Michael Collins: Our guest is Dan Murphy, a security executive with decades of leadership experience across corporate security, and investigations. Dan began his career as a New Yorker. Police department, detective, and later as an investigator for the Bank of New York. He then served in corporate security leadership roles for national brands such as Supervalue, Optum, United Health Group, and US Bank Corp. Dan, welcome.
DAN MURPHY: Thank you very much, Michael Logan. It's a pleasure to be here with you.
Michael Collins: can you summarize your career background? What led you to ultimately become a corporate security executive and the public service leading up to that?
DAN MURPHY: Sure. I'd say the long and winding road to that kind of started when I was probably eighteen years old, living in Queens. My neighbor who was a retired cop had a security company he started and he got a contract at the South Street Seaport Museum in Lawrenhattan while it was under construction in the early eighties. And most of the guys from my neighborhood took a job there and we just did basic security work and it led me to consider law enforcement. My uncle was with the MYPD for thirty-eight or thirty-nine years before he retired. And I didn't know what I wanted to do. And he sort of said to me one day at a family barbecue, Why don't you take the police test? And I was in college and I was communications major and I was floundering a bit, didn't really have a direction. And so I really hadn't thought of it. So I took the test and I did very well, to my surprise and Got hired within a year and really loved it. Really loved the concept of being out and being able to protect people, look out for people. And it was just it was great fun, great excitement. At the time in New York City, was completely out of control. Nineteen eighty four. Crime was through the roof. the next year crack hit and crime went even further through the roof. and it was only about four years I did in patrol before I was able to get into investigative track, which is the Manhattan Warren Squad, which was searching for fugitive felons all throughout the city, people who had either skipped
Michael Collins: Wow.
DAN MURPHY: out on bail or skipped out in their trial or just plain didn't want to go to court on their felony. And so you learn how to find people, and so I did that for a couple of years, got a chance to go into the narcotics division after that, nineteen eighty-nine, New York City was exploding with drug violence. I was assigned to Brooklyn North, which was we used to like to say it was the most dangerous stretch of real est real estate in the world. murder central. these are high, high crime precincts with lots of violence. And we were out there doing plain clothes, narcotics work with undercovers and working with informants and and stuff. And moved on from there to a task force with the Drug Enforcement Administration, which was a higher level. I ended up you know working a bunch of wiretaps. I ended up developing a case that became my first racketeering case, Rico case. in the Southern District of New York with some fantastic US attorneys, great detectives I work with, and we we developed this case and I ended up going over to Hong Kong and doing some undercover work over there, which was an incredible experience for me, considering I started out not too many years before swinging a nightstick on a footpost in Brooklyn. And now all of a sudden here I am in Hong Kong negotiating a transfer of millions of dollars worth of heroin, securing audio tape. evidence that would put these people in American prisons, which it did. Moved on from there after a few years of doing that onto the major case squad of the Detective Bureau, put a suit on and was a real detective now. And now I'm tracking down kidnappers and I'm doing RICO cases on violent gangs. And it was incredibly fascinating work. Kidnapping cases are among, if not the most tense, stressful cases you can ever work as a detective because you have someone's life on the line. Homicide's one thing. You go there, the person's already deceased. Now you have to figure out, unravel who did it. A kidnapping, where is my live victim? Did that for about three years and then I was promoted to sergeant, went back to uniform in the Bronx in the 46th precinct, and anybody who ever hears this, who's familiar with the 46th precinct, knows that it is one square mile at the time, at least, of massive amounts of drugs, crime, child abuse, robberies, shootings, homicides, stabbings, i everything. On a given night, you could have anything. moved on from there and had to do my two years in the Internal Affairs Bureau, Did a couple of years there and then moved on to to the gang unit, And I was a sergeant in the Bronx gang squad, a where we had thirteen detectives, and our job was to do something about the gang situation in the Bronx. We had about forty-five thousand identified gang members in the Bronx at the time. A couple of years are there, and I was transferred to the unit that I was in on 911, which was technic technical assistance response unit, we they called it Taru, which was a all-purpose unit that did a variety of things, many of them covert. We'd put the bug in a gangster's house in the middle of the night. we would do put tracking devices on cars, we would do Hostage negotiation, communications, setup and control. We would do videotaping of of s events, wire up undercovers, wire up informants, set up wiretaps, We had all the tools, the toys, and the know-how, and it was fun. And on 9 11, responded to the World Trade Center and shortly thereafter, I was called by Chief of Counterterrorism Phil Pulaski, want you to come work in the terrorism task force. We're beefing it up and I