Roger's Information Security Blog

So I had one of the oddest experiences I’ve had at work for a really long time.
I had a vendor coming in to do a pitch on their product. Originally they were going to do this online as a webdemo, but they realized they’d be in town so they might as well come by and do it in person. A couple months ago I got yelled at by security for bringing a foreign national by for a meeting without filling out some paperwork first. In that instance they let the person upstairs for the meeting. I wanted to do it right this time so I look on the company intranet for the proper procedures and find the Foreign National Visitor Form. It pretty much has 5 things. Their name, their nationality, their company, my signature and my directors signature. I turn the form into security and ask if that is everything they need. They respond that it is. I also provided date of visit and purpose of visit although there is not a place on the form for that.
My meeting was about 4 business days later. On the morning of the meeting, I get a phone call telling me they will have to have their passport xeroxed. First of all, it does not seem like a good practice to have people xeroxing identification papers. Second of all, its the morning of the meeting. Its too late to contact them and ask them to bring a passport. I had told them to bring ID such as a drivers license. At least of the people works locally and of course only brought a Virginia drivers license.
So security has a freaking cow because they dont have the correct identification. I was told they would not let them upstairs. To that I asked I could use a conference room on the first floor. Since outsiders are allowed in the cafeteria on the first floor, could I use a conference room on the first floor not in the secured area. Security responded that the conference room is in a controlled area. I asked how it could be in a controlled area when there is not a locked door separating it from the “public” areas of the building. They responded that I could meet in the cafeteria. The cafeteria is certainly a great place to meet with a vendor. I wonder if I could set up a projector and a screen in there. I’m seriously thinking about next time just hooking their computer up to the plasma screen in the lobby and using that for our meeting. I asked to speak with their Director in the hopes that he would allow us to meet in the conference room on the first floor which is in a non-secured portion of the building. That is when things began to get interesting.
Rather than listen to my concerns about the Foreign National Visitor process, or my experience in getting foreign nationals into the building in the past, the Director cut me off and repeatedly said I was not within policy. He would not answer my questions as to why I was not informed of a passport requirement before the morning of the meeting when I had turned in my visitation form the previous week. This Facilities Director basically called me a liar by denying events that I have experienced (having foreign nationals visit without this hassle), he then made up policy that is not recorded on the company intranet, and basically belittled me. Somehow he managed to do all this while making sure to only say things about how he wanted to help. It was a thing of beauty how he was able to humiliate me while at the same time verbally maintaining his desire to help. He put the cherry on top by sending out an email to me about how much he wanted to help. He certainly knows how to play the game of politics. If only he actually desired to help people with the same ardor. For people like this power is their aphrodisiac. And the wielding of it better than any sex they can have. The satisfaction that comes from crushing power games is still there even when wielded against people many pay grades below. This is a man to be pitied. For he is nothing if not a Dilbert cartoon character.
I understand that given the nature of the facility that we have requirements regarding foreign nationals. But policies need to make sense. I’m just trying to talk to a couple of vendors, not make a huge production number of it.
I still dont know exactly what a foreign national is. Is it a non-U.S. citizen? What if they have permanent residency or a work permit here? I guess I could have learned something if the Facilities Director didn’t have such a huge attitude problem. So now I’m supposed to attend a reeducation session with security. That was the trade off for getting my vendors into the building. Right. I dont think so. I cant wait to see what happens next. Will they lock out my badge (again)? Will they “write me up”. Will they try to yank my clearance (if I have one, you aren’t supposed to admit to having such)? Or perhaps they will merely slow walk the renewal process for it.
I thought about putting this in my personal blog. It would have less potential to cause trouble. I keep that one under password protection. But this issue directly relates to what we do in security. Make the security irrational and people are going to resist it. If you respond by protecting your sandbox and lashing out as this Director did in his passive aggressive way, you will find your kingdom despised. Sooner or later the important things you are trying to do will be trivialized, marginalized and ignored. Piss off enough people and you’ll be on the outside looking in.