Annual report for the Scottish Business Resilience Centre by Prettybright Ltd

Annual Report 2015/2016

Cyber and e-Crime Anti-Illicit Trade Group Serious Organised Crime Secure Transport and DIPS Retail and Tourism Financial Resilience Group Adults at Risk of Financial Harm Best Bar None Scotland Safer Areas Can Do Places Metal Theft

About Us

SBRC Board

Chief Executive’s Report

Chairman’s Report

20th Anniversary Timeline

Cyber and e-Crime

Serious Organised Crime

Anti-Illicit Trade Group

Adults at Risk of Financial Harm

Financial Resilience Group

Metal Theft

Safer Areas

Retail and Tourism

Can Do Places

Best Bar None

Secure Transport and DIPS

Membership and Marketing

Deputy Chief Executive – The Vision for the Future

3 2

SBRC Annual Report 2015/2016 | Protecting Scotland, its businesses and their customers

About Us The Scottish Business Resilience Centre is a unique organisation comprising contributions and secondments from Police Scotland, Scottish Government, Scottish Fire and Rescue Service, major banks, industries, investors and private membership.

The SBRC Board Our objective is to create a secure Scotland for business to flourish in; a safe environment where businesses can trade and prosper securely, regardless of size and sector. This encompasses everything from premises and employee safety to cyber security. We support businesses of all sizes and have a special interest in protecting the needs and interests of small and medium-sized businesses.

We provide our members and business across Scotland with a wide ranging one stop shop for business security services and commercially enabling advice. We have established ourselves as a hub of innovation and business improvement in support of our partners and the business community.

The Scottish Business Resilience Centre is very fortunate to have a Board comprising key personnel from a multitude of sectors who provide a wealth of knowledge and experience, and whose guidance ensures that the Centre continues to grow and evolve. We take this opportunity to thank Brian Gibson, Ken Milliken and Marion Venman for their service as they step down from the Board. We welcome Douglas Barnett, David Doran and SBRC Deputy CEO, Ronald Megaughin. List of Board Members Alasdair MacFarlane, Chairman, Royal Bank of Scotland Mandy Haeburn-Little, CEO, Scottish Business Resilience Centre Ronald Megaughin, Deputy CEO, Scottish Business Resilience Centre Mark Baird, Head of Alcohol in Society, Diageo Douglas Barnett, Head of Customer Risk Management, AXA Insurance David Doran, Director, UK Corporate Security, Scottish Power John Fallen, Site Manufacturing Leader, William Grant and Sons Limited and Chairman of Secure Transport and DIPS

Russel Kerr, Director, SecuriGroup Ruaraidh Nicolson, Deputy Chief Constable, Police Scotland Derek Penman, Her Majesty’s Inspector of Constabulary in Scotland Lewis Ramsay, Director of Response and Resilience, Assistant Chief Officer, Scottish Fire & Rescue Service, representing the Chief Fire Officers Association Gordon Robertson, Director of Communications, Edinburgh Airport Gillian Russell, Director for Safer Communities, Scottish Government Kenneth Russell, Sales & Marketing Director, John G Russell (Transport) Limited 5

SBRC Annual Report 2015/2016 | Protecting Scotland, its businesses and their customers

Mandy Haeburn-Little

Chief Executive’s Report

Chairman’s Report

This year has been another of significant change for our membership, particularly so as it has played out against the debate and outcomes of Brexit. Inevitably, also within that time, there has been further public sector reform and there are still very few areas of business in Scotland that remain unchallenged in traction and growth against the wider environment.

I have now been Chair of the SBRC for three years and I’d reflect that this has been the Centre’s strongest year yet in terms of outcomes and new relationships. The Board is very conscious of the importance of collaboration with our excellent partners, and is committed to continuing to strengthen and broaden these relationships.

We are always indebted to the many business partners, from right across the business community, who have supported us and continued to work with us to define services, provide advice, create events and offer their support in making Scotland a safer and more resilient community. May I take this opportunity to thank you individually for your support. If I may in particular draw out our close relationship with Police Scotland who have been such excellent and consistent partners and also the different teams within the Scottish Government whose support has enabled us to develop new and unique services and opportunities. SBRC has seen very strong growth this year. It has been a time again to reflect and review our work streams and consider how these can remain most relevant to the changing needs of business whether this be in the voluntary, public, private or academic sectors. The report before you lays out what has been achieved under these main work streams. During this period we have also seen the design of our new resilience assessment tool for business and,

as I write, we are looking forward to its imminent launch. There are so many examples of achievement and partnership that have taken place over the past twelve months and I hope that you enjoy reading of our progress. As you might expect, the work that we are engaged in, on the cyber side, continues to develop at great pace as we all depend more and more on transacting safely and confidently online. We are always so glad to have feedback on our progress and to receive suggestions on what we can do better, so please do contact me if there is something that you would like to raise. In closing, I would like to pay tribute to our team who, though small in number, deliver so very much. Their dedication, ideas and energy have been so high again this year and within that I include the very welcome secondments, expert hacking students, and short-term positions that have taken place across the year. I would also like to pay formal tribute to my previous Deputy Director Brian Gibson from Police Scotland who supported the Centre throughout much of last year and who made such a great contribution to us. Brian’s role has now passed to Ronnie Megaughin who already had a strong relationship with the Centre. Within a short space of time Ronnie has brought new thinking to us and I have asked him to lead the Vision for the Future report at the end of this document.

