- 1 Art of managing the order of a space or any physical and virtual domain, without prejudice to the n (...)
1Whatever its legal and material characteristics, any company taking risks in commercial competition has vulnerabilities in relation to its competitors, employees and customers. The need to ensure the organization’s survival in the face of damages from natural disasters, economic, political or social risks and ensure the safety nets required by insurers and external regulations (employment and fire safety) creates very different perceptions and concerns in its leadership. Size, geographical location and business sector are three of the most significant macro-sociological variables necessary to comprehend the nature of the mechanisms used to protect against the vulnerabilities, risks and threats that affect businesses. In order to understand the internal protections found in large corporations in the era of global security—a new necessity for the science of policing1 as well as policing agencies—boldness as well as modesty will be required.
2Why bring up the concept of “assemblage”, coined by Haggerty and Ericson (2000) and popularized by Brodeur (Brodeur, 2010, 17-41)? This metaphor seems one most likely to explain the growing interpenetration of all the actions and entities involved in creating state and commercial security, where we have to treat formal and informal groups of private agents as public ones. We evaluate the organization of internal security services in large corporations today because it seems more effective than three other academic ideas: the idea of division - the interaction of social control between private and public police forces (Shapland, Van Outrive, 1999); the idea of the pluralization of policing (Jones, Newburn, 2006); the idea of nodal control of security (Shearing, Wood, 2003; Shearing, 2005). The first two are limited to recording multifaceted overlaps and are not integrated into the various order management methods within complex societies; the third, which postulates a tendency towards the horizontal equality of agents of social control within a network, has difficulty accounting for the asymmetrical effects of positions, including those within security nodes. We want to better document the empirical interconnections between risks and threats averted by companies, with or without State assistance, by focusing on their concretely implemented internal security mechanisms. More precisely, the aim is to test the gaps between official justifications of merit behind the protection of corporations and the personal competence of the players deemed to be in control of daily operations. We will discuss the cognitive implications of the idea of “global security” articulated in the “threats” that affect the large corporations in our sample group, while relying on indispensible non-commercial (“grey”) literature, in the absence of a very substantial scientific one. We will then use a qualitative study to survey the position and its holder within 25 French corporations and French subsidiaries of multinational corporations. We will then present the main findings of the study, basing them on three paths of analysis. We will conclude the study with a more generalized hypothesis regarding the militarization of security mechanisms within corporations.
- 2 On several rare, old entries, Ocqueteau, Pottier (1995); Ocqueteau (2002). More recently, Bonnet (2 (...)
3Due to a lack of academic or scientific study devoted to the actual organization of policing assemblages, the art of protecting corporate victims against internal or external2 risks and threats remains a subject of little empirical study, at least in France. The interconnections between security applied to or within companies and external partners remain relatively unknown, with a few exceptions. There is still quite little consistent investment in corporate security. This is because except for the areas of occupational and fire safety, which have been consolidated by the accumulated strength of the welfare state (Ewald, 1986), the creation of security has remained a prerogative to be exercised largely on an autonomous basis. The causes and consequences of this relative freedom have given rise to authentic protective practices, though still quite lacking in standardization. And since the perception of risk and harm assessment remains an area of sovereign discretion that is mostly subjective (producing different estimates of the relative severities of loss resulting from malicious or menacing acts), the costs of investments aimed at limiting the risks related to hostile action or their negative consequences fluctuate considerably from one corporation to another. For the most part, they vary according to the financial resources that directors of various companies are willing to invest.
4Since the 2000s, an inspirational manager-oriented literature focusing on threat management has nevertheless begun to provide benchmarks useful for a better understanding of security in the era of globalization (Pierre, 2009a). If the objective of this knowledge is not “critical” as such, its contribution to the understanding of the reality of concrete protective procedures is nonetheless an indispensible prerequisite in any new investigation. The cumulative knowledge transmitted by this literature is conveyed through two broad determinist models: it is the diversity of threats that mechanically explains the development of the security mechanism in the capitalist enterprise, with the State remaining in the background; or else it is the State, which in certain circumstances still dictates how corporations must develop their security systems in areas where they are negotiating attack strategies against common threats.
- 3 On the recent promotion of this concept, see Y. Roucaute, editor of Cahiers de la Sécurité (Roucaut (...)
- 4 ... And as such, a priori unwilling to be constrained by protections viewed as restrictions on thei (...)
- 5 See Olivier Hassid, who defines four categories of agencies that deliver protective services: a sec (...)
5A specialized expertise has accompanied the cultural revolution sparked by the rise of corporate global security resulting from the increase in threats and attacks aimed at corporations.3 The objective of this expertise is, ultimately, to transform certain adventurous entrepreneurial and risk-taking4 mentalities into ones that are more inventive in the implementation of precaution in the era of risk among people beyond the traditional “heir of private means” or “administrative officer”. In order to promote human and technological mechanisms of prevention among entrepreneurs known to lag behind threatening realities, this literature of expertise focuses on the description of threats, their magnitude and recurrence, their novelty and variability. We no longer count the attempts to typologize global threats refracted within the internal order of corporations. The most elaborate of recent attempts is based on the strategic paradigm of detection, study and training regarding resilience to risk and threat. For example, Yves Roucaute (Roucaute, 2010) suggests a hierarchy of threats (“processes induced by the human will”), expressing them in the following rhetoric of war: 1 – the scope of high intensity conflicts and attacks by malevolent, fragile or failed states trying to attack computer networks in order to destroy infrastructure; 2 – then, threats from asymmetric warfare, such as those embodied in radical Islam, terrorism or organized crime; 3 – threats connected to soft power seeking to undermine the authority, legality and legitimacy of a state, a government and the culture of a nation; 4 – finally, threats related to cyber attacks aimed at individuals, executives, businesses or a whole country. Implicit in this expertise is an assumption that is generally behaviourist: the malevolent threat explains protective behaviour that occurs, without consideration, except in the form of lip service, of a collective responsibility. It resonates with an emerging economy of private security, even of the privatization of security. In this scheme of thought, the range and number of threats and challenges is based on the size of the companies, the largest being considered as the most innovative in protective measures, whether they rely on internal mechanisms or external service providers through which they, as mature participants, shape the market.5
- 6 In this regard, for a first serious investigation, where the protocol can at least be judged, see D (...)
6We can see other evidence of this rhetoric of danger in a recent work (Hassid, Masraff, 2010) dedicated solely to protection issues within large groups and businesses. The work describes possible prevention strategies relative to a range of identified threats (“crimes”) in the corporation, which are in turn arranged in the following typology: threats against intangible assets and information; threats against persons; and threats against property. This work deals more specifically with threats against the corporate brand or reputation6 (through informational attacks) and threats against other intangible assets (connected to industrial espionage, counterfeiting, cyber crime). It also focuses on threats against corporate collaborators (wage earning employees and expatriate executives), and finally, threats against facilities, material assets and merchandise, linked to politically unstable environments where the subsidiaries are de-localized, in line with the globalization of the world economy (protests, terrorism, piracy).
- 7 Out of 82 useable responses, one-quarter came from companies with more than 10,000 employees, one-t (...)
- 8 Recall that the DI is formed by the difference between the actual stock at the end of the year and (...)