want you to take a squad as a sergeant. I said, Absolutely. I had lost many friends there, and it was really a horror horrific experience. And I went and did that for the last stretch of my career. And that took me into retiring. had a business briefly with my old partner, John O'Boyle. we did some security technology work. We we really couldn't find our niche, so to speak. And I I moved on from that. I went to the Bank of New York and I became a senior investigator for them. And part of the concern then was because the squad that I had ran in the terrorism task force was telecommunications and terrorist financing, I had had experience being an end user for suspicious activity reports or SARS. Our group every morning, myself and my FBA partner, Dave Schaeffer, we would get from the bank banks in in and around the New York area a stack of suspicious activity reports, all indicating some sort of of movement of money that's either questionable or had a terrorist link or potentially. And we had a lot of them and we would go through them every morning over coffee The Bank of New York, when they hired me, part of the reason was because they really didn't have any of that sort of insider expertise with what happens to the SAR afterwards, And so I did some work in that area and it was it was a great opportunity. from there I was asked to move on. I actually met the CEO of Albertsons Corporation in New York. Jonna Boyle and I had done some protective work for him. and I ended up being asked to take a role with his company. and start a corporate security program with a Fortune fifty company based out of Boise, Idaho, which was Albertsons at the time. So I didn't know how to build one, but I certainly leaned on people I knew. And that's actually where I got acquainted with the Gavin DeBecker and Associates folks there. I ended up going to the Threat Assessment and Management Academy And I started delving into the world of threat assessment. Worked there for a number of years. That company was purchased by Supervalue, I was asked to move to Minnesota, which I did. And I was asked to flex the muscle of the corporate security program within that company. And it was an again a great opportunity. Had a chance to work overseas. We opened up subsidiary in India. did quite a bit of work establishing the protocols, the physical security equipment, selecting the guard companies, doing all that kind of work. That's what corporate security is. You own all the crazy stuff that can happen, did happen, or that you're preventing from happening. Took that with me to optim, for a couple of years where I worked in the compliance section. Now, it wasn't corporate security per se, it was compliance and privacy as well, helping them do investigations. How do you make sure that compliance is kept? You have to have a system in place where allegations of of violations of that or of privacy have to come in to dedicated people who understand how to how to work those, and report it when necessary to the government. one of the things I learned is that the attorneys that worked there, many of them were very, very smart, but they were not Adept in the areas that I was skilled in, which is interviewing, in information gathering, intelligence gathering. They were good at understanding the law, but often were not good at getting detail from people during interviews. So I di I put together a training program internally for Optim's compliance investigators. This is how you can get the most out of an interview over the telephone, let's say. Because you can't travel everywhere for every case. Left Optimum after a couple of years for an opportunity to be to become the chief security officer at US Bank, which that that's a title in a role that if you're in the security world, it's the top of the heap. because it has tremendous amount of responsibility. It was a heavily regulated banking industry, the financial sector, where I was meeting with regulators on a fairly common basis. Money laundering is is everywhere. moving the proceeds of criminal activity to wash them to appear legitimate, moving them around the world, et cetera, et cetera, is a constant challenge for the banking industry as well as for law enforcement to stay on top of. And so we have to have great communication between. So working in the capacity I work with at US Bank, it allowed me not to do the money laundering pieces so much. There was a separate person there, but to make sure that my team, with regards to anything fraudulent, we were catching it, we were being notified, we were doing the right thing with it in a timely manner, and agencies that were taking the ball from there could do it knowing they had everything they needed. And that's just one piece of it. There was many other aspects of it. The bank robbery aspect, bank burglaries, insider threats that happen, working with the Chief Information Security Officer on on various things like that. And of course, an organization with 77,000 employees has its share of individual problems, right? Who's threatening who? Who needs to be terminated. So I teamed very closely with human resources, legal risk throughout all these roles, because you are a partner with them at the table and you can often be the common, not the common, but the calm voice That leads you to a rational solution to a problem when emotion is happening. And that's something that I prided myself on was the ability to say, okay, let's take it easy for a second and let's figure out what we're really dealing with here and the best way to deal with it.
Michael Collins: we're super curious about the transition from public service to corporate. But first before we go there, what was sort of the best and worst part of that public service, please?