Alasdair MacFarlane

I would echo Mandy’s introduction by adding my thanks to our SBRC Board for their commitment and enthusiasm. During the year we have had the pleasure of seeing the model for our cyber work stream develop further in London (the London Digital Security Centre) and have seen our own relationships grow, including future links that will bring benefit to Scotland, including with Europol. It has been a very full calendar of activity again and none of the events the Centre organises would be possible without the input and support of our partners and

members. There are many highlights this year including: holding the largest and most successful Best Bar None Awards; the extremely well received Anti-Illicit Trade event in Glasgow City Chambers and George Square; our Cyber Conference with excellent support from partners and also another Metal Theft event. In addition, the Centre ran a very substantial Outreach Programme including the Islands, introduced more cyber security services and produced the first Business Resilience App for Scotland. We also reviewed the work that had previously been undertaken under Safer Areas and rationalised and balanced what we are doing to avoid duplication with others in the same sectors. We continue to embrace collaboration and the excellent activity under our new Ten Step Plan for Business Resilience which will be the next step in providing genuinely accessible, unique and effective solutions for business across Scotland.

May I thank you again for your support for the Centre and take this opportunity to wish your business every success.

7 6

SBRC Annual Report 2015/2016 | Protecting Scotland, its businesses and their customers

SBRC 20th Anniversary Timeline

LO ity

ta gi

di re nt

Cyber and e-Crime Last year we reported considerable growth in this work stream and it continues to be our busiest. During this year I have continued to Chair the Cyber Strategy Group taking over from Detective Superintendent Stevie Wilson as he headed for his new pivotal role as Head of Business at the European Cybercrime Centre at Europol. I mention this relationship at the beginning of my report as undoubtedly our links to Europe and beyond will only strengthen as we develop further. There are different facets to the work that we provide under the Cyber work stream and I have broken the following commentary down into the activity undertaken with the Scottish Government; our separate services with our expert ethical hacking students for business; our project work and our activity with Police Scotland. In this work stream there are many, many partners to whom we are indebted for their close working and these include the NCC Group, Microsoft, ID Cyber, Trend Micro, the banking sector, many different elements of academia, Scottish Enterprise, Digital Scotland, Skills Development Scotland and a whole suite of excellent technical and digital companies. Under the guidance of Scottish Government, I was delighted to launch Scotland’s Cyber Resilience Strategy with the First Minister and Deputy First Minister at the National Economic Forum, on behalf of the business community. This has given us such a strong platform on which to build capacity around the nine areas that business requested be considered and acted on.

Since then there have been five work streams defined which will report back on activity to the Deputy First Minister, these are Communications, Research, Business Enablement, Public Sector and Skills. SBRC are delighted to have been asked to lead the Business Enablement Group. Also with partners in Scottish Government during this time there were two pieces of work undertaken with academic partners, both of which have considerably wider long-term implications. The first of these was the design and development of the Cyber Crime reporting app which was developed through two groups of students at Glasgow Caledonian University. The app was designed for android and then rewritten for a wider platform and has the potential to provide tagged or requested information on types of cyber information, to act as a jargon buster on cyber terminology and to create an online community with the same interests. The app has now been designed and populated and it is hoped it can be trialled this coming year. The second piece of work was research undertaken by the University of Glasgow on why apparently small to medium-sized businesses are not acting on the plethora of cyber security advice available to them. This research was of interest to the media and showed that actually 85% of those companies interviewed are aware that they are a potential target. It also showed that they valued their data and that of clients very highly but were still doing little to protect this. This information has been very helpful to us all and to colleagues at Scottish Government considering what themes to address through the Communications Subgroup mentioned above. Separate to the work with Scottish Government, we have continued to work with the ethical hacking student community at Abertay University in offering direct services

to the business community. As one year graduates, so the course broadens, and new students come in and of course this applies to many other excellent Universities also. Our direct services to the business community broadened to nine services during the year and the number of requests received for presentations, surgeries and roadshows has grown exponentially. We delivered roadshows right across Scotland and often worked directly with partners including the National Federation of Self Employed & Small Businesses, and the local Chambers of Commerce. This year we have had more requests than ever before, and this requires dedicated management, to make sure these are all resourced and materials and guidance produced for each of them. A key part of working with the many companies represented on the Cyber Strategy workstream has been holding an annual conference. This year this was on the theme of Trading Securely and our close partner NCC Group assisted with this as did Trend Micro, Security Circle and Rosberg. We were very pleased with the level of interest this brought amongst the media and would like again to thank these core supporters. Amongst a magnificent mix of speakers, we were also able to bring a drone to the event and although not in flight, some of the potential of a drone was demonstrated very clearly.

I have already mentioned three Universities and we were pleased to work also very closely with Edinburgh Napier University during the year and with partners at the Cyber Academy. We see clearly the opportunity to continue to generate offering and collaboration with the university sector. On project work, we work obviously in some sensitive areas under this work stream and it has been a great privilege to collaborate with other partners and to respond to those in need of confidential assistance. We are part of a wider community that supports the trusted platform that CiSP provides and were delighted to be involved in the launch of the Scottish arm of this, SCiNET. In addition, we continue with partners to push ahead with the promotion of the Cyber Essentials standard, particularly for small and medium-sized companies and are actively involved in discussions about how we might produce a cyber insurance product in Scotland for this market. Finally, I must pay tribute to the many different levels of collaboration with Police Scotland that we enjoy in this area. Their partnership ethos has been impeccable in this and many other areas.

