Getting away with it

I have a propensity to give into my curiosity and explore places that most people don’t even notice, let alone think are worthy exploring and certainly don’t think are works of art and beauty. This means that I will periodically encounter some well meaning security guards who are doing their job to the best of their ability, and doing that job often means asking me to leave.

That’s fine by me. One of the things that I really try to remember when I’m face to face with security is that they’re paid to stop people from doing things that aren’t within a very narrow band of accepted behaviors. Consequently, giving the security staff a bad time won’t help anyone else caught in a similar situation. I’ve written up my notes on how I’ve social engineered my way out of trouble in various occasions over the years.

Note: No guarantees are implicit, implied or given except to say this probably won’t work with police. In the event of getting pursued by police, you’re probably screwed anyway. They have radios, dispatch and a whole world of experience at catching people.

Plus these days, in the 2010s, shooting first and covering up later is policy.

These aren’t foolproof guidelines by any means.

This is a set of notes from my experiences of not running like hell from security

Security in the 2010s is a problem.  More and more guards, police, rent-a-cops, and security feel the need to manufacturer crisis to make themselves valuable. People who need to validate their investments (governments, police, contractors) will start throwing good money after bad as they can’t back down and say “Well, we can deescalate the scenario now”.  The new Cold War is personal, and privately funded.

There will be a chance the guard is on a powertrip, had a bad day and wants to kick some ass to feel better or is just a jerk who does the job for the powertrips. On the other hand, the guard could be a reasonable person, doing the work to fund their way through college/university or be a retired police/military officer who still believes in duty. Good and bad people are guards, just the way good and bad people are stopped by guards. It’s a question of how well you convince them that you’re the good guy when it happens that determines the outcomes as much as what you were doing in the first place.

The Way the World Has Changed: Political considerations

  • If you know you’re about to get engaged by security, activate your recording kit.
    • Pre-install an app on your phone. Practice with it.
    • Put the phone onto record / live stream the moment you are certain you’re about to engage.
      • Pocket the phone is my preference, so the phone stays with you for the longest time.
      • Do not attempt to access the phone until the situation has resolved and security is elsewhere. Don’t give them the marginal excuse to declare you were reaching for a weapon.
    • Know that your evidence is grounds to cast suspicion on what may happen to you, and, not automatic grounds to exonerate you.
  • Post 9/11 is an excuse, not a reason
    • It’ll be in the security lexicon as a rationale for why they won’t let you photograph a building or do what you were doing. This is a bogus reason for you, and a daft rationale for their management, but for the most part, the security guard is likely to have accepted that they’re doing their part to make the place safer.
    • Excuses are just excuses. Reasons can be negotiated, excuses can be accepted. Don’t bother trying to point out the insanity of 9/11 as a justification for why you can’t photograph a public building. It’s not a sane reason, it’s an emotional excuse.
    • You can’t tell someone their emotions are wrong, because it’s not a thing you can discuss in logic, reason or rationale. If a security officer is emotive, and responding emotively, then you’re dealing with that as your reality.
  • If you are in the wrong for legiimate grounds of trespass, criminal engagement or doing something broadly recognisable as illegal, then it’s your fault if you get into trouble.
    • The parameter illegal is getting worse.  What counts as good law and bad law is still law, and if someone wants to power trip on you with the law, then you’re going to have a bad day.
  • If you are in the right, yield and concede to the guy on the ground, even if they’re wrong.
    • They have no ability to change policy anymore than the counterclerk at McDonalds can get the company to adopt more green policy.
    • Particularly if they’re wrong.  If you can survive long enough to get to a lawyer, charges can be dismissed.  Injuries, death and psychological scars do not get reversed on appeal.
  • If you’re in the right, and the ground troops are wrong, call up or write later politely asking for permission to do what you wanted to do.
    • This section is valid if you’re male, white, middle class, and carry no priors, and are not a recognisable activist, journalist or blogger.
    • Comply nicely. Say thank you and yes sir, no sir. Feed the power trip if they’re tripping, and try to scale down as fast as possible. Question as little as possible..
    • Ask nicely. Carry a notepad so you can take down the details after the event.
      • Do not try to record things during the event. Keep your phone running, but do not attempt to write things down in process.  It’ll be seen as a threatening gesture particularly if the individuals are exceeding their roles and powers.
    • Thank security for their help. This may gain you buy in with the guards, and when you do see the people at higher level, thank them for the helpfulness of their security team if you’re trying to get back into the venue for other grounds.
    • Don’t ask for the name of their manager/boss/team leader
      • That’ll be seen as a hostile approach.
      • If you must ask, ask them for help in working out who you should see to get official clearance.
      • Apologise for interrupting their day, and discuss if there’s a way they could help you figure out who needs to be notified before you do what you were doing.  These days, don’t discuss what or why you do something, and try to keep chat to small talk.
      • Security teams are looking for self validation, so they’ll want to imagine the worst

