The Cipher Brief spoke with Francisco Quiñones, the founder of Arcis International, a security, risk management, and crisis response consultancy based in Washington, DC. Quinones, a kidnapping and ransom (K&R) expert, discussed the work his company does to ensure the safe return of kidnapping victims.
The Cipher Brief: Can you start by telling us a bit about your background?
Francisco Quinones: Four years ago, I started my own company, Arcis International. We begin with basic security consulting and then move to the prevention side—once you decide you are going to operate in certain countries, then we say "this is what you need to prevent against." That includes everything from field studies to training, speeches to basic security phone briefs. The protection side involves close protection. We work on cases with bodyguards and vehicles, armored and non-armored, and armed and unarmed in about 30 different countries. The final part is response. If after you’ve done all of this—the initial planning, the initial training and the prevention training, and physical protection—and then something happens (because things do happen) then you need a response, and that’s when we come in. This close protection response, when an incident occurs and you need to call our consultants to guide you through a crisis, is pretty much what we are best known for doing. The crisis could be kidnapping, extortion, malicious tampering, disaster relief evacuation, political evacuation, or even just an incident where something has happened and you need the response to clean it up and make sure it doesn’t happen again.
TCB: You mentioned a number of business lines. Can you walk us through the contours of a typical case from start to finish? How do these business lines get utilized throughout the course of a case?
FQ: I will walk you through one particular client, who went through everything except the final response. They were looking at investing tens of millions of dollars in to a new manufacturing plant in Mexico, but it was going to be the first time for them there. They had made a couple of visits but they were not familiar with Mexico. They knew it was a big market for them, especially to re-export stuff back to the U.S., and they kept seeing images in the newspapers of homicides, drug cartels, and drug wars, and they were wondering whether or not it was going to affect them. So they picked two cities, Juarez and Tijuana, with a possible third being Monterrey.
We did a field study for them to see what it was like there and what they could do to mitigate risk. We looked at every relevant statistic on crime, from crime prevention to actual cases. Then we looked at the labor markets, as to what kind of labor they would need and what kind of turnover they should expect. We looked at the qualified labor and how hard is it to hire quality people. We then assessed the logistics and quality of life. Which cities would expats find more comfortable, not just for security reasons, but also for the quality of life? With regard to the actual merchandise itself, we find that most companies can handle areas where there is insecurity. You mitigate it with increasing your force protection, cameras, personal security, outside security, etc., so any loss is easily affordable. One of the biggest problems we are running into is the logistics of the parts coming in and going out—the market part of it.
We find that most companies are worried about security, but that is not the primary reason not to invest. What it can affect is the decision on where to invest. We try to help them make the right decision of where to go—not solely based on security but on the overall risk. In the end, this client chose Tijuana because most of the parts coming in were coming through the Bay of San Pedro and being re-exported. In Juarez, logistics would be more expensive. Also, the quality of life in the Tijuana San Diego area was much better than in Juarez. They decided not to go to Monterrey because the area where they were planning on investing was a little too hot for them.
The initial planning included the field studies. Then, every time their executive went down there, we provided them with an armored vehicle, one armed guard, and one driver just to give them the extra sense of security. Fortunately, up to now, they have not had an actual incident where they need a response. They had a couple of random extortion calls of people saying they belong to a criminal group, which operated in a different part of the country and wanted money. That is quite common in Mexico, so we helped them realize that it wasn’t a serious extortion attempt and to ignore the phone calls.
TCB: Can you help our readers understand, generally speaking, the kidnapping problem and global kidnapping trends? Are things getting better or worse? Where are the areas of highest threat?
FQ: It’s constant. I wouldn’t say it’s getting better and I wouldn’t say its necessarily getting worse either, but there are some variations. For example, it’s happening in other places where it previously wasn’t as bad. You are always going to have the same seven of the top ten places: Mexico, Honduras, Nigeria, Afghanistan, Pakistan, Philippines, and Brazil. They are always going to be in the top ten of all the ratings, but where they are ranked depends on with whom you speak.