11 10

SBRC Annual Report 2015/2016 | Protecting Scotland, its businesses and their customers

Serious Organised Crime SBRC sits on the Serious Organised Crime Taskforce and on the Environmental Crime Taskforce. SBRC has continued to work closely with partner agencies, including Police Scotland, private industry and educational establishments to identify new crime trends and practices, and to support businesses to avoid becoming the victim of crime groups. Whilst working in partnership and supporting businesses across Scotland, we have reduced the impact these threats present to the business community. This has been achieved by raising awareness of scams and tactics used by crime groups to target the business world and giving relevant advice to enable companies to become more resilient. By introducing innovative new measures to counter the dangers of organised crime and working closely with industry, our intention is to significantly reduce the risk to many small and medium-sized enterprises. Significant progress has been made in raising the profile of human trafficking and how it has impacted on the business community. It has been identified that the railway network has been an area that has been utilised to transport people who are victims of human trafficking. The SBRC has engaged with several partnerships to raise awareness of human trafficking and modern day slavery. This has included an input at the Anti-Illicit Trade Summit, titled ‘The Real McCoy’ that took place in May of this year and, subsequently, a joint national awareness campaign is being planned for later in the year.

SBRC has been able to reach out to landlords, trade groups, legal institutions, serviced apartment holders and hotels through social media, print and television. In response businesses have recognised the indicators associated with trafficking and have reported suspicious behaviour in the hope of reducing this activity. SBRC also welcomed the National Pawnbrokers Association (NPA) to its ranks, with some very exciting work carried out ensuring that NPA members are resilient to attacks from fraud and other financial crime. SBRC developed an information sharing platform specifically for the use of jewellers within Edinburgh City Centre, titled ‘Goldwatch’. Work will continue to identify other business areas that would benefit from a similar information sharing platform. Looking ahead, this year has also seen SBRC become accredited in the delivery of training to support Project Griffin 2, the UK Government’s initiative advising on security and counter-terrorism issues. This will support Police Scotland in delivering Project Griffin across the nation. Also during the year, Cyber has been one of the themes discussed under the heading of Serious Organised Crime, and this aspect will continue to develop further.

13 12

SBRC Annual Report 2015/2016 | Protecting Scotland, its businesses and their customers

Guest Speakers at ‘The Real McCoy’ event, Glasgow.

Anti-Illicit Trade Group The SBRC continues to participate fully in the Scottish Anti-Illicit Trade Group with a focus on the ongoing illicit and counterfeit trade. This year was a very significant one with the second Anti-Illicit Trade Summit coming to Glasgow, supported by our close partners Underwriter Laboratories (UL). We are very grateful to the many partners who enabled this to happen, including Glasgow City Council.

recent shocking examples of the extreme harm caused by counterfeit products, medicines and cosmetics. Also for the first time, a case study was shown focussing on counterfeiting in the Scottish fishing sector. We are looking forward to talking further with UL about raising awareness across Scotland, and linking in to their significant cyber experience and knowledge.

The event this year titled ‘The Real McCoy’ was a strong blend of public awareness activity, expert speakers and contributions. In terms of public awareness we were able to establish an open air public market, with stalls showing the breadth and also the harm that can be caused by the many counterfeit goods available, sadly often purchased online.

The Anti-Illicit Trade Group will continue to highlight the dangers of purchasing and using counterfeit products and raise awareness that this funds serious organised crime groups and terrorism. This will be achieved through our partners, stakeholders, members, social media and press.

The conference itself, with a truly outstanding suite of speakers, highlighted some of the most

This year, to raise awareness amongst children and young people, the Disney DVD ‘Honest and

Real’ which was kindly sponsored by UL, was placed in the majority of schools across Scotland to highlight illicit and counterfeit trade and teach children to become good citizens. East Dunbartonshire was the first area to utilise this within their primary schools. We are currently awaiting confirmation from Disney to allow this to be placed on the GLOW website to be freely available to more youth organisations. This education strategy has been expanded across the country and has included presentations to the Police Scotland Youth Volunteers (PSYV) and special constables. The PSYV were utilised at ‘The Real McCoy’ event and it is hoped they will become mentors and continue to educate their peers. Moving forward, it has been identified that there is a requirement to form a Subgroup of the

Anti-Illicit Trade Group. This will focus on enforcement and development of best working practices to be shared across the different agencies. This Subgroup is in the process of being formed. Due to the success of the partnerships within the Anti-Illicit Trade Group working together, this has had a very positive effect enabling the group to report more cases to the Procurator Fiscal, involving traders who were engaging in the illicit and counterfeit goods trade, particularly within the Barra’s Market in Glasgow. It has also become clear that more effort is required to try and stop this type of activity on the internet. Police Scotland, Scottish Fire and Rescue Service and partners such as UL and the AntiIllicit Trade Group, will continue to work together to establish emerging trends and criminal activities.

15 14

SBRC Annual Report 2015/2016 | Protecting Scotland, its businesses and their customers

Adults at Risk of Financial Harm During 2015/16 the Centre has continued to play a pivotal role in, and has contributed significantly to, the work of the National Financial Harm Co-ordination Group involving Financial Services, the Office of the Public Guardian, Trading Standards, Local Authorities, Adult Protection Committees, Social Services, Scottish Government (Mental Health Division), Police Scotland and third sector organisations such as Alzheimer’s Scotland and Age Scotland.

The Centre continues to work closely with several local authority adult protection committees to provide communication channels and business engagement with financial services locally. We have delivered numerous presentations to local authority conferences and events in support of adult protection committees and participated in planning groups for such events.

We have delivered many and varied presentations to a diverse range of organisations, all with a view to creating awareness of financial harm, promoting collaboration, enabling businesses to better understand their customers and providing staff with the tools necessary to manage what can be a very delicate and sensitive issue. Training and awareness has been delivered to the Trading Standards Institute, Banks, Pension Companies, Local Authorities, Credit Unions and many other stakeholder organisations.