DAN MURPHY: one of the more rewarding pieces by far of all of it is the simple act of doing something like being involved in a kill that wasn't simple, a kidnapping and breaking the door open and rescuing a kidnapped victim. helping people, going to a domestic where a a woman is being beaten, writing the situation, making an arrest, getting her help, getting her referred to social agencies when she has nobody. Those are great things. Bad things, well, you are a witness, a front row witness to some of humanity's worst. You see the violence that people are capable of to each other, the brutality, and some of it is deeply shocking. Even to an experienced cop and detective, And then towards the latter part of my career when I thought I had seen everything comes nine eleven, which was a whole new level of shock to the system, having to work on the pile twelve to fourteen hours a day, seven days a week for the first month or so, and doing what we were there for. Our job was to go down and find at first people who had survived it, which was Very few. And then it was find remains so that families could have some sense of a I hate to use the word closure, but a but a funeral or a service or feel like they they got their loved one back. And then two months after that we had American Airlines Flight five eighty seven crash in Queens, where we all responded and spent about twelve hours there and That was the job there too, was picking up human remains. You go home to your family and you try to shake that off and it's difficult. So there's there's tough, tough parts to it, absolutely. And there's a lot of stress involved in police work. You you're worrying about your safety, other people's safety, people you work with. you're dealing in environments where when I first started, we had a six-shot Smith Wesson revolver and a ten-layer Kevlar vest. And we're out there seizing, you know, sort of shotguns, tech nines, you know, nineteen eleven forty fives, all these things that easily could have penetrated our vests and we would have lost a gunfight with and members of the police department in New York lost gunfights because they were dealing with revolvers versus versus semi automatics. And that's and that those things are hard. The funerals are always hard. Members of the service who died in line of duty, very hard. Those are the tough parts. All in all, though, I look back with great memories, fondly of my twenty year career there. And well, like we like to say I I I miss the the clowns, not the circus, so to speak. And so the people I I worked with and I stay in touch with a bunch of them. And so that's that's my little short and take of some of the ups and downs of that world.
Michael Collins: Incredible. Dan, the transition to the private sector. leaving public service. what was that transition like for you and your family?
DAN MURPHY: At first initially it was a wave of relief. I'll never forget the day that I I I formally retired, which was right before Christmas, turned in my gun until I could come back and get it with a with a with a permit. Walked across the street to the Joint Terrorism Task Force, my last assignments to the Christmas party. And I walked in and I saw these amazing people. And I realized at that moment, number one, I had a weight off my shoulders. I didn't have to worry anymore about if I'm walking down the street and somebody, you know, does something I don't have to I don't have to do anything anymore. I I can be a human being, a regular citizen. But there was also the realization I had just left my identity. I had just walked away from and most pe everybody does at some point, the greatest group of people in the world. The most interesting work. And I was questioning it up and down, but I I was very tired and I was ready to try something new. However, the transition isn't always smooth for a variety of reasons. Now, I transitioned into the business that John and I started, and we had fun. We weren't making much money, but we were having fun and we enjoyed each other's company. But my financial obligations to my kids going to college and stuff started to sink in and it became obvious I had to do something different. And when the Bank of New York called I took it. To my benefit, most of the people I was working with, just about all of them, were were retired members of police agencies, some in New York, some outside. And we had very much a detective squad feel. And that was comfortable for me. It was okay. It was different kind of work But I think the overriding thing you have to do is you ha when you leave any public service and you go to another private sector, let's say, job, you have to recognize that you're new and keep In your head, what it is that you've learned, but don't pretend you know what you're doing yet. You can't, you don't. Be humble. Seek out mentors, people who can help you on that walk because you'll need them. Because it is a different mindset. I mentioned earlier, the mindset shift that takes place. I was lucky enough to be open-minded enough to let that happen. I've seen people who haven't been able to. Like for example, you go to work for XYZ Corporation as a security manager or something. Frankly, they don't care how many how many arrests you made. They don't care how many homicides you've cleared. They don't care. They care, what are you doing here? What are you doing today? And that's a different mindset. But it's it's a transition. Prepare for it. It's it's amazing how many folks leave it and they feel, I'm burnt out, I'm fried, I'll just do a little bit of this, a little bit of that. Well, that doesn't satisfy long. It really doesn't. Not fine, not only financially, it doesn't satisfy you as a person Because if you're not learning and growing, you're stagnating. And so when it comes to the private sector, you are not guaranteed your job like you are in law enforcement unless you get convicted of a felony or you're hurt. For the most part, you're guaranteed a job in those worlds. In the private sector, mm mm Come in any day and they can decide they found somebody better. So you have to earn your position all the time, which is a bit of a different mindset.
Logan Willans: So you mentioned when you're working at Albertsons you had to learn to think differently than a police officer. So can you be a bit more specific in what you mean by that?