One of the difficulties of K&R (kidnapping and ransom) is that a lot of cases go unreported or are underreported, making it harder to determine where it is dangerous and where it is not. Additionally, the definition of kidnapping itself varies from country to country. In Indonesia, you can get kidnapped by a taxi driver—you get inside a taxi, they kidnap you, take you outside the city, strip you of your belongings, and release you. In Indonesia, they report it as just a robbery, where in other countries they would say, “Yes, you were kidnapped. You were physically taken away for X number of time. That’s kidnapping.”
Most of us in the industry refer to kidnapping as someone taking you away and calling a third person for a ransom versus taking you to an ATM, emptying your account, and releasing you. In that case, you were kidnapped, but there was no ransom involved. Kidnap for ransom is the most sophisticated crime because, from a criminal standpoint, you have to grab the guy, take him to a safe house, and get a third person to do negotiations. It has a greater degree of exposure, a greater degree of getting caught, and it requires a greater degree of criminal sophistication. The number of these cases goes up and down in many countries. In some areas, it has gotten more pervasive. It works really well in areas where police are either corrupt or undertrained. By corrupt, I mean they might be involved in some criminal activities. Undertrained means they just don’t have the budget or proper training for investigations. It also works well in areas where there is large income inequality between the have’s and the have not’s.
In another development, people who use social media can unwittingly give potential kidnappers important information about themselves—information that previously would have been very difficult to obtain. You’re seeing kidnappings in First World countries. It has happened in England, France, and Germany. There have been a couple of high-profile cases in Germany in the past couple of months, whereas before there were very, very few.
TCB: What is the nexus to social media on that? Is it that criminals are trying to find out when people are traveling?
FQ: Social media helps to gather more information on suspected targets. You find out that a guy just posted a picture of his son in Dubai. You think, “He’s got money. Nobody goes to Dubai just for vacation if they don’t have any money.” Or a person just posted that he’s doing humanitarian aid in Africa. I don’t know how much money he has, but I know a plane ticket to Africa is going to cost at least a couple thousands dollars, so they’re going to have at least a lot of easy, quick cash. It basically facilitates information to distinguish between the values of targets.
TCB: Can you give us a little insight into the negotiation process and how that unfolds typically, if there is a typical scenario?
FQ: There’s a basic methodology, but as the military always says, a well-written battle plan works until the first bullet gets fired. That’s why it’s called a crisis management plan. I’ve had cases where some of the victim’s family members were experts in merger and acquisition negotiation, and they thought they could handle it until they couldn’t, so they called me.
You have to start with the premise that you are not dealing with a rational actor. The kidnapper is not rational—he could be a good businessman or he could be a psychotic criminal who doesn’t care about life regardless of whether you pay. The initial process starts in trying to determine who the kidnappers are based on their demands, voice, accent, and vocabulary. You start to build a profile of who the kidnappers are and the demand. Unfortunately, there are a lot of people in the field that always negotiate to a preset amount of the ransom. That’s probably the worst thing you can do because, a lot of times, you cannot do anything but give them 100 percent of what they are asking. That’s where you consider, “What are they asking and what’s the value of the target? And what’s the known value of the target that the kidnappers already have?”
For example, let’s say I kidnap someone who I know is related to a famous movie star. If I ask them for $20,000, I expect $20,000 to get paid right away. If they try to negotiate down, that is an insult. Conversely, if I kidnap someone who is very well dressed and ask for $10 million, he can be worth $100 or he can be worth $1. I don’t know, but I start high and see what they come back with before bringing it down. As the third party, you have to figure out what information they know about you ahead of time so you know at what value to begin the negotiations. Once you determine that value, then you start the negotiation process and start setting the logistics in place. Once you reach a final agreement, set up the delivery and bring the victim back.