Conduct Authority (both UK and beyond), British Bankers Association and a number of Credit Union bodies.

Working with several Retail Banks and Pension Companies we have engaged in the proactive development of a single process for the sharing of information between statutory public sector agencies and Banks, ensuring optimum levels of communication between people and organisations to support the most vulnerable members of communities and those who are at greatest risk of financial harm. It is anticipated that the process will be fully operational by the end of 2016. This means that for the first time there will be a consistent, effective and widely understood process for sharing financial information under the terms of the Adult Support & Protection (Scotland) Act, 2007.

A key aspect of developing collaboration and improved information sharing has been to keep the various regulators and trade bodies updated and informed on progress. To that end we have provided personal briefings to the Information Commissioner, the Financial

Much progress has been made over the last three years to enable businesses to serve their vulnerable customers in the most appropriate way and to prevent them from being financially exploited, however, a great deal remains to be done before we can be confident that people are as safe as possible. While finance is clearly a reserved matter for the UK Government there can be no doubt that financial harm that affects communities and individuals in Scotland is a devolved matter. The variation in responsibilities means continually making sure everyone is updated and the Centre has contributed hugely in this area.

17 16

SBRC Annual Report 2015/2016 | Protecting Scotland, its businesses and their customers

Financial Resilience Group As our other work streams have developed or been reviewed, this work stream has seen new links and opportunities emerge in how it relates to our other activity. For example, cyber plays an increasingly important role as more and more banking services are digitalised and as mobile access to bank accounts and records becomes commonplace for many people.

Police College. A total of 18 Senior Police Investigating Officers and 25 bank officials representing five banks jointly exercised in incident response.

A significant piece of work was carried out during 2016 to review the strategic direction of this group. As part of this, a Bank Support Group was established to enable financial services organisations to understand and articulate issues relating to vulnerable customers. The group also provided a forum for engagement with public services e.g. Police Scotland, Social Services, the Office of the Public Guardian, and Trading Standards. The main outcomes from the group were greater inter-bank discussion, heightened awareness about servicing the needs of vulnerable customers and increased collaboration with public sector agencies with statutory responsibilities.

Work continues with banks, other financial sector organisations and SMEs to, firstly, bring

Anti-money laundering is a key aspect of financial services governance and compliance. The SBRC has delivered training to over 100 Credit Union staff and volunteers representing 35 Credit Unions in Scotland. Much more requires to be done in this area to ensure maximum awareness of legal/regulatory responsibilities and for action to be taken around suspicious transactions. Also, conscious of the ever changing external environment in which we all live and work, two Tiger Kidnap scenario exercises were held at the Hydra Unit within the Scottish

The voluntary sector continues to play a vital role in many aspects of what we do and SBRC has continued to develop working relationships with both the Grameen Foundation in Scotland and Social Enterprise Scotland to develop the best possible resilience advice for very small business start-ups. We are also of course very involved in the work of Can Do Places.

them closer to public sector functions for the purpose of enhancing community safety and, secondly, to provide them with the necessary resilience support for their business customers so that lending and other financial risks are mitigated. To that end the SBRC has regular liaison with the National Fraud Intelligence Bureau, CIFAS and the British Bankers Association to ensure that intelligence and alerts around fraudulent activity and ATM crime are monitored and communications are sent out when there are specific threats in Scotland. The SBRC has participated in a number of bank customer seminars and workshops to provide support in relation to fraud prevention and cyber security. SBRC and the Scottish Government Resilience Team have continued to engage on a monthly basis with business continuity personnel at banks to update them on emerging disruption threats, mainly in relation to weather and any strategic issues around the critical infrastructure. This process is now well established and enables banks to review their contingencies and continuity plans on a regular basis, making adjustments where necessary.

The Credit Union Group has met on regular occasions to discuss and resolve common issues around anti-money laundering protection processes, fraud prevention and wider threats that could potentially affect business as usual. Specifically the group created, designed and published a selfassessment process for Credit Union Directors and Managers. The process allows directors to identify areas of weakness both in their own knowledge and within their organisations, enabling them to take corrective action. The Credit Union Group now comprises four of the largest unions in Scotland representing approximately 70,000 Credit Union members who currently have savings and loans.

Further training has been delivered in the following areas; • SBRC has provided expert support and guidance in terms of live incidents involving fraud and cyber attacks – providing direct links with appropriate law enforcement agencies and assisting with compilation of evidential material for investigators.

• Working with Police Scotland we developed a case study from a successful major money laundering (cuckoo smurfing) prosecution, and a training package was delivered to over 300 financial services personnel (UK wide) via Chartered Bankers Institute and individual banks. • Fraud prevention training was provided to Bank, Corporate and Commercial clients. This was led by SBRC and involved Police Scotland Economic Crime Unit and SBRC Ethical Hackers. • We continue liaison and collaboration with financial regulators, the British Bankers Association, CIFAS and the National Fraud Intelligence Bureau to ensure that Scottish activity is recognised and recipients of training, and awareness raising activity are best informed.