7More targeted investigations have attempted to quantify more precisely, within large international corporations from developed countries (surveyed online), the concern of their directors regarding their possible victimization. One of them (Very et al., 2010; Monnet, Very, 2010) has listed 28 types of crimes or abuses that enterprises could have been subjected to in 2008 and 20097. Not surprisingly, it follows that the most publicized crimes are the rarest, and that the most frequently condemned crimes are the internal ones, in other words, internal thefts of products and equipment (84% of respondents describe it as a priority) and internal fraud (it is the case for 67% of them); the fight against “theft” is also mentioned twice as often as the fight against “illegal penetration of information systems” (Very et al., 2010, fig. 1, p. 9). This is corroborated by the fact that the same respondents cite, among the criminal actors with whom they have had problems, their own personnel (in 87% of reported incidents) three times more often than terrorists or guerrillas (Very et al., 2010, fig. 2, p. 10). Apparently, the threats of greatest concern, including within multinational corporations, are not really the newest. Apparently, the most “visibly recurring” are always the threats that are most easily perceptible to enterprise directors because they are the ones most easily fought using the methods and resources available to them, which prevents them from perceiving their contributions to the eventual degradation of an internal social climate, something that could explain these excesses (Minot, 2009; Asseman, Dupont, 2011). Similar results support the premise of a longstanding trend, both in the United Kingdom and in France, relating to mechanisms of investment in the measures taken by local businesses to reduce inventory shortages.8
8The primary concern of most businesses is to avert the risk of recurring property loss (loss prevention), whether due to the malice or negligence of employees and collaborators, rather than being concerned with the rarity of spectacular media events in an environment the business deems to be out of its control. This is the first indication that if the threats are globally perceived according to identical hierarchies of concern, whether in large corporations or medium or small businesses, then perhaps size might not be an essential issue. As a result, the “security function” would only be considered in terms of the most recurrent risk generating the most manageable losses. It would be far less so if the risk were rare and would be deemed nearly unmanageable by the party concerned. But if that is the still the dominant configuration, it is because such is the reasoning behind the practices of average commercial and industrial enterprises and is not part of areas deemed to be « vital » (see infra).
- 9 An undeniable effect of the context of the crisis due to the great fear of 2009, the H1N1 flu pande (...)
9Another French study (Thalès et al., 2008), having surveyed 100 very large enterprises (with more than half having at least 10,000 employees and annual sales of more than 7.7 billion €), added some important nuances to this subject. Taking into account the variable “sector of activity” of the business in question, seems to define a clear demarcation among them, in terms of their priority concerns. It might seem that industries are much more concerned with protecting themselves from espionage (85%) and health risks (62%)9; infrastructure operators with preventing accidents (90%) and extreme risks that increase the vulnerabilities of their networks (70%) ; governments might seem especially concerned with social problems (80%) ; finally, in service companies and local businesses, the major concern might be with the violation of laws and regulations concerning businesses that interact with the public (ERP) (95%), given the nature of the risk exposure at the interface between production and the client.
10There is no doubt that the answers to these kinds of “sensitization” studies that try to measure the real concerns regarding threats that must be fought, are still geared to the interests of the people assigned to the prevention of hazards (also responding most often to surveys soliciting business practices). If these are valuable insights, it is nevertheless not possible to be content with such crude stimulus/response explanations to explain the emergence of positions dedicated to “security”.
- 10 The White Paper of 2008 defines it as the willingness and ability of a country, of a society and go (...)
11Some partial indicators suggest that the spectrum of mission objectives assigned to directors of security will broaden in the future, to the extent that market resilience10 (Briggs, Edwards, 2006) takes precedence over security practices aimed at threats that are managed in a still too fragmented manner within enterprises. Is this a fatal evolution?
12A study of the Delegation Regarding Forecasting and Strategy (Paulin, 2009) has shown that the security function had tended to become more and more “transversal” within the enterprise, while evolving in two opposing directions: first, in a role of support and guidance for the benefit of operational units, and second, in a role of increased responsibility in relation to the head office and management bodies. Although this study is silent about its sample, it concludes that the great majority of directors of security for large groups (could have) their immediate superior in the executive committee, or produce (or might produce) reports at regular intervals to their superior, or even to the Executive Committee. One hypothesis lending credence to the idea that there is a closer relationship than before between directors of the enterprise and the directors of security might be based on their need to be reassured about the issue of their penal responsibility. It is not only the legal and penal risks of failure or criminal negligence in some situations that might frighten them, but above all, risks that are more diffuse yet persistent threats to the image and reputation of their enterprise, provoking them to seek durable solutions while creating positions that are more visible.
13But the security function is obviously not exhausted by holding a strategic advisory role to the company management in order to help make decisions that might become necessary in increasingly uncertain environments. The structure of enterprises largely explains the nature of positions dedicated to security. In this regard, the previously mentioned typology of Hassid and Masraff shows how organizations according to functions define security as an integral part of “support functions” (in the manner of finance and accounting), clearly distinguishing it from operational functions. The structures by divisions, with businesses dedicated to different products, brands or customers, can shatter the security functions within each business unit or profit centre developing their own security. Structures by business, finally, configure the function within the management base (to focus on strategy, development and coherence), along with other, partly pooled functions, such as general administrative tasks for the benefit of all or some of the other management authorities.
- 11 ISMA, International Security Management Association. Study cited in the monthly newsletter Directeu (...)
14Although these nuances exist, the general tendency is towards the centralization and relative sustainability of the security function in the national or multi-national enterprise. If this centralizing tendency seems dominant, in France it is apparent that the State exercises a still tighter control over the economy. Conducted in July 2009, an international ISMA survey of 113 security branches in large enterprises having more than 10,000 employees11 confirmed this trend towards centralization in 66% of the enterprises. And this concentration of resources might satisfy 80% of heads of group resilience or chief of resilience officers that are asked. Most claim to have been assigned to lead a team created to conduct four main types of missions: protection of sites and employees, implementation of plans for continuity in case of crises, internal investigations, and the security of their expatriates or travellers. On the other hand, they are pleased to have been relieved of the management of security and surveillance activities, which have been heavily outsourced.
- 12 The article compares the studies of two offices, American Foushee Group (for the USA and Asia) and (...)
- 13 American Society for Industrial Security created in 1955 became ASIS International in 2002.
- 14 Pierre concludes: metrics or internal legitimation to validate the levels of compensation have evol (...)
15Another indirect indicator of the influence of security directors within large enterprises having international connections was outlined in studies of the rise in their salaries during the last decade (Pierre, 2009b)12. These would have increased by 73% between 2002 and 2008, demonstrating a priori, the value of their presence. But the financial crisis of 2008-2009 began to cause a reversal of this trend, something as evident to ASIS International13 as to the ISMA, which for analysts, tended to prove that their value had possibly been greatly overestimated during the period of their rise. Since apparently their most recently created jobs would have been the first to be attacked during the onset of the crisis14, we might possibly conclude that the function had not yet shown its complete legitimacy, its fully indispensible nature.
- 15 The larger the business grows ( 10,000 employees), the more a "comprehensive approach" was implemen (...)
16In another survey cited above (Thalès et al., 2008, p. 10), which focused on perceptions regarding a global approach15 to security, the solicited companies definitely believed that this approach has become a necessity (83% of the panel, n=83), but nevertheless would have been converted to this point of view only very recently (less than four years for about one quarter of the enterprises questioned, n=24). The main motivation might derive from an explicit desire of the DG (directorate general) concerned to ensure long term development (n=17). For the others (n=7), the motivations existing when the position was created would diverge according to the sectors of activity involved. According to the infrastructure operators, for example, it was the rise in terrorism and criminal violence that caused an increase in the public’s demand for security, and, as a result, new obligations to meet their concerns. According to the investigations of classic industrial and commercial enterprises, attacks on the reputation of the brand as well as major financial and industrial accidents might have been the dominant explanations. In the case of public enterprises that had been privatized, the explanation would mostly have been about the need to adapt to new management obligations and practices that had formerly been the responsibility of the State.
