked
    rows, creating this situation for people parked (legally) around
    the edges:
    
                        v---"double-double-parked"   	
    		||||||||| - <-- this car can't back out!
    		|||||||   -
    			  -

    There isn't room to back out; you're trapped.  If this happened
    to me, I would go to Security armed with the license plate of the
    naughty parker and ask that the car be towed.  I expect Security
    would at least call the person up and request that the car be moved...
    (If I were more sociopathic, I might be inclined to force my way
    out, even if it damages the car of the naughty parker.)
    
    (Grrrr!  I don't get TOO worked up over this issue, do I?  8^)

        Here's another way to look at it:  a fellow employee who damaged
        your vehicle on DEC property and drove away without attempting to
        contact you (by notify security, who should know how to reach you,
        because you've registered your vehicle with them, right?) is
        in violation of Digital's Personnel Policy on Employee Conduct,
        section 6.24, which says (in part):

 Digital strives to create and maintain a positive work environment.
 To achieve this, the Company encourages courteous and respectful
 behavior, a responsible attitude toward work and respect for
 employee and Company property.

 The Company feels strongly about this and has developed this
 Employee Conduct Statement to help clarify differences in judgment.
 This statement outlines general principles on which employees are
 expected to base their behavior and cites examples of unacceptable
 conduct; the examples are not meant to be all-inclusive.

 IN GENERAL, EMPLOYEES CAN ANTICIPATE THAT ACTIONS HARMFUL TO
 ANOTHER EMPLOYEE OR TO THE COMPANY ARE CAUSE FOR DISCIPLINARY
 PROCEDURES OR POSSIBLE DISMISSAL.  SPECIFICALLY, EMPLOYEES ARE
 EXPECTED TO BE AT THEIR WORK SITES AND ATTEND TO THEIR RESPONSIBILITIES.

 EMPLOYEES ARE EXPECTED TO RESPECT THE INDIVIDUAL RIGHTS AND PRIVACY
 OF OTHERS.

        [details removed]
        
 EMPLOYEES ARE EXPECTED TO RESPECT THE PROPERTY OF OTHERS.

 For example, they will not:

      o Destroy, deface or damage property belonging to Digital, its
        customers, vendors or employees.

        [other examples removed]
        
        Sounds to me like you've got a legitimate beef about the conduct
        of an unknown person, who just might be an employee, and might
        be subject to being fired for his or her irresponsible actions.

        Later, it says:
        
 Interpretations for some of these general principles may be subject
 to legal and cultural mores in countries where Digital has
 facilities.  If you have questions, please talk with your supervisor.

        Sounds like there is some question of Security's responsibility
        in a matter such as that described, where a person's property
        was damaged by someone who is likely to be a fellow employee,
        who was in what I perceive as pretty clear violation of this
        policy.
        
        Have you discussed it with your supervisor?  Perhaps you and
        your supervisor should discuss it with the facility's security
        manager.
        
        Tom

    Tom, perhaps my description was too vivid.  I spoke hypothetically.
    Your concern is appreciated but misplaced.  Sorry about that!
    
    In such a hypothetical case (to recap, an employee who had jammed his
    car into parking spots, scraping a number of cars in the process), I
    maintain that Security is in a much better position to substantiate
    details and follow up leads than individual employees.  After all,
    Security has a database of car registrations.  If they keep records of
    incidents, they could quickly determine that Mr. Hyde had been involved
    in several such collisions. 
    
    There are other reasons than socipathy for such behavior, reasons
    that would justify a proactive role by Security.  Perhaps my fanciful
    Mr. Hyde is having a nervous breakdown; perhaps he is having seizures
    of microstrokes; and he doesn't realize that he's careening through
    the parking lot.  (My grandfather had a microstroke in a supermarket
    parking lot, and collided with three cars while attempting to park.)
    
    By the way, my wife, who works in a hospital, reports that security
    there is tasked with watching employees who leave the employee entrance
    until they're safely in their cars.  Third-shift workers are offered
    a ride to their cars.  I appreciate their attention, and offer that
    as a model for our own Security folks.

Here's another aspect to the registry of employee license plates which is
maintained by Security at many sites.  I wish the information was treated as
if it was classified as Digital Personal:

"
 | DIGITAL PERSONAL:  This level of proprietary information involves
 | personal data about individuals that will be distributed in a
 | manner based upon local law and absolute need-to-know.  Personal
 | data about an individual refers to information that is (1)
 | protected by law; or (2) is of a descriptive, personal nature; or
 | (3) a reasonable individual might not want disclosed; and/or (4) an
 | originator determines that it should be limited in its disclosure.

 |     EXAMPLE:  Salary data, performance evaluations, medical
 |               information, job applications, personal or family
 |               details, curriculum vitae, resumes, etc.
"

Ideally, nothing short of a formal complaint or evidence of legal actions would
allow it to be disclosed, even in a jurisdiction where the data is part of the
public record.  It doesn't seem very secure for receptionists to reveal the
owner's name of vehicles.  I'd like it even less if they did that upon hearing
an informal complaint.

Comments?
				/AHM

        Whenever I've had occasion to want Security to contact the owner
        of a vehicle (e.g., because the lights were on), I've given the
        license number to the receptionist or security person on duty, and
        they've contacted the owner if he or she is listed. They've never
        given me the owner's name.  I don't know if they would. 
        
        This is a moot point in many states, where you can find out the
        name, home address, and assorted other information for any person
        who has a registered vehicle by simply contacting the registry of
        motor vehicles.  Some states consider this information a matter of
        public record, not a personal secret.  (Whether this is right or
        wrong is probably not a suitable topic for discussion in this
        conference.  I mention it only because it seems foolish to me to
        expect Digital to protect information that can be readily obtained
        through other channels.) 
        
        Tom

Re .32:

>        Whenever I've had occasion to want Security to contact the owner
>        of a vehicle ... They've never
>        given me the owner's name.

In my experience, if you hang around to see if the vehicle is registered,
there's an excellent chance you'll hear the receptionist at least mumble the
name of the person.

>        This is a moot point in many states, ...

Yes, I said that.

>(Whether this is right or
>        wrong is probably not a suitable topic for discussion in this
>        conference.  I mention it only because it seems foolish to me to
>        expect Digital to protect information that can be readily obtained
>        through other channels.) 

Do you have an opinion on the fact that the policy I posted clearly reserves
to individuals the right to designate information they provide as personal?
				/AHM/THX

RE: .22

	A similar incident happened to a co-worker here in SHR a few
weeks ago.  Their car was dented by another car.  When they complained
to Security, the response was "Well, you should have written down the
plate numbers of all the cars that parked around you..this morning....."

    re .22

        
    
    Even the police don't help. My wife was rear ended in downtown
    Leominster. She got out to exchange papers, looked at his car
    saw no damage, my wife's had some minor damage. He said I haven't
    got time for this $h!t and left.
    We contacted the police and gave them the plate number...........
    
    Their remarks were.......What do you want us to do about it?
    
    Lou