19 18

SBRC Annual Report 2015/2016 | Protecting Scotland, its businesses and their customers

Metal Theft The Metal Theft Subgroup and Metal Theft work stream sit separately under what was our Safer Places work stream. We are grateful to British Transport Police’s ongoing chairing of this group under the guidance of John McBride, Chief Superintendent and Lead for Metal Theft in Scotland. In addition, this was the third year that, with partners, we delivered Scotland’s Metal Theft Summit. The activities of those involved in metal related crimes can have a significant socioeconomic effect on the security and safety of all of us. Whether the thefts are from our transport network, utility companies, schools or historical buildings we will continue to work with our partners to prevent these types of thefts occurring. Although we have seen a significant reduction in the number of metal related crimes and some positive results against organised crime gangs, we are only too aware of the impact this type of crime has on the Scottish economy. In the last 12 months, the SBRC delivered over 20 presentations to businesses and enforcement agencies. The presentations were to raise awareness of Metal Theft, and included information on its impact on both the economy and infrastructure, ensured that the Metal Industry was aware of how the new legislation would impact their business, and provided advice on how Metal Theft can be prevented. Audiences attending these events were made up of both private and public sector organisations including insurance companies, utility providers, emergency services and private companies. Presentations were also delivered to the Community Safety course that is run at the

Police College, Tulliallan. Over 420 people attended the 20 presentations. The main Metal Theft activity was delivered across Scotland under ‘Operation Scandium’. The SBRC has attended all days of action that have taken place under this operation. These days of action are designed to reduce metal related crimes and develop an intelligence picture of activity across Scotland focusing on non-compliant dealers. To date there have been over 18 pro-active days of action covering all the Police Scotland divisions. Over 3171 vehicles have been stopped and 854 offences recorded. Partners attending these events are British Transport Police (BTP), Police Scotland (PS), the Scottish Environment Protection Agency (SEPA), Department of Work and Pensions (DWP), HM Revenue & Customs (HMRC), and the Driver & Vehicle Standards Agency (DVSA). ‘Operation Scandium’ will run until the end of November 2016 and SBRC will continue to support these events. Another arm of ‘Operation Scandium’ is raising awareness of the changes to the Metal Theft Legislation that came into force as of 1st September 2016. Under Phase 1 every scrap metal dealer in Scotland was visited, RAG assessed and advised of the proposed changes in December 2015. In March 2016 these dealers were visited again in Phase 2 to ensure that they are up to speed on the new local authority licencing protocols and we will look at any problems they are having. There are over 140 dealers in Scotland. On Tuesday the 23rd of February 2016, SBRC hosted the annual Metal Theft Summit at the Scottish Fire and Rescue National Training Centre in Glasgow. The focus of the Summit this year was to raise awareness among the delegates of the impending changes and the impact that it may have on their businesses regarding the new SBRC Annual Report 2015/2016 | Protecting Scotland, its businesses and their customers

SBRC Annual Report 2015/2016 | Protecting Scotland, its businesses and their customers

Metal Theft (continued) scrap metal legislation. Presentations on the day included inputs from the Scottish Fire and Rescue Service (SFRS), AXA Insurance, SP ENERGY NETWORKS, BTP, ONIS Consulting, SEPA and PS. The Summit also highlighted the excellent work which has been carried out through ‘Operation Scandium’. Over 80 delegates attended the all-day event. SBRC has participated in several interviews on the subject of Metal Theft. These included interviews for STV News at Six, BBC News, BBC Radio 2 and BBC Radio Scotland. In addition, SBRC has taken the lead on the media campaign to raise awareness of the new legislation and the impact it will have on the dealers and the itinerant dealers. In partnership with BTP, PS, SEPA and The British Metal Recycling Association (BMRA) the SBRC has developed the ‘no cash for scrap’ posters (posters contain all the guidance from Scottish Government relating to the new legislation) and flyers. This material will be delivered to all Scrap Dealers in Scotland when BTP are carrying out Phase 2 of their visits. BMRA will also mail drop all their members within a fifty mile radius south of the border. We will also hand this information out to the relevant persons when taking part in ‘Operation Scandium’ or any other days of action. We will strengthen the campaign nearer the changes in September. Over the year we have also assisted Police Scotland on days of action under ‘Operation Monarda’, ‘Operation Mermaid’ and ‘Operation Rouge’. Over 19 of these operations were attended by SBRC staff, to provide an advisory role in Metal Theft Legislation (current legislation and new legislation as of September 2016). Over 1800 vehicles have been stopped and various offences detected. SBRC pro-actively participated in ‘Operation Fuga’. This was a Police Scotland operation, funded through the Scandium budget, within

Ayrshire designed to target the increasing theft of live overhead cables, within a 24 day period there were 21 thefts resulting in power outage to local properties. One of the incidents resulted in Scottish Fire and Rescue Service personnel attending a private dwelling after the power sockets melted as a result of a power surge. As a result of the work carried out during ‘Operation Fuga’ four individuals were apprehended and faced prosecution for the theft of overhead cables. Since these arrests this type of incident within Ayrshire has all but ceased. We are also currently looking at the illegal industrial flytipping of tyres in conjunction with SEPA and SFRS and are also involved with SEPA in regards to setting up the National Register that will hold all the relevant licensing details for the scrap industry after the new legislation comes into force. Over 70 site visits were carried out as a result of cable burning, stripping and theft of material taking place. This unfortunately also involved one fatality (lead theft) and three individuals seriously burned (theft from electrical substation). We continue to facilitate the Metal Theft Scotland Working Group. Jim Scott, Metal Theft and Business Resilience Lead at the SBRC attends as Deputy Chair. This group sits every three months at various locations throughout Scotland and is attended by all the main utility companies, enforcement officers, Scottish Government and several private companies. The Metal Theft website is continually updated with news stories, events and case studies, and will provide a strong platform to share information regarding the changes to Metal Theft Legislation. The Centre also continues to produce and update the Metal Theft Toolkit for Business which is at present sponsored by Transport Scotland and SP ENERGY NETWORKS.