17The French global security approach was the result of the concerns of large enterprises with the emergence of a new standard after 2000 in the areas of state action. Let us recall that the enactment of the June 2008 White Paper on National Defence and Security (White Paper, 2008) led to the creation of a General Secretariat of Defence and of National Security (SGDSN), the result of the fusion of the Council of Interior Security and the Council of Defence. The Secretariat of this organization recently considered a system initiated in 2006 which requires that enterprises deemed to belong within the perimeter of the Sector of Activities of Vital Importance16 (SAIV) must take measures aimed at resisting threats and attacks likely to affect the national economy, the security of the State and the livelihoods of the people17. This sector had previously been defined as consisting of “critical infrastructures” vulnerable to nuclear, radiological, bacteriological, chemical – electronic (NRBC-E) threats, and involving thousands of sites spread across the country. In the operation to streamline the new system, twelve areas of vital importance were defined by a prime ministerial decree on June 2, 2006, amended on July 3, 2008, and grouped into four sub-sectors : “predominantly sovereign”, “predominantly human” (food, water management, health), “predominantly economic” (energy, finance, transportation), and “predominantly technological” (communication, electronic, audiovisual, industrial, space and research). Within three years, 21 national security directives were approved, 228 operators of vital importance (OIV) were designated by the various supervisory ministries, 110 of them having finalized their Plans for Security Operators (PSO). In other words, out of a possible 1,500, approximately 900 PIVs designated as sensitive targets were secured. The review concluded (as of the summer of 2010) that the threats averted by the 110 operators brought into compliance, and appeared to demonstrate in the concretely developed mechanisms, the following hierarchy: firstly, mechanisms against malicious threats, thefts, intrusions, sabotage, hostage-taking or attacks with improvised explosive devices; secondly, mechanisms to combat threats to information systems; finally, mechanisms to combat NRBC attacks or those made with armed commandos (Coursaget, 2010, p. 13). Once again, reality has confirmed earlier perceptions: despite government orders, businesses within the SAIV perimeter adopted mechanisms for the prevention of malicious threats already standardized in the area of their daily concerns. Their willingness in relation to those threats was not duplicated relative to diffuse risks (computer security) or those considered rare (terrorist attacks).
18There is no doubt that the structure and the area covered by the companies within which our sources operate will also completely define the nature of the profiles of the directors of security that this study seeks to explore. The question is whether, within the companies surveyed, the directors of security have the professionalism and competence to manage everything or do they confine themselves to a role of control and supervision? And if this is not the case, what are the factors that explain the emphasis on and investment in the prevention of one threat over another, to the point where the size and power of the enterprise become secondary?
19We would argue that the precursor “course” of the person designated as director of security and the manner of his self-expression within the position, constitute the indispensible supplementary dimension of any preliminary analysis of the impact of a security mechanism, whether or not the enterprise is included in the vital perimeter as defined by the State.
- 18 This is even more true for very large than for medium companies, as evidenced by a recent qualitati (...)
20Wanting to better understand a position and its holder is justified by several considerations. We accept, hypothetically, that the directors of security in French enterprises still act under an uncertain status, and are preoccupied with improving their positions and anxious to have their professional legitimacy recognized18. However, if their professional identity fails to be stabilized, we believe that it is largely the result of a mismatch between the major changes that affect businesses generally and internal security and safety designs stemming from policies that are poorly finished, unclear, or even of secondary quality. This is more likely related to the persistence of a barrier to the protection of people, goods and heritage (against malicious acts or threats of a malicious nature) at the perimeter of the management of accidental risks (fire, health and labour). However, this barrier, which is both something institutionalized and institutionalizing within the enterprise, makes it difficult for a credible actor to emerge and manage the global security of an enterprise, even if such historical barriers might increasingly be perceived as counter-productive.
21Since the publication of the White Paper of 2008, the ministries of the Interior and of Defence have agreed that the security of enterprises at the regional, national and international levels has become a fundamental strategic objective, but it is not certain that these ministries always know how to follow these developments in a way that benefits everyone. Not only do they not always have the right people with a community of experience in risk management within entities with very different exposure, but even more importantly, it is not necessarily up to them to define the scope of skills of people mobilized by those who will be paying them. Nevertheless, we will see how public authorities try to influence such processes by trying in particular to control the transfer of skills of their retiring employees, candidates for retraining.
22It must be said that clubs and associations work much more actively towards the recognition and enhancement of the position of security director, such as the CDSE or the Security Agora, to mention the best known among them. They try to ensure that positions are conceived and implemented in terms of genuine skills, real knowledge and ethical considerations (Pellerin, 2010). They try to promote a better coordination of positions with the purposes of a global security believed to be capable of overcoming, or even transcending the traditional obstacles to public and private cooperation within the framework of this mixed economy that still largely defines the French model. In practice, the program to overcome these cultural and organizational obstacles means two things. On the one hand, it involves transcending inhibitions related to the barriers among cultures of security, where the enhancement of expertise acquired within the State would not have to risk being diluted in the private sector, but would, on the contrary, propagate and perpetuate itself there. On the other hand, it involves transcending the hostile reflexes of enterprises regarding the clumsiness of the State’s positions that are often faulted for authoritarian reflexes or ones that are too lax, positions aimed at dictating the obligations of market results, especially within the non-vital sector, without always providing oneself with an example of good management within public institutions or companies.
- 19 It is not possible to reveal the exact number here, especially as this information is covered by th (...)
23The field survey was specifically aimed at understanding how the director came to justify the circumstances of the recruitment to his current position; what seemed to him to be the reasons for him being chosen; the ways by which he lived within the perimeter (with his eventual collaborators); what brought him the flow of formal and informal knowledge from his participation in social networks of counterparts; what the future had in store for him. The survey was conducted from April to September 2010, from a battery of non-directed interviews structured only by three central questions. The panel consisted of twenty-five directors of security from public or private enterprises that were as diverse as possible in terms of their structure and company name (see Annex). Most of the enterprises they belonged to have major developmental activities abroad; others have a rather large domestic market; others are industrial and commercial public institutions, administrative and commercial public institutions, or enterprises that interact with the public. Some have a financial structure based on a State shareholder, others with a minority State shareholder, the third type is purely private (and among them are either anonymous majority shareholders or family-held majority shareholders). In other words, we have found, as in all the quantified surveys supra, differentiated sectors of activity (industries, operators of infrastructures, administrations and public institutions, service companies and businesses); and, in a very large proportion, people labelled as security or safety directors (n=20), the remainder being risk managers (n=3), director of information systems (DS=1) or security responsible for information systems (RSSI=1) acting. The panel attempted to cover the widest range of sectors to which the sources belonged and to diversify their profiles as much as possible based on age and type of training. Among the areas listed, we count: industries (n=3), transport and logistics (n=5), energy and associated partner enterprises (n=5), retail (n=3), experimental and other fields (n=5), public service institutions (n=2), tourism services (n=2). About 20 out of 25 companies are also involved with an “SAIV mechanism”19 mentioned supra. Regarding profiles, ten of the directors questioned had spent more or less a long period in the military (5= in the central or operational information services, 5= officers or NCOs of the gendarmerie). Five of them had spent more or less long periods in a police or prefectural environment (3 retired, and 2 agents available or on long-term detachment). The remaining ten are from private enterprises or from internal promotion: self made men from the guardian or fire-fighting sectors, or much more qualified, technicians and engineers, in particular.
24It is necessary to make some substantive comments about the investment of the respondents in this research. By inviting them to comment about “what they do in their jobs”, we have updated the information on how position-holders evaluate their personal contributions at the head of a department that is formally dedicated to providing security for their enterprise. They spoke about the legitimacy of their work and, to some extent, their professional identity. It was necessary for them to define their area and evaluate their latitude within it. Self-assessment of their area of expertise leads them to classify themselves as de facto having a moderate amount of legitimacy, weak when the security department was composed of a single incumbent (PME, i.e. small or medium business]), a lot stronger when the department was composed of ten or so people (which was mostly the case for panel members). The more the security department (or cell) was enriched with people, the wider the range of missions controlled by its director would become and the wider would grow the social division of labor through specialization of risk (“country risk analysis” vs “crisis management”, for example), and the more the function was made problematic by the concept of global security strategy. There are those who claimed it included the prevention of traditional threats (protection of vulnerable people and property) – an oversight function for subcontractors, most often regarding the protection of tangible and intangible assets (security of sensitive information against deliberate attacks and advocacy against vulnerabilities caused by the lack of vigilance of the youngest collaborators, within and outside of the business), and, finally, the anticipation and management of new risks by the development tools experts (systemic and major crises, defence of the brand and corporate reputation).
- 20 The issue is more acute because in 2010, French authorities were responsible for supporting the pri (...)
25Truthfully, claiming the management of “global security” of the enterprise places the person in a position overlooking several activities more or less dissociated from safety (fire safety, hygiene, work) and security (management of threats and disasters). It appears that global security was more and more closely associated in the large enterprise with the awareness of damages connected with industrial espionage and with the need to defend the company’s heritage, (Vuillerme, 2010), its intangible and informational assets, especially20, all other components (situational prevention and management of access through identification), the most often outsourced are relatively quite standardized.