Security in the post-9/11/2001 environment has become a lot more problematic. In a sense, everyone is seen as a guilty party until temporarily presumed legitimate. Official documentation is being scrutinized more carefully, and you’re more likely to cop grief with legitimate ID than you are if you’re trespassing, since the official identity indicated you should probably know better. How long this climate of hostility to curiosity lasts isn’t something I care to speculate on, I’m just aware that there is greater hassle to be found, and it is having a chilling effect on the urban exploration and urban photography I used to perform more freely. That said, I still calculate the three dimensional maps of building in my head as I look for the hidden spaces and crawl ways, and work out the coverage patterns of security cameras (it’s a fun game to play with maths, angles, and calculating fog of war maps in real time, real world places in your head).

The problem with the modern world for the urban explorer is threefold

  1. Curiosity is less respected than compliance:
    1. Asking questions is a sign of disobedience rather than loyalty.
    2. Exploration is a sign of non compliance, and non compliance is not particularly welcome at the moment
  2. People have always been afraid of things that are different, and things they don’t understand. Where previously people had a murky vision of a “Bad Thing Might Happen” they now have a crystal clear mental image of the World Trade Centre as the go-to “Bad Thing” to image when anyone is doing anything they feel might be suspicious.
  3. There is a sense that “Exploration is over”, and everything known is already known, even when that’s patently wrong. Whilst the urban explorer looks at a closed door at the end of a service corridor and wonders what lies behind it, other people see the door as the end point of the corridor.
    1. A strong media message at the moment is that you don’t want to know or need to know about anything beyond the door
    2. Unless authorised, most people will accept a narrative that what lies beyond the door is known already to the person who put the door there, so there’s no “exploration” to be found in uncovering something someone already knows. That you and I don’t know what’s behind Service Door Number 1 isn’t the point to them. It’s a known thing to someone else, therefore it’s known, and known things do not need exploring.
  4. Corporations are worst than governments for wanting knowledge segmented into pre-approved packages.
    1. Exploring a corporate site means you may discover the man behind the curtain, and everyone knows the cautionary tale of how the Wizard of Oz took out a sealed injunction against Dorothy
    2. Saying one thing, doing another, and getting live broadcast on YouTube/uStream/Vimeo for doing the third thing is the nightmare of modern corporations, so they’ll use heavy security tactics to ensure they sleep at night

Dealing with Security

Over time, I’ve found a few consistent lessons when dealing with security guards when you’ve either run into them around a corner whilst exploring, or they’ve come charging up to you (whilst you were doing something and didn’t notice them)

On the Subject of Producing ID

If you read Schneier.com(and I do), you’ll see the periodic discussion over ID, the production of ID and the right of government, agencies and individuals to demand ID. One of the factors I’ve encountered with personal experience is that the ID card is a security placebo which works when you need to give someone a placebo. A lot of my advice with security involves coughing up an ID card and being ready to ID who you are and why you’re there, and what you’re doing and the sorts of questions that you’re usually advised to STFU by a lot of places.

For me, as a white mid 30s male, defeating the expectations of security means flipping the script on what they expect me to do – standing when I’m meant to run, cheerfully greeting them when I’m meant to be hostile, and producing ID when I’m not expected to do so and so forth – remember, this is a social engineering hack approach. I don’t advocate this because I think you have no rights in a situation, I’m advocating this because my experience with guards has been such that cooperating has thrown them off script. I’ve capitalised on the confusion and gotten away because I wasn’t playing to the expected resistance-to-authority script.

Personally? I think the value of an ID as a security token is bloody useless. If they were useful, I wouldn’t be using them for script-flipping social engineering attack, would I?

Steps, Protocols and Advice.