23 22

SBRC Annual Report 2015/2016 | Protecting Scotland, its businesses and their customers

Safer Areas During the year this work stream was also reviewed and refined in light of the sheer number of other agencies and organisations working in this field. Whilst SBRC will continue to provide advisory support, advice, and training to the many organisations trading across Scotland, we are determined not to duplicate where others are also fulfilling a role. The Safer Areas and the Retail work streams merged to ensure that we are meeting the challenging needs of both large businesses, and in particular, the SME market. The aim of this merged activity is to create towns and communities which are secure, vibrant and resilient, in line with the Scottish Government’s commitment to the revitalisation of town centres. Key areas include:-

• Safer Shopping • Safer Transportation Hubs

Deputy Chief Executive Ronnie Megaughin, who will say more about this activity at the end of this report.

• Safer Transport • Safer Premises • Intelligence Sharing Database • The Retail Working Groups • The Third Sector • Internet Resilience Training Database During the course of the past twelve months work has begun on a new and entirely unique product which will be available online to business across Scotland. We recognise that immediate access to advice is essential particularly for smaller companies and this will be the most meaningful and effective way of delivering this. As you would expect, this new activity, including the design of a bespoke product has taken a considerable amount of time and attention to detail, and this has very much been the creative genius of our new

During the past year, we continued to deliver a number of level crossing safety initiatives with British Transport Police, Police Scotland, Network Rail and ScotRail. These concentrate on professional drivers and others using level crossings and highlight the proper procedures which should be followed when crossing any railway line at these specific points thus ensuring the safety of railway users, drivers and pedestrians alike. SBRC are also currently working alongside British Transport Police, Ascension Trust, Network Rail, ScotRail, the Samaritans, Just Enough UK, and Police Scotland on a rail pastor programme. This initiative aims to enhance safety while reducing crime and anti-social behaviour to make our towns and cities safer and more enjoyable places to visit, live, and work. As part of the initiative, voluntary street pastors routinely patrol a number of our

towns and cities throughout Scotland to reassure the public and keep a wary eye on those who may find themselves in a vulnerable situation. The initiative is operating in the Falkirk and Fife Circle Railway line, including Edinburgh Waverley, as part of the ScotRail franchise Suicide Prevention Strategy. SBRC continued to work with the Scottish Grocers Federation to provide guidance and recommendations for their members. From our visits to various areas across Scotland with our colleagues from Scotland’s Towns Partnership, we have identified a number of towns and communities that would benefit from our support and we are now looking at how best to deliver this. Over the next 12 months, we will extend our reach further, with the delivery of Project Griffin 2, Counter Terrorism Awareness Training, which gives businesses an insight into what they should be prepared for in the event of a terrorist related incident.

25 24

SBRC Annual Report 2015/2016 | Protecting Scotland, its businesses and their customers

Can Do Places Retail and Tourism This area of work has merged with the Safer Areas work stream as mentioned previously. Work has continued to develop relationships with the Major Shopping Centre Hubs across Scotland. This collaboration has been mirrored by developing a close relationship with the Scottish Grocers Federation. There is a constant stream of intelligence and shared practice to enable our partners and members to make the right decisions about shoppers, consumers, visitors and travellers, ensuring they have a safe, secure and enjoyable experience. Secure intelligence sharing models and platforms for exchanges of information were introduced for shopping centres and shopping markets and training delivered further across the retail and tourist sectors. A number of sector specific initiatives were launched including ‘Goldwatch’ for jewellers rolled out in Edinburgh. The SBRC now facilitates the hosting of the Edinburgh and Glasgow Hotel Check-in websites. With almost 200 Central Belt hotels registered on the network we are able to coordinate the members to circulate real time criminal information which is having a positive impact on resilience across this vital economic sector.

Similarly we are also working with many large wholesale and retailers across Scotland to provide ‘Security Circle,’ an informationsharing platform that ensures that they too benefit from exchanging up to date data on criminal activity within this particular business sector. We will continue to develop this sharing platform as well as training and guidance on data protection law. This allows users to exchange data confident in the knowledge that they do so lawfully and in line with legislation. We anticipate carrying out much work in this area next year. The Retail working groups are developing well with quarterly meetings with key retail stakeholders held within North, East and West Police Scotland command areas, again securing that vital community link with Police Scotland. Stronger ties have been formed with Safer Communities and the Scottish Crime Division, based at the Scottish Crime Campus, reaping benefits for both the retailers and the division, whilst third sector organisations are now linking in on key areas such as vulnerable persons, staff training, and community support workers.

Scotland CAN DO is the Scottish Government’s shared statement of intent towards becoming a world-leading entrepreneurial and innovative nation: a CAN DO place for Business. Can Do Places is part of that programme, and although it is not delivered by SBRC, we are very close partners in enabling and protecting entrepreneurs and new-start businesses. By encouraging and growing resilient business we make Scotland a more attractive and safe place for people to live, work, study, invest and visit. Can Do Places is the rebranded name for the Can Do Towns Innovation Challenge, a programme delivered by Iain Scott of Can Do Scots and supported by the Scottish Government’s Can Do Framework. Can Do Places is designed to revitalise local economies by working with communities who want to breathe life into underused places and spaces; creating new opportunities for local employment, enterprise and job creation. These Can Do Spaces generate an income for the community group, create conditions for business and enterprise to flourish and make our communities safer and more resilient. The work of the SBRC Outreach Programme this last year, has been very closely aligned to the objectives of Can Do Places, providing free business resilience advice and guidance to the SME business sector throughout Scotland. The common aim of both Can Do Places and