26It seemed to us that the defence of a modernist conception of the “dematerialized business” had been understood more quickly by the security heads of the leading enterprises (“the jewels of the industry”) of international stature than by the heads of medium and small companies, national or regional. It seems that the larger firms had a clearer view than the others of the future of global security. They live as enlightened missionaries, more pedagogically oriented spear-headers, to the extent that they consider their positions more attractive but more exposed to the rules of global competitiveness. The counterpart to this is a more acute ambivalence with regard to the role of the State as protector of the company, as it impedes or supports its development.
27For the purposes of this study, we will ignore the most significant results in several stages, based on a synthesis of relevant information collected from the 25 interviews, adding to them the most significant excerpts. These fragments will serve to demonstrate ideas or actions that are important or recurrent to the speaker in order to illustrate some key dimensions of his experience in the position. Because we are attempting to delineate a function of order (of control or surveillance), one that is new to the enterprise, in the absence of a constitutive professional identity, we will resort to an actionalist sociology. It aims to identify the self-reflexive subjectivity of an actor in his position and role, explained by several factors: the determinants of his earlier trajectory and the value systems he brought to the company he runs; the current investment practices, from his margins of autonomy within the concrete organizational constraints of his enterprise; the alignment of his work with the views of his idealized role, an attitude that inevitably encourages the speaker to create permanent comparisons between his status and those of his peers. If we were to qualify the mobilized discipline inductively, we might be talking about a sociology of work at the intersection of a sociology of organizations and of management.
28The self-evaluation of the role and function of the position by the incumbents diverges very significantly according to the patterns of their recruitment.
29Rightly or wrongly, the holders of the positions in this sector often live like atypical people in relation to the public police and military sectors that produced many of their counterparts. Two main sub-groups emerge from them, in a discordant arrangement, driven by a very minority profile.
30The first sub-group, older and from the private sector, includes technicians and engineers from their company who have reached the end of their careers (between 55 and 65 years old); risk managers from the field of insurance, or had occupied, different positions in technical or logistical services within companies:
My path is atypical, it’s that of a director of safety whose career was largely devoted to insurance for twenty years. I became a specialist in the implementation of sensitive policies, “atypical political risks”, in businesses that experienced expropriations, nationalizations, commitments not respected in unstable countries.
31The second one, younger, includes risk managers and experts (35-50 years). A minority among them had experience as project leaders in defence organizations, such as the Directorate of External Security, even the Directorate of Military Intelligence. It nevertheless carries a professional identity that is more “civil” than military.
I see myself as having a mentality that is much more IHESI (Institute for the Advanced Study of Internal Security) than IHEDN (Institute for the Advanced Study of National Defence)…I work in a self-sufficient company that, if the purchases are not immediately profitable, outsources few services and buys little. I implement safety practices in a highly evolved company that needs above all to adapt to international standards of operation. The former position holders who are switching to this type of position after thirty years in the military have neither the creativity, nor enough humility to question themselves, and things are not headed in the right direction.
32An another:
I fought through the risk-taking culture of the military, and very soon after that, transforming myself so as to earn a diploma that took me further away and helped me become more acceptable within the company clan. It was especially necessary that I prove myself, not in terms of my exploits in the military, but rather in terms of how well I could integrate myself within the company. And it was by being a generalist that I did so, hence my acquisition of expertise in accounting, taxation, employment law, HR, marketing…And that is a plus, because this vocabulary has become accepted by other entities in the business. It feels as though I have been adopted there a lot more easily.
33These two subgroups exist as the vanguards of a globally oriented security business they feel they must design from scratch, based on the elements highlighted in their own personal training experiences. It is among them that are found the most widely accepted innovations of Anglo-Saxon managerial language, the most creative reflexes, the most entrepreneurial imaginations, the most advanced skills (in the protection of information and Economic Intelligence). But also, according to them, the greatest difference between them and their senior colleagues is that the latter tend to reproduce old formulas rather than try to innovate. As a result, they believe, more often than their colleagues, they are better able to honour the position of director of security and to place a premium on merit. In fact, they stress the idea of having been recruited through internal promotion within large companies, in preference to the simple solution, which would be mostly to go looking for a military or police person who is more readily operational. Because for them, it’s the business that comes first and justifies the return on investment in protection and security, not the security that would protect the business. We search in this sector for generalists, jacks of all trades, who could improve a managerial, vague function, people who above all, could show that their team is contributing to the profitability of the company, even if success in this challenge is never a foregone conclusion, especially in times of crisis. The operation of the company has no secrets for managers in this industry, nor do the “harsh laws of the market”, for which their own paths have prepared them and whose sanctions they are prepared to accept.
I’m naturally curious and my ultimate objective is to be happy every day. For me, the only thing that counts is business, marketing, and benchmarking, which are related to the confidence and satisfaction of the boss and the customer (you have to be able to look them right in the eyes). They have all the rights, including to fire me if I don’t have credibility and inspire confidence (my letter of resignation has already been prepared), because that is the tacit rule of the game, and is normal: if you’re good, you’re promoted; if you’re bad, you’re fired.
- 21 Grard, in his preface to Complete Security and Agora (2010) explains: the company has neither the m (...)
34Their challenge is to know how to transform an apparently unproductive constraint into a longer term resource. If safety is priceless21, it does have a cost to be optimized, without damaging the sustainable development of the company. This is one of the main outlooks of directors in this sector regarding internal promotion or people coming from other companies, often through a head hunter who identified and lured them away. When the risks are rare but potentially destructive, the response of these risk managers is clear: if the risk did not materialize, they argue, it’s because they had persuaded politicians and financiers to allocate the necessary funds to decentralized operational echelons. Or because, at sites where former colleagues from the company were active, they knew how to have them work in proper conditions conducive to personal safety. They are followers and practitioners of all the techniques to rationalize cost optimization through the calculation of ROI (Return On Investment). They most often include SSI officials, for whom the protection of sensitive information is not yet sufficiently valued. It is in this sector that the lobbying of these experts is pursued most aggressively for the proper recognition of their value and professional identities. It is especially important to them to convince their colleagues and the public authorities of the necessity to change the balance of global security by orienting themselves towards the better protection of intangible assets (informational). They encourage their peers to abandon their control procedures, which had focused exclusively on material assets or the supply chain, management of which they consider to be correctly subcontracted to agencies having expertise that their enterprise uses when it decides to outsource this area of activity (Warfman, Ocqueteau, 2011, 94-95).
35However, we cannot have many illusions about the real impact of all these efforts, because in France, the culture of the elites who manage companies is still very unlikely to allow for innovative approaches to security. Since there is the attitude of “can’t do”, and since there is apparently a virtual pool of quite available specialists who “can do”, for them, the internal cultural conversions are likely to be particularly slow.
As well, today, the large companies, obsessed with diagnoses of the many vulnerabilities that may hinder their businesses, perceive that they are very visible and thus highly exposed, and so tend to always turn to the most readily available recruits, in other words, the police, the gendarmerie or the military, the “action services”; what a shock! (said with irony). It is a way of reproducing an earlier model, one they have already mastered quite well, not just their networks, but at a price, unfortunately, due to a lack of flexibility in a defensive style of operating that is static, monolithic, a deal-breaker style, whereas a safety practice in a “business-oriented” style should be developed, something a lot more dynamic, active, aggressive, in a deal-maker style. At the very least, when we claim to be part of leading companies, the elite that should lead by example, what is expected of us should be something other than what we don’t necessarily expect from challengers or outsiders.
