Undoubtedly, the incident last week in Aurora, CO, is tragic. Any time a person feels the need to inflict pain and suffering onto others simply to assuage their own pain and suffering gives us pause, and in this case it certainly has raised many concerns. Unfortunately, much of what we are seeing and hearing in the mainstream media, from politicians, and from lobbyists the world over, is that this event is about guns and violent crime. Sadly, this is misplaced angst, and a diversion from the true issue at play: that a man in decline and distress, who clearly needed some form of mental healthcare support, somehow was left to his own wilds and allowed to reach the conclusion that the best way to deal with his situation was to shoot-up a theater of innocents.
What I find so disturbing from all the stories and vitriol post-incident is the furor over "gun control" and "gun rights," and the lack of furor over a clear lack of mental healthcare for this troubled person. People are eager to demand that the "right to bear arms" be recalled or grossly limited over this one incident, yet that argument ignores the true root cause, which was the mental and emotional state of the perpetrator. I submit to you that the only true positive take-away action here would be to improve funding for mental healthcare, eliminate the negative stigma attached to such treatment options, and in general seek a broad-sweeping cultural revolution that acknowledges that stress and personal suffering is normal, is ok, is part of life, and that we're not all alone in our personal struggles.
Sadly, I hear blind cries for application of the death penalty in this case, well before professionals can evaluate this man's mental state. Is he of sound mind, or of diminished capacity? Sadly, I see much anger directed at the guns he acquired and used, rather than at his personal decision to project his suffering onto others. At the heart of this matter is a man who was clearly in distress and decline, and who very clear needed mental healthcare and direct intervention... where is the outrage over that not happening?
There are interesting parallels here to the security industry. Much of what we do is focused on treating the symptoms, rather than trying to address underlying causes. Someone even went so far (tongue-in-cheek - sort of) to suggest recently that the "solution" to the hacker problem is to get hackers girlfriends. While we all had a good chuckle over this comment, the article itself does raise some interesting questions. More importantly, to me, this goes to the heart of the matter, which is finding ways to address root causes, rather than stay on the hamster wheel of pain as we continue to fight against symptoms. Fundamentally, this relates back to the need for sound GRC programs within organizations that can help apply reasonable risk analysis and decision support.
It seems to be very much en vogue in society today to employ knee-jerk reactions in flailing against symptoms. The USA-PATRIOT Act was hurriedly passed in the shadow of the 9/11 terrorist attacks, and is widely hailed as one of the worst pieces of legislation to ever be enacted, effectively rolling back myriad civil liberties. The TSA exists as elaborate security theater to keep honest people honest, and not to actually provide much in the way of meaningful security. Speed limits have been raised over the past decade as statistics have shown that the old federal mandate of 55mph on highways turned out not to have a benefit on reducing vehicle fatalities. Just so, I think we would do well to consider that trying, convicting, and sentencing a disturbed person to death because he had a gun is also a wee bit simplistic and shortsighted, causing us to tilt at windmills rather than openly discuss and address the underlying core issue of mental healthcare.
In general, we need to be much more vigilant in how we react to, and follow-up on, various types of incidents. In particular, we need to do a much better job applying risk analysis, as well as in performing a reasonably comprehensive post-mortem to understand what happened, why it happened, and what sort of reasonable measures can be taken to prevent it in the future and to improve incident management. As part of that analysis, it is imperative that we stop and consider "Could the outcome have been worse?" and, if the answer is yes, understand what was done right, as well as what went wrong. For example, Aurora PD and Dispatchers have been hailed for their excellent use of emergency communication in response to the incident (recording here).
Only when we apply analysis, and eliminate the misleading influence of raw emotion, can we truly begin to understand and accept the challenges we face. It is too easy to jump on the bandwagon and chase after the first "easy" target, overlooking what may be an addressable root cause. We must be wary of the tendency to go after "low hanging fruit" as this can encumber us with dangerous shortsightedness, exposing ourselves and our businesses to even greater risks.
As for Aurora... it is, indeed, a terrible incident. A dozen innocent people have lost their lives by virtue of being in the wrong theater. However, we must not lose sight of the fact that this incident was perpetrated by a man of questionable mental stability, who in all likelihood should have been identified as troubled and been receiving assistance, and that it was *not* the result of any specific choice of weapon. As was demonstrated by the booby traps around his home, this man was clearly capable of doing even greater damage, and we should be thankful that the outcome was not much worse. Let us focus on how we can help people like this man before it's too late, and not on the minutiae of the means he employed, which is at best a red herring, and a detractor from the true threat of inadequate support for mental healthcare in this country (a theme that has repeated itself over and over and over again).