the SBRC Outreach Programme is to create a more enterprising Scotland, where business can prosper in a safe and secure environment. Throughout 2015-16 Can Do Places developed its collaborative partnerships and worked closely with groups across Scotland to provide them with action learning materials to translate their vision into reality. This innovative approach has resulted in a suite of films and podcasts accessible to every business and community across Scotland. In April 2016 Can Do Places ran a national event for up to 100 participants representing groups across Scotland at ‘The Place Matters Enterprise Mash Up’ to progress activity and roll out more Can Do Places. The Can Do Places website has continued to provide a platform to house an online repository of films and interviews with Can Do Communities across Scotland, including the successful postcard series with Can Do Stories. The participants this year have been a wide and diverse group, united by a desire to do something to re-energise their towns. The programme is attracting recognition across Europe and beyond for its innovative approach to linking enterprise, business and communities. For more information visit us at www.candoplaces.org and on twitter @candoplaces

27 26

SBRC Annual Report 2015/2016 | Protecting Scotland, its businesses and their customers

Best Bar None Best Bar None (BBN) continues to be one of our busiest and most impactful work streams. Our thanks are due to funding partners DIAGEO, Molson Coors, HEINEKEN, Maxxium UK, Tennent’s and Chivas Bros. We are also indebted to the Scottish Licensed Trade Association (SLTA) who contribute to make such a collaborative and effective Board, and one which is uniquely positive to work with. Also very close partners in making this a success are Police Scotland, the Scottish Fire and Rescue Service and Local Coordinators who work so tirelessly to make our day and night time economy a truly great environment to socialise in. The work undertaken by the BBN Board this year has been considerable and we seek to raise consumer awareness of BBN as proof of enhanced customer care and a quality experience. Indigo PR continues to work with us on promoting the positives of BBN and there has been a good deal of media interest in our work this year. This has seen an increase in engagement by 1000% in the BBN social media profile. Best Bar None is one of the vehicles used to create awareness of the importance of protecting the vulnerable and making Scotland safer. Vulnerability and equality remain a core

theme as evidenced by the good practice we generate year on year through the annual awards process. In the last year work has begun on a unique film about vulnerability and awareness raising for staff who support our night time economy in Scotland. This will launch in August, and is titled “Good night out…?” The Board has also continued to promote and highlight innovation and good practice in BBN premises as a result of the changing culture in the licensed community where alternatives to alcohol and low alcohol products are key in adapting to commercial challenges; we are supported hugely by the SLTA who work closely with us to understand the trade perspective. The 6th National BBN Awards, Grand Central Hotel, Glasgow

This year we have also spent time promoting safety and health messages via BBN accredited venues as being the socially responsible venues of choice, and we will continue to pursue this means of communication. We now have 400 BBN premises accredited, with a further six new local schemes in development. At a more practical level, we have been working with Harper Stairmand Insurance Brokers to offer BBN accredited premises a saving of up to 20% on their insurance premium, based on risk reduction through our assessment process.

On Thursday 10th September 2015, the SBRC proudly hosted our first Pubwatch Summit at the National Galleries in Edinburgh. The event attracted delegates who had a keen interest in making the night time economy a safer environment for the people of Scotland.

Year on year we are evidencing increased engagement from Licensed Premises in Local Community Initiatives, encouraged by our Heart of the Community, Public Health and Innovation Awards, which motivate venues to develop social responsibility.

The 6th National BBN Awards took place at the Grand Central Hotel, Glasgow, on 24th March 2016. We welcomed 380 guests and 54 finalists from all across Scotland received an award in recognition of their status at a National level.

The training portfolio for Licensed Premises has also been further developed with the launch of ‘The Bar Code’, a guide for venues in how to deal with stages of intoxication, monitoring customer behaviours and offering key messaging around Duty of Care, which will form part of the “Good night out…?” project.

Best Bar None has also been embedded into Police Scotland’s Alcohol Strategy, and is used as a delivery mechanism for Police Officers across Scotland.

29 28

SBRC Annual Report 2015/2016 | Protecting Scotland, its businesses and their customers

Secure Transport and Distribution Industry Partnership Scotland (DIPS) Through the Distribution Industry Partnership Scotland (DIPS), the focus on the haulage industry and logistics sector has been an important part of the activities of SBRC. Over the last year significant change has taken place with the Centre now focussing on both freight and passenger transport through the Secure Transport Forum. John Fallen from William Grant & Sons currently chairs both groups and we are grateful to him for the time he devotes to the groups and the work of SBRC. We have been successful in having ratified the agreed protocol between DIPS members and Police Scotland for the investigation of incidents involving the theft of high value loads. The High Value Load Guidance

document makes clear the responsibilities of the companies, DIPS and the representatives of Police Scotland that are involved in the investigation and intelligence sharing associated with the incident. To assist with the collation of information and intelligence, an incident reporting proforma has been designed and introduced. This allows all companies to report incidents of all types in a standard format which can then be shared with other members and intelligence gathering organisations. The information then becomes available nationally and internationally when included in other analytical reports. Standardising these processes and procedures has helped to make reporting much easier and assisted with the collation of accurate statistics. DIPS continues to look at other business areas where high value, vulnerable loads are being transported and encourage these companies to join DIPS as a way of improving

their supply chain security and reducing risk. Initial discussions have taken place between SBRC and the Tobacco Manufacturers Association and the Medicines & Healthcare products Regulatory Agency who are involved in the regulation of the pharmaceutical and health product sector.

security of the passenger transport network. The terms of reference and objectives for the group have now been identified and the membership of the group continues to grow to ensure it has wide representation, and is able to discuss from a strong knowledge base, issues that affect the whole of Scotland.