36Between these two types of position-holders, split by a slight generational effect, other atypical people in the sector slip by, especially among the operators within open strategic infrastructures, public enterprises destined to become increasingly competitive through their partial or complete privatization. They justify their mission within a large permanent gap between measures to protect physical assets and human resources, and aggressive preventive actions against the risks of external and internal disturbances. This core of atypical people, with clashing opinions, is differentiated by sensibilities or options clearly defined by classical philosophies of situational prevention that guide the practices of most of their peers. According to them, rather than obsessing over the deterrence of hostiles, thieves or the uncivil, the director of general security in the business should rather concern himself with the prevention of diffused mass-oriented risks. The implementation strategies related to care and accountability must ideally be thought through by the co-producers, managers and executives, staff and clients, based on long-term strategies of prevention, rather than on the quality of urban life as manifested within the company. The engineer needs to have the sensibility of a sociologist and know how to resist the attractiveness of militarizing or “police-izing” symbolic mechanisms:
Social enterprises such as ours do not really consider security as the constant research into the quality of social bonds, but rather as the protection of normal business from abnormal attacks. Without ever integrating the co-produced phenomena of insecurity, our State enterprises, subject to galloping privatization, have unfortunately only become goods enterprises, spreading envy and frustration. We still recruit people who are incapable of problematizing or complicating safety issues ever so slightly (…). At best, we attach ourselves to pseudo experts whose function is to “reassure the engineer” still dealing with “linear cause and effect” of crimes they do not understand, rather than questioning ourselves.
37They are mainly represented by civil servants from the Ministry of the Interior and by military people, sent by the Ministry of Defence (from the three services or the Gendarmerie).
38Regarding retired police officers redeployed from the central directorates of the PN, their main attraction is in their rich portfolio of relationships or their foreign networks, acquired almost at the same time as the recruitment of the office-holder:
I admit that I took time to gain confidence while they saw me a bit like « Moscow’s Man ». But gradually, I came to be accepted by energetically mobilizing my old networks, and especially a police captain I kept a special connection to so I could quickly solve problems relating to thefts and scams within this business. And because I hadn’t concerned myself with the management of crises, and I took quickly to international orders, I also broadly and decisively mobilized crucial information from my former networks of advisors and liaison officers in the embassies (…) Obviously, I think some of the determining factors regarding my recruitment were my national and international networks. I have the complete network of X, I am still in contact with them, because a network communicates in depth, these are old friends stationed overseas, I know at least half of them; for those I don’t know, I go through the central office that employs them.
39Regarding members of “the prefectorale” (prefects and sub-prefects), civil administrators or police commissioners on secondment or temporary lay-off, with the exception of prefects in classic career paths, the commissioners or civil administrators have rather meandering, bumpy and highly mobile career paths (in local governments and/or in « difficult territories »…). They also report a greater appetite for the world of politics (MPs, mayors) and business, rather than for the managing of management:
Even in my different police positions, I was always willing to cut loose in private, I was always fascinated with the world of economics and aimed for a job with an international focus and especially the Anglo-Saxon world. The clash of cultures in which I am now comfortable has to be reduced by the director of safety, who has to work tirelessly for the convergence of these two systems of values, or two cultures of security that are perceived as incompatible. For me, “information science” must remain controlled by the managers of the business, and the uses and purposes of vitally important, overall enterprise safety must be assimilated by engineers and computer scientists. This continuing education that I promote must convert managers to the idea that identity access management is seen as an ultimately positive constraint and not as a business-hindering constraint to be rejected.
40They don’t live only as idealists for the cause, but also as generalists useful for two intrinsic components of their missions, defined as follows: strong capacity to mobilize all law enforcement personnel in times of major crisis; better ability to interact with public authorities who would recognize two of their characteristics: confidence in the management of highly confidential files, -who do not resort to the use of less reliable agents, private practices – and knowledge of how to negotiate as equals, the impact of regulations, standards and the ethical standards that would henceforth be imposed by the State in the SAIV:
Faced with the particular nature of my job that is not directly productive, I believe that the utility of my position as the head of the group is related to my ability to elicit information, the “weak signals”, as they say, to process and analyze them, but also, my ability, at the central level, to find common solutions for communicating with the monitor for the media, thanks to the importance of our corporate links and a common language that reflects an immediate understanding among peers. And I do not see in-house engineers easily heading off to the office of the prefect to negotiate.
41Regarding the military sector, which we encounter most often in a survey of this kind, it is very much appreciated in responsive large public and private businesses. Easier to train than their police colleagues, the soldiers and gendarmes also benefit from attractive advantages: in their hearts they were and still are men of the field, sometimes even warriors, who have worked in reputedly dangerous foreign theatres of operation, and as such have extensive knowledge of human material. They are good providers of intelligence related to certain risk-laden countries where, in the past, they had found themselves having to conduct negotiations. One can also favourably assume them to be endowed with moral righteousness and respect for hierarchies, as well as being able to keep a cool head in times of crisis and emergency. These assets can, nevertheless, be considered as defects or impediments when these people are seen to reproduce their internalized habits of excessively strict discipline and obedience (the source of their propensity for procedures that are limited only by the penal code), rather than producing horizontal global security within the company. The shock could also be violent for the soldier-turned-policeman hired by the CEO of a start-up, when he realizes with bitterness that he has not been fully accepted by the other owners-heirs of the company:
Despite my willingness to earn degrees in VAE (Bachelor +2 ), I still have a lot to learn (…) I am still protected by my CEO, who told me to do what I want and not hold back on the methods (the confidence is still there, because I was able to prevent him from being defrauded by a fake policeman). But I have an enemy in the Parisian management, his right-hand man, who seems lax, he doesn’t want to see me, and above all, he has no interest in learning about the controls, filters and other internal regulations related to the time clock. There really are bosses who do not lead by example. Their unjustified absenteeism is demoralizing for the employees, they leave the business for whatever family reason, avoiding eye contact as they flee. They made a big mistake casting me for this role.
42Against the massive transfer of civil servants into sensitive private enterprises, we sometimes find an exception that confirms the rule. Especially in this industrial enterprise, subject to the rules of “Defence Secrecy”, where the position holder, a private engineer, defines his own role in almost absolute secrecy:
I was not originally an expert on safety, but I became one through my questioning, my ability to structure our business operations, my capacity to provide structure. I have no operational expertise-for that I rely on my colleagues. On the whole, our margin for maneuver is slight, but after seven years of breaking in and reshaping the position, when the State comes around to inspect things, we are able to tell it to not criticize us too much.
43Which would tend to prove that the need to erect or maintain certain functional boundaries between worlds is not always connected to agents of the State intelligence service. Military officers, officers and non-commissioned officers of the gendarmerie often claim exclusive control over the security services related to businesses in vital sectors. If their claims that they are not always comfortable with the management of the company incline them to self-devaluation, for the most senior of them, especially, the other values expressed (“order and the penal code”) are, on the whole, strongly appreciated. Especially since they are often the source of an extreme rhetoric of legalistic ethics, setting them apart from the world of managers who, trained in business schools, are a lot more likely to circumvent the rules.
Regarding my superiors in the hierarchy, my role, aside from solving problems to accelerate administrative procedures in place for our colleagues abroad, is to apply my social and technical skills to keep them informed. I don’t make decisions, but I do insist on being able to control the execution of decisions on the ground because that is essential to the work of a non-commissioned officer! I think like a colonel but act like a regular soldier (…) I think like a colonel and act like a lieutenant.
44Among the former members of foreign intelligence, for example, we still appreciate their ability to formulate strategic decisions, based on their solid understanding of the mentalities of the local political elite, within this specific cultural area where the company tries to reinsert itself where they once officiated:
For me, a real risk analysis in the countries where we operate, that means reading and embracing the historical culture of this country, then I go and “infiltrate the crowd”, thus learning how to adapt ourselves to all environments, as my job has taught me to do, adapting to the population by casting aside my prejudices, which does not mean that I deny myself, but at the very least I am respectful.
45In this situation it is imperative to gain the confidence of a partner with whom we are to negotiate a long-term contract, as in the case of energy companies. They don’t mind carrying out informal, on-site reconnaissance missions. Indirect testimonials of satisfaction are then specifically sent to them. They have the ability to discuss strategy, “tooth and nail”, with management, but also to stand behind a decision that has been taken, even without their full agreement:
The amazing thing about these soldiers [the witness is an engineer who claimed to have worked with five ship captains while in his position as head of security, people who “let it all out”], is that once they were able to express their views in an extremely strong and combative manner, when the boss had spoken, everyone got in line and everyone made sure that the system agreed upon would be effectively implemented, and you could be sure there would never be any failures.