TCB: There is a lot of debate as to whether paying ransom exacerbates the problem in the long term. In your opinion, does paying ransoms encourage more kidnappings?
FQ: Our government says, “If you kidnap one of our guys, we’re not going to pay.” It works well if you’re a government official and you can enforce that. But as the government, when there is a private citizen kidnapped, how can you tell a family member: “We’re not going to let you do whatever it takes on your own efforts to bring that family member back”? I know of no government official that, once he leaves office and I ask him, “If your son gets kidnapped right now, if someone calls you out of Brazil, Mexico, or Germany, and they want $50,000—are you going to pay that money or not?” I do not think any family member, whether he was in government or not, is going to say, “No, you cannot pay that.”
Does it encourage more kidnappings? Not necessarily. I think some criminal groups are going to kidnap regardless. They will kidnap for money, but they will also kidnap for political reasons, so kidnappings will continue. Whether they’re going to get money out of it or political power is secondary. Does it increase their financing? Yes, it does increase their financing, but no terrorist organization or criminal group is going to survive just off kidnapping alone.
TCB: What advice would you give for individuals in companies operating in high-threat places like Mexico? For example, for companies that are new to this type of market, what are the types of things they can do to mitigate this threat?
FQ: First, become familiar with the environment in which you are going to operate. Companies going to any part of the world understand the risk and take the proper conditions to mitigate them. In places like Mexico, for example, there are companies that are still going down there despite the insecurity issues. They’re just shifting the locations they’re going into. Even within a city, some parts are safer than others. Understanding what the local risks are will help you implement the proper security measures.
You also have to be careful about being over-fanatical or over-reactive. Let’s say someone tells you that Mexico is very dangerous and you need armored vehicles and armed guys. If you have too much security around you, that draws too much unnecessary attention, and in that environment—a drug cartel area—no matter what kind of security you have, it will not be enough to offset organized crime activity. Sometimes the security you put in has to be very good, but low profile. Understand the risks but do not overreact because that could be counterproductive.
TCB: What are your thoughts on the outlook of Mexico? Do you see it getting better or worse? What are you thoughts on the PEMEX developments and foreign oil companies entering that market?
FQ: Within the country as a whole, there are some areas that have improved dramatically and are really safe. There are other areas that have deteriorated. I think the country as a whole has been stable—it has the same security challenges as before.
Looking at PEMEX, the whole northeast region of Mexico is where the big interest is. That part of Mexico has not improved; it has actually deteriorated in many ways. As far as investments, that is probably one of the highest risk areas, but it is also an area that has a lot of opportunities. The challenge is going to be putting together the proper insurance and security package that is not just guys on the ground, but a whole risk management package that encompasses more. Other parts of Mexico are doing really well, and security-wise are not that dangerous. Political-wise, it’s a bit of a challenge in other areas. By political, I mean student movements, protests, trade unions, and riots. That type of stuff that doesn’t affect security per se, but affects other areas of logistics.
TCB: How has the K&R business changed over time? Is it fundamentally the same business as it was ten years ago, or has the threat been evolving?
FQ: When you talk about the K&R business on the private side, for example K&R negotiators, there are not very many negotiators out there that make a living on K&R if they are not tied to an insurance company. If you go through all the security White Pages just between the U.S. and UK companies alone, a lot of them claim to do K&R, but they might do one case a year if they are lucky. Companies that do not only K&R, but crisis response, are all closely tied to the insurance industry and there are only a couple of dozen companies that have those types of contracts.
We are seeing a lot of shifts in the market, both in security companies and in the insurance industry as well—some are being bought out and consolidated. So, there is a little bit of a shift going on. It’s a very profitable business, and it is a business that is growing. A lot of companies that decided one day to go out and invest in developing countries realized that kidnapping is a bigger risk in some countries than in others, and having K&R insurance is actually not that expensive, so they’re investing more. From a business standpoint for insurance companies, it is a growing market, but the challenge with that is providing the response services, and again, there are only a handful of security companies that can do this well.