DIPS have improved internal communications with regular information and intelligence bulletins and are looking to make better use of social media and their online presence for accessible information sharing.

Reaping the benefits of partnership working and collaboration remain high on the agenda for DIPS and the Secure Transport Forum. Opportunities for closer association with the Regional Transport Partnerships are being explored and closer links with other representative bodies such as the Road Haulage Association and Freight Transport Association are being pursued.

The provision of security advice to companies to assist in improving the security of premises and the supply chain has continued to develop. The self-assessment tools have been adopted by some organisations in other work streams who have transport elements to their businesses. The introduction of the Secure Transport Forum gives a focus for improvements to the

31 30

SBRC Annual Report 2015/2016 | Protecting Scotland, its businesses and their customers

Membership and Marketing – Listening to our Members Understanding, supporting and acting as an advocate for our members is at the heart of what we do. We strive to exceed the expectations of our members, through the unique level of advice, support and expertise available through the Centre. Working in partnership with, and on behalf of our members, we are uniquely placed to provide a range of business security services and advice, and also act as an advocate and independent voice for our members.

We continue to offer our extremely competitive and innovative cyber services to make sure that our members are kept fully up to date on this ever evolving area of risk. This year we have also seen the SBRC become accredited in the delivery of training to support Project Griffin 2, the UK Government’s initiative to advise and familiarise managers, security officers and employees of public and private sector organisations on security and counterterrorism issues. This training will be delivered to our members at no cost and we plan to deliver a series of national seminars over the coming months.

minimum disruption or abstraction to business operations. This is an exciting concept which we hope will play a real part in enabling business in Scotland to remain safe, secure and resilient.

In addition, the development of a ‘10 Steps to Resilience’ online self-assessment will enable businesses of all sizes to understand

As ever, our connection to a wide range of expert bodies, including Police Scotland and the Scottish Government, enables us not only to keep abreast of current and emerging threats, but to use our knowledge and contacts for the benefit of our members. There are many examples in the past year of the SBRC being consulted by small businesses to help them resolve issues related to physical security, fraud, cyber security or customer risks. As such, we remain completely focused on playing our part to ensure that businesses

risk through supported self-assessment, with advice on how risk can be addressed with

in Scotland are as resilient as they can possibly be.

Finally, 2016 is a special year for the Scottish Business Resilience Centre as it marks our 20th Anniversary and gives us the opportunity to both reflect on the successes of the last 20 years, and also focus on the future of SBRC as we continue to support our members.

SBRC Annual Report 2015/2016 | Protecting Scotland, its businesses and their customers 32

SBRC Annual Report 2015/2016 | Protecting Scotland, its businesses and their customers

Deputy Chief Executive – The Vision for the Future

Ronald Megaughin

I am immensely honoured to present this concluding part of our Annual Report, however before I offer a vision of the future; I too would like to take the opportunity to thank the SBRC team for their dedication, commitment and creativity over the last year. The very significant successes highlighted within the report are the result of strong productive partnerships, a supportive Board and motivational leadership. Looking forward, all these elements will continue to be critically important in the ongoing development of SBRC as a formidable force in supporting Scotland’s businesses to become more resilient. Over the last year we have rightly reviewed and refined our work stream structure to more accurately reflect the threats and risks faced by the business community. That process will continue over the coming months as we strive to increase our capacity and capability in light of those new risks. Cyber has been the fastest growing area of work for SBRC and I am convinced that will continue to grow at pace over the next year. Scotland needs a collaborative, structured and adequately resourced response to the growing threat, one which harnesses the exceptional talent within law enforcement, academia and the public and private sectors. SBRC will continue to lead the discussion on the creation of a Scottish Cyber Hub.

Within the next few months we will see the launch of a unique, all-encompassing online assessment tool titled ‘10 Steps to Resilience’ which will provide every business in Scotland, irrespective of size, with the opportunity to test their resilience and when vulnerabilities are identified to engage in a programme intended to mitigate those risks. This assessment tool is indicative of the innovation and creativity which will be the mainstay of the SBRC as we move forwards. To achieve that, I will ensure that current SBRC staff are offered structured development opportunities to ensure they remain at the cutting edge of knowledge and professional competency. I believe that the SBRC has never been in a stronger position to grow and further professionalise our work. We have extended our reach to deliver Project Griffin Counter Terrorism Awareness Training to the SME sector at a time when arguably the global threat has never been greater. We have increased the scope and scale of bespoke consultancy work with large scale industrial companies and iconic brands in Scotland assisting in the acquisition of credible accreditations. Our vision and supportive partnerships will see some of our work streams grow beyond any previous expectations over the coming year and we will continue to look for new and exciting opportunities to support the growing number of home-start businesses which are at the heart of economic growth.

The Scottish Business Resilience Centre would like to take this opportunity to gratefully acknowledge the continued support of our partners and members.

I look forward to what I personally believe will be a pivotal year in the advancement of the SBRC and I commit to providing the vision and clarity of leadership necessary to achieve the optimum outcomes.

35 34

SBRC Annual Report 2015/2016 | Protecting Scotland, its businesses and their customers

Scottish Business Resilience Centre Unit 10, Alpha Centre Stirling University Innovation Park Stirling FK9 4NF w: www.sbrcentre.co.uk e: enquiries@sbrcentre.co.uk t:

01786 447441 @SBRC_Scotland