46Other skills became apparent in some of the younger officers, among whom there are real experts in Information Systems Security:
I managed to convince my former CEO to specialize in the security of the parent company, in the more specialized area relating to the protection of information and internal sources against cyber attacks and in EI. To this end, a soldier was recruited from the DGSE who, at fifty years old and after a four month apprenticeship with X, has ten years ahead of him to support this mechanism of the future.
47As for the expertise sought from the officers of the police or the Ministry of the Interior, it is explained mostly by the knowledge that these agents are much better analysts of the opaque workings of criminal justice and the too-complicated world of judges:
When I arrived here, management had a clear idea of what my job was: I would deal with problems of fraud, money laundering, and the threat of terrorism with Vigipirate. They knew very well what they wanted from me, first of all, directly usable knowledge and police know-how, they were afraid of penal risk, their penal responsibility, and thought that one day they might end up in prison, without really understanding why the judges might actually find them guilty. I accepted, because there was also another dimension, one more important than the one of trust and proximity maintained in protecting the personal interests of the CEO (he received death threats from crazy clients): he was also preoccupied with improving the level of internal security of the enterprise, and of its atmosphere, which had deteriorated. Then I was attached to the SG, then the HR department, which put me at a safe distance from the CEO, because there was always a risk he might ask you to do some marginal things (something illegal), things that you have to resist, while offering other methods to attain the same goal, even if they take longer. And once we have achieved this, we initiate activities regarding the new risks that are going to impact the enterprise. And I got caught up in the weakening employee situation (stress, harassment, discrimination, suicide prevention, and crisis management), while establishing and shaping an early warning and prevention network made up of 70 of our colleagues in every country, including outside experts (from the police, justice, university professors).
48It is certain that the shock of “Karachi jurisprudence” was a very real collective trauma. This involved the directors of some large companies being prosecuted for endangering their employees through failure to anticipate the risk of attacks. This shock has certainly accelerated the demand that public officials better protect themselves against such challenges in the future. Let us recall that this 2004 case defined “great negligence of the employer”. In this case, the Director of Shipyards, despite being aware of the danger of a terrorist attack in Pakistan, did not see fit to take measures necessary for the protection of the eventual victims - eleven expatriate employees. Given the information available at the time, the DCN should have been aware of the major risks that an attack could have been carried out against its employees (The Social Security Tribunal of La Manche).
49A final quality: more than others, they mastered the art of informal negotiation within departmental headquarters of ministries. Within ministries – and we are referring firstly to that of the Interior – they are reputed to know how to find “listening ears” to perceive and anticipate normative decisions that need to be made and applied within enterprises to which they have been attached.
50The survey allows us to identify, beyond the generational differences, differences of culture and of adaptation within the world of business, arriving at conclusions that are expected and several others that are more counter-intuitive. The prejudice that security is always a priori seen as an unproductive investment within the business in relation to other business units, and therefore always subject to less investment, seems less and less proven. All of the directors concerned try to empirically objectify the performance of their work by establishing metrics, measurement instruments or indicators of efficiency, even though analysts recognize that their full implementation is quite rare in French companies (Galea, Couvain, 2009), even though all schools of risk management love the idea. It is, however, clear that the risks of outsourcing secondary functions (such as caretaking, body-guarding, filtering and access control management) and the possible inferred feeling of dispossession are properly assessed. Instead, the prevailing impression among them is that these “basic” activities relating to the physical protection of the company have increasingly become moralized and normalized:
We have had contracts in procurement for four years, the technical terms of which I am in charge of with my assistant. During the renegotiation of the contract that I have been familiar with for 20 years, we have tried to re-think matters and request new terms, but unfortunately, during this four-year renegotiation, our room for maneuver with the supplier has been quite limited. For example, sixteen candidates were running, and the ones that were chosen were those that promised “70% quantity and 30% quality”. Our intention to thwart the policy of the “purchasing department” within the framework of the negotiated contract has been clear. Now, since we’re very familiar with the partners, we’re able to show him how to unpack the price of the service and evaluate the consequences of the risks taken in social terms (dissatisfaction, strikes, work stoppages) if they want to aim lower. Nevertheless, we have to prove to them that we will provide thrifty management for the next four years, generating a surplus of 1.5% on the 4 million Euros allocated, with savings on non-package services.
51Above all, it seems increasingly important to understand risk management as it relates to the most vital interests of the business with regard to secondary risks. It is generally thought to be easier to estimate the return on investment when protecting property through the calculation of decreasing “shoplifting” in large grocery chains; it is the same when we argue for reductions in premiums during the renegotiation of insurance contracts on the basis of efforts seen as successful within processes aimed at effecting conformity with technical standards or ethical guidelines.
We do a very precise monthly and annual accounting of the internal threats at headquarters as well as each of the decentralized units with systems implemented to block the threats and prevent their escalation. We record all the training activities of our personnel and especially our reception personnel in at-risk areas such as the emergency services. Because it’s an important indicator for our ministry, we especially tabulate attacks on property and people, knowing that the climate of aggression is greater than before (especially because of verbal threats that not everyone complains about in the same way), although this is still at a completely acceptable level. We support our staff and since 2004, have encouraged victims to file complaints within the framework of our legal affairs services. Our concrete actions have become much more visible to supervisors and our staff than in the past. They just can’t get by without us.
52What are different, on the other hand, are the evaluations on investments that are more difficult to sell, and especially regarding rare risks. They follow difficult negotiations about the hierarchy of emergencies, varying according to the power of companies, but also not always rational efforts at trial and error with respect to the assessment of financial costs of living in relation to mechanisms of protection (against attacks, kidnapping, hostage taking). It is a constant concern for those employees who have foreign exposure, an emerging concern that mobilizes a lot of energy and technical knowledge, especially within “Cindex” (the protection of expatriates).
53A second split separates the security departments that are business-oriented (objectively without any legal tool of coercion with regard to uncooperative people) from those who believe that the State remains the final recourse for the vital enterprise during times of great vulnerability or major crisis. The latter consider the State to be a key actor, with its own sources of information, which can facilitate the maximization of profits. This enables it to have the expertise and capacity to alert all governmental entities in the event of a major crisis and especially civilian and military security functions. Opinions in the position differ quite appreciably on this point.
54When the security-oriented business departments are certain that the laws of the marketplace must dictate their conditions to a State in retreat (non-vital sector), the mobilization of criteria and indicators of the profitability of global security becomes an issue of primary concern. Proving efficiency and efficacy remains the major litmus test evident in the symbolism of objectives expected from numerical results: reduction of losses (frequency and intensity); non-occurrence of feared events, profitability of BCPs (Business Continuity Plans). Imagination in this area is quite fertile. Some have also promoted innovative and creative experiences which, judged as being too audacious, were not accepted by management, which led to a reduction in their application.
We still have a real problem communicating up the chain of command and listening to a management that is still caught up with short term thinking and quick solutions. As long as there is no mechanism to accelerate the process of awareness, the conversion to a global security will remain slow. I cannot currently see global security being based on an economic lever within the company, unless getting them to accept the idea that its mastery might be a factor of differentiation among our competitors, giving them a competitive advantage. But this does not exist, I do not see it, security is always seen as a hindrance, as a constraint. We prefer to wait for the regulations so as to be able to bypass them, in a situation where the Vigipirate plan is in the red for a long time. My other solution is to try to convince our decision-makers, factory owners, to work on crisis management, in the absence of being well protected against all possible threats. It means working on resilience to systemic crises, from feedback experiences of catastrophic scenarios for which they were never prepared. We tried to put them at a table together, under stress, in situations requiring that they make decisions interdependently, rather than each one sitting in his own corner taking precautions. For example, I persuaded them to imagine the headquarters of bank X completely disrupted because of an explosion at station Y. It’s at the point of the “human factor” (a convergence of the physical and the logical) that the vulnerabilities of all the most sophisticated information systems break through, requiring that everyone engage in a mutual supervision. But no one listened to me. For them, it’s too complicated or it could never happen. To cultivate new and more mature approaches, approaches that are interconnected, interdependent, open, complex, in so far as there would be no more solutions that come as a whole package, I tried and I gave up. Maybe only a charismatic leader, still unknown, would be able to budge all these elements of inertia.
55As for the latter, with the enhanced legitimacy of an identity that draws on the developments of the lex mercatoria and the law of the state, they magnify instead the excellent components of a mixed culture. It doesn’t lead them to put all their energy into narrow indicators of quality, ethical plans and mechanical reporting of accounts in the short term. They play on many other keyboards, as learnt in the schools of the large state-controlled entities. Close to the bosses of the large public industrial groups, they are led to provide sensitive information produced by their own internal services as well as public intelligence agencies:
Out of necessity, we discuss questions connected to intelligence regarding our company since the change in its status, and in a situation where the General Intelligence (“RG” in French) no longer does its traditional work…So, we’ve put in place a mechanism of internal analysis and for the dissemination of memos on the internal climate which the political staff can have in risky missions relating to social unrest. And that hard work and intelligence to alert senior management is an important part of our mission, our unit being the inescapable entry point for information on this subject. We transform this information into briefs for our bosses, who authorize us, or not, to transmit this information to the Central Directorate of Internal Intelligence (“DCRI” in French) or to the offices of the ministries concerned.
56The search for a more balanced relationship in the exchange of information having economic and/or non-economic but strategic value, is also a recurring concern. Sometimes, people challenge the manner in which sensitive information is treated in France, believing that this treatment is still too one-sided, in other words “the State versus businesses”, and so passionately advocate for a better balance.
Obviously, the State helps us a lot, but it also “interferes”, because people like me, who are not part of the club, have a hard time accessing information on their public colleagues. I think that the State services work, first and foremost, on behalf of the State and the DGSE is not especially “business-oriented” which is not to say we could not get information from it, but we know that is not its primary mission. On the other hand, the State’s sense of time is unlike that of a business. Making a request to obtain some confidential information which might not be crucial after two days but having to wait six months to get it would prove to be completely counterproductive. Apparently, the State does not want to give up its monopoly on confidential information, even though open sources are fully exploited by the private sector somewhere else.
57On the other hand, many people recognize, especially among converted former gendarmes, the contribution and educational support of the services of the DCRI which were very welcome vis a vis the dissemination of the culture of “economic intelligence” in their company. As reflected in this excerpt:
I was sometimes helped in my reconnaissance missions by agents of the DCRI, which I had solicited, and that had a much stronger impact on them, although this had not been without problems because of the head office of our firm abroad. We wondered whether the DCRI or the DPSD (Directorate for the Protection and Security of Defence) could assist us. This problem was solved because I had a good reputation and without a doubt they had to have done research on me before responding to my request. This bit of advertising was without a doubt the thing that created confidence in my company, because when I arrived, I felt that the business-minded thing to do was to remove this cliché from their minds: back at home there’s this guy in security, a bit shady, we don’t know too much about what he does, what he is, for sure he does bizarre stuff, we have to be careful, because he has to work for me, against me, for reasons that escape me. So my strategy of laying my cards on the table began to pay off. For two years, things worked out vis a vis the head office and management; there were good results from my reconnaissance efforts through the development of supports for the protection of information (passport information protection, traveller safety; training module on the identification of strategic information in the company with role playing exercises of spy vs. the spied upon).
58This proves once again the point to which ambivalent attitudes towards services provided by governments to businesses remains mostly conditioned by the cultures of origin and the roles of facilitators or gatekeepers (Coffee Jr., 2006). Converted former officials are generally a lot less likely to criticize the actions of the State than their counterparts in the private sector. Clearly, it is somewhat banal to repeat, but it is certainly true that French peculiarities regarding roles manifest themselves: the State might often do too much and badly or not enough, in its expected or detested role of military arm in defence of its “industrial jewels”.
59The sustainable promotion of a culture of security or caution is of paramount concern for all companies. But on this subject, practices regarding the best levers to pull diverge considerably. When there is no certainty of having an unlimited budget, there is a “grey-zone” technique which is still widely used in relation to employees and production managers who are resistant or indifferent to requests for caution. “Young” employees and “disreputable collaborators” are the most frequently mentioned targets: the young ones are thought to be unable to properly distinguish information from their private lives from that of the company for which they work; careless employees who allow their lap-top computers to be stolen in embarrassing circumstances are unable to confess this to their bosses (a situation frequently mentioned in case studies. It must deal with this very French tropism which mingles, according to most observers, an ideology of an a priori mistrust and suspicion towards any type of internal security, caught up in the paradox of the fire extinguisher and its recycled consequence within the company, the well known technique of spreading fear in order to establish a dominance aimed at achieving confidence in the political field (Robin, 2006):
The security function is like a fire extinguisher, it does not add beauty to the environment, it is expensive, it seems to serve no purpose. And so you have to find some other function for it. For example, a fire extinguisher can be used to hang up a coat or hold open a door. And the security function in the company, well, we provide general services, some HR, whatever you want, because in any case, we have to keep busy. Okay. But, on the day that an extinguisher is needed, well then, it has to be available, above all, it must not be encumbered by other functions and someone has to know how to use it. And we can see this like day and night and at the highest level of the company. But when the fire has been extinguished, they will again be keeping doors open and will be forgotten. So, when I say there is a paradox, it is that we could almost get to that point (…) to wish that there might be [crises], because it is then that we get to show our stuff, we get to enjoy ourselves and assume our true place! And when we return to our original spot, forgotten in the corner, it’s in some way, quite frustrating.
60Whatever the structure of the company where they work, many security officials admit that they in fact have to get the job done with weapons that permanently inoculate people with the fear of the criminal’s wrath, or more simply of that which might cause blame and disapproval, lay-off or termination, a civilian’s resource that is apparently still persuasive and can be summoned according to circumstance. It is a weapon used equally by managers from different sectors, the differences among them relating to the relative brutalities with which they are used.
Externally, you have to be able to persuade a client that security is profitable, and certainly not an unproductive investment, for example, that it would speed up rather than slow down production. If necessary, confidence promoted in “the reluctant ones” by playing on the theme of the disguised threat when the client is reluctant to internalize the cost of the security contract [two examples of persuasion are given in the interview, the threat to resign by the insurer, Lloyds, the threat of leaks to the environmentalist media regarding the poor implementation of security regarding the movement of truck convoys belonging to X].
61An another:
They told me that I “attacked Kolwezi a lot”…As you have no sovereign powers to push people around, you have to frighten them…that is a real truth…, so sometimes you have to cry red alert even though it’s just an orange one, because if you don’t, people won’t do anything…That’s a system I use a lot less these days, but one I had to often use and I was criticized for it by some people. They used to say: yeah, that’s very nice but sometimes they send us e-mails that say “this will mean war”. But it will not be war!...except that, since you don’t have the sovereign powers of the police, if we don’t do it, people won’t move, they do nothing, after that, there IS a red alert…so it’s true, that’s a criticism I’ve had many times… I accept it, but since then I have become more moderate, I don’t have to resort to that.
62For the least strict or most flexible of them, substitutive pedagogy works instead on a more playful basis, seeking reassurance through symbolic stress tests, in which we study the consequences of personal and collective engagements:
The strategy of the transparent activity is much more rewarding for me, I distance myself from secret practices. First, with respect to a “crazy” predecessor, making him believe that I was even more twisted than him; but also, to acquire the legitimacy of other entities, and I muscled my way in and made a playful publicity stunt to demystify my job. It was during a well known open-house where I brought everyone together like it was a police custody exercise (GAV in French) and it was done with American Western style “wanted” posters, after which, all the other “invisible” services of the company did the same thing.
- 22 We would have wanted to avoid mentioning the false spy case involving the Renault Company in the au (...)
63Among the most strict – a position that no one directly assumed over the course of the survey, except when speaking of predecessors -, the pressure exerted, on the other hand, among the most threatening of the individual tactics aimed at “the guilty” or by the indirect strategies drawn from the internal disciplinary arsenal. These are always admissions of failure, because they poison already tense climates within a company claiming to care about HR22…
64Does this mean that risk management of the company as a whole (Power, 2004) would be a political path to a bright future, consolidating the triumph of the free and peaceful market place for the virtuous company? It is not apparent to what this ideal of “civilization”, of the management of risks in companies, is inviting the French observer to understand at this time. Because, we are struck by another fact: the seduction exercised in most large companies by agents with roots in the military and gendarmerie should be felt as a more lasting effect. We would not be able to definitively interpret this phenomenon, even if we tried to control the representativeness of the sample. Unless there are unpleasant experiences within corporations or corporate managers adopt anti-military ideologies, there is nothing to suggest that the strong flow of military people into corporate security will quickly abate.
- 23 As we have recently seen at the SNCF, where Jean-Jacques Henry, engineer and former director of sec (...)
65It is rare to see former senior police officers or officials of the Department of the Interior in companies deemed «non-vital”. Within the security management of public institutions or companies from “vital” sectors as well as others, we can observe the almost systematic presence of at least a second-in-command, right-hand-man from the military or gendarmerie attached to the holder of the civil or police post. The dominant reflex would seem to be the quick replacement of the civil by the military23, as though the exception was bound to confirm this rule.
66This basic trend needs to be examined because it is likely to go against the grain of established assumptions about the alleged civilianization of security management in corporations, something propagated by civilian officials trying to protect business within a corporate culture competing against agents who would partially dispossess them. And the real question thus becomes: why does management have the natural reflex to use military people in matters of security, as they are, rightly or wrongly, thought to be the least flexible in the management of polymorphous risks experienced in the company? To this question, I would be tempted to tentatively suggest three cumulative responses.
67Two of them seem to be in a kind of conversion mode that is more in tune with an uncertain request. It is not so much the caricature of the “five-star generals” of the past that now imparts cohesion, as much as it is the mobilization of toughened staff that is generally younger than their police colleagues, in as much as their retirement age is the earliest, as compared to all other officials. It follows that if the values of order, control and loyalty, which form the core of their ethos, are a priori appreciated, it is also linked to an implicit calculation by the applicant company regarding relative youthfulness as a guarantee of flexibility and adaptability. They will be more able to bend or conform to the laws of the internal order. If we assume that they do not all have the expanded relational resource capital that their conceptual counterparts do in the police context, we can imagine them as being able to amass strategic information from the best sources and in a timely manner. However, in a dangerous situation where companies in the SAIV must demonstrate their compliance with the expectations regarding global security defined by the United Nations in its efforts against major hazards, what better opportunities could a company have to validate these gestures of goodwill?
- 24 See especially the role of Arco.
- 25 On the role of "employment agencies" and "headhunters", see for example the debates generated by "I (...)
68Especially since, as the second part of a more pragmatic response—this request encounters an increasingly offensive offer: that the soldiers and gendarmes being retrained have indeed learned to organize themselves more quickly than the more independent police, through the use of associations dedicated to learning retraining techniques based on the use of feedback24. More and more candidates for important positions learn to sell themselves and acquire the skills of seduction once they have decided to conquer the company25. A decree of the Minister of Defence of June 10, 2009, called “Defence Mobility”, has even doubled the efforts of these associations by creating an agency to assist with the retraining of these officials. Consider in this regard, the latest data of 2009, which no longer allows for the counting of military people converted into subgroups divided according to the length of their careers in the army, as it was still possible to do so prior to that date (see Table 1).
Table 1. – Summary of military retraining of people with more than 25 years of service
OFFICERS > 25 years
|
NCOs > 25 years
|
|
Land
|
Air
|
Sea
|
Gend.
|
Land
|
Air
|
Sea
|
Gend.
|
2005
|
494
|
201
|
115
|
129
|
1,131
|
657
|
333
|
1,950
|
2006
|
418
|
137
|
175
|
155
|
944
|
327
|
671
|
1,623
|
2007
|
461
|
121
|
215
|
165
|
953
|
367
|
842
|
1,878
|
2008
|
603
|
194
|
253
|
124
|
938
|
415
|
938
|
1,600
|
Source: Ministry of Defence, General Secretariat for Administration, HRD, Annual Reports (Summary of author).
- 26 Source: Bilan reconversion 2009 / Défense Mobilité, ARF - Agence de Reconversion de la Défense.
69The data gathered from the new Defence Mobility Agency, concerning influxes up to December 31, 200826, shows the following details: in 2008, 148 military personnel were reclassified within companies that were partnered with Defence (id., p. 37); 1,411 military personnel in partnerships with other types of businesses (n=597) or with professional federations (n=814), of which 30% were in the area of logistics (id., p. 37). French businesses have mainly recruited technicians - «senior positions” have accounted for only 8% of the reclassifications. The officials concerned were moved into transportation and logistics, [Keolis (n=58) ; SNCF (n=32) ; Giraud International (n=20) ; Air France (n=19), (…)] ; the companies labeled Energy partners [GDF Suez (n=30), FII (n=24), Bouygues Construction (n=19), Areva (n=16) Total (n=15), ...], the distribution partners [Sodexo (n=26), Auchan (n=21)]; experimental fields [Veolia Environment (n=56), and among the miscellaneous, Adia (n=44), Eurocopter (n=17) Thales (n=16)]. In addition, retraining of military personnel also occurred in the police (n=15) or DCNS (n=15).
70Finally, many military personnel were converted en masse through various federations playing a dispatching role through their members, [TLF (n = 614), ANSF (n=83), USP, the largest union of private security companies (n=65)].
- 27 In absolute values depending on the weapon: 334 officers and 1,155 noncommissioned officers of the (...)
71Note also that in 2008 the number of military police reclassified (24 officers and 434 NCOs) accounted for significantly higher rates (respectively 80% and 92%) than non-military gendarmerie (respectively 71% and 73%)27. The policemen of all ranks would have been reclassified, with 42% of them in «services to individuals and the community” and 16% in «transport and logistics services,” and finally, to 9 % in «distribution and sales.” Note finally that additional remuneration at retirement would be between 1,000 and 1,500 € / month (for 70% of them) between 1,500 and € 2,000 (16%) and> € 2,000 for 10 %..., these additional perks are tempting, to say the least.
- 28 A good introduction is found in a book by Lemieux, Dupont (2005). These authors are aware of having (...)
72According to one hypothesis increasingly supported among specialists28, a third, more fundamental reason is that such phenomena have arisen in the context of a broader militarization of Western police apparatus. The trend has mainly been documented in the areas of crowd control, security intelligence or information, and in areas where there has been a breakdown of traditional spheres of sovereignty, which has seen the rise of an offer of commercial security alongside global business development on a worldwide basis (Johnston, 2005).
73However, in this area, we believe that the analysts are possibly too attached to the dramatic: would the out-sourcing of military expertise in mechanisms of their conversion within private military companies be designed for peace keeping operations? These analysts seem to have forgotten more subtle but otherwise important phenomena-those relating to the internalization of the “military culture of risk” within large companies. Now, it seems to us that one of the most decisive reasons that importing military culture into the company has become so attractive is that it is seen as a final possible defence against the anxiety that business leaders endure in the face of risk. It seems as though a reassuring military presence could magically ward off the uncertainty connected to the loss of rationality in dealing with complex environments that are perceived as dangerous and virtually uncontrollable.
74Whether the uncertainty is or is not rationally averted and whether or not chaos is banished from our democracies engaged in global securitization, omnipresent vigilance requires that we know how to remain watchful. Corporate directors of security carry composite value systems that are still the best guaranty of a non-unified management style, and therefore there is a possibility of transparency in their role with regard to the employee collectives at work. Although the fear of industrial espionage and the protection of the country’s legacy has become an obsession shared by the highest powers of the State and its industrial elites, the mechanisms for internal protection must remain transparent and not be subjected to extreme standards of confidentiality from which the democracy of the company will inevitably suffer. For we will not develop durable global security policies relating to the internal order of companies if they are built in an authoritarian manner on the backs of executive employees and customers whose liberal, open and confident value systems prevent them from spontaneously adhering to value systems that are too narrowly security-oriented.