DAN MURPHY: Sure. If we became aware of an individual within our organization, or even a contractor that was doing something that was kind of criminal in nature. Immediately as a cop you look at and go, Okay, I have probable cause for A, B, and C. I'm locking them up. That's it. Case closed. I learned in the corporate world that may not always be the best solution. It depends upon the type of criminal activity. It depends upon whether it's the kind of thing that if it hits the newspaper and if it takes up my time going to court, is it worth it or is it better to just bring the person in, interview them, work them out of the organization? Wish them well, move on, and keep everything going. The organization has to maintain its productivity, it has to maintain whatever services or or goods it provides on a regular bas and you don't want to interrupt that. That's something that the upper leaders of the company are always looking at, not to mention reputational. If you get a reputation as a as a company where everybody who goes to work there, they're always trying to looking for ways to lead them out of the building in cuffs. You Become a place nobody wants to work. Not because they think they're going to be involved in criminal activity, but because there's that fear, they're gonna plan something on me. There's so many different ways to look at it. And I quickly became I remember one time Mike DePaula, rest in peace, Mike, he told me, you think too copy. Like you wanna have you wanna set up a case with the postal inspectors to have this guy exposed. I said, Well, yeah, well, I I see this clear avenue. I used to do this. I could he's like, No, you don't do that anymore. That's not what we're doing here. We're getting rid of our problems. We're not looking to put them on trial. Unless of course it's something serious, But for certain lower level stuff, it was not making an arrest, it was working the person out of the organization for the benefit of the organization.
Michael Collins: Dan, what are the big misconceptions in corporate security and the investigations work that you've done?
DAN MURPHY: I think a lot of people don't understand just how valuable to a an organization a strong investigations and corporate security team can be. How important it is to mitigate risk, Cyber, y I mean cyber is enormous. You have to have an incredibly powerful chief information security officer or An IT security team, whatever whichever how big your organization is, you have to have that. You have to protect your information. And then the human piece of it. If you're not protecting your people, if you're not caring for them, if not sh if you're not demonstrating for them that they matter above everything else because they do, then you are gonna fail. And a lot of organizations don't do well because they send a message to their employees through individual actions that the employee is last. Give quick example of that. And I don't mean to put this person down. I won't name them, but when I first arrived in Minnesota as the director of corporate security for Supervalue, the corporate building itself, the main headquarters with the CEO and all the executives came and worked on the third floor, was an easily accessible building, parked, walked in. There was a a front reception desk with two very nice ladies sitting behind it who answered the phones and helped people, and there was a way to walk through these procs readers to go up the stairs. And if you wanted to, you could walk in, wave to people, walk directly through. A sound would go off because you didn't have a badge, but you could be up in the third floor sitting in the CEO's desk in 45 seconds. It was completely open. That kind of shocked me. So I said to the individual who is tasked with security at that building, who was the facilities manager, I said, totally different worlds in my world. I said Why is it that there is no guard on the day shift? But we have a guard on the 4 to 12 and the midnight. And he said to me, Because we have two receptionists in the front and they watch things. I said, Okay, let me walk you through the mindset. What you're saying to every employee in this building is that their safety and security doesn't warrant having an Unarmed guard even, watching the cameras, dedicated full time to that, doing rounds during the daytime. But the building, the walls, the computers, and the carpeting do on the midnight. And he looked at me. I never thought of it that way. We're gonna start having one. Where are we gonna get the money from? I said, I'll argue for it. We'll get the money, but you cannot have that open of a situation. Then there are investigations. I mean, I got involved in investigations that involve large sums of money, embezzlement cases, or people who used ACH fraud because we had a million different vendors we we dealt with who who provided us their goods. And the channels by which the funds move back and forth for that for those transactions can be easily manipulated. We have one case where they were. And in the course of a week we lost, I think it was ten or eleven million dollars. And I I got a panicked call from a bunch of executives saying, We just lost all this money. What what are you gonna do? I used to work in in counterterrorism and I did terrorist financing and I am aware of the DOJ and the FBI's capability in this area, So I made a call, got the right person on the phone, worked with the local FBI office because eight ten million dollars in the New York office wouldn't bet an eye. Whereas in Boise, Idaho, it was big mu big money. The agents there were great. We put together a great report, sent it in, and within Not too long a period of time we were able to freeze funds. They had moved three times around the world already. Somebody had manipulated the email address for returning and and and put in a a new change of routing and account information for the money. And so what it all fell to was a girl who was making thirteen or fourteen dollars an hour. She would receive these emails and send the money off. Now the director was supposed to do it, but he put it on her. And she did it and she made a mistake. She had an oversight. Somebody, company they had changed the email, just modified a little bit to make it look like it was legit. And that much money moved very quickly. And so we managed to get the money back. It was held up in courts for a while, but we managed to stop and seize it, freeze it and seize it, and as a result, the company got that money back, But the organization was Panicked, panicked that this might be happening in other places. And what else are we losing? Turns out it was a one-off, but that's the kind of thing that can hurt an organization. We were big and we were able to absorb it without much issue. But a smaller organization, all of a sudden you have investor flight. Investors become aware. If you hit the Wall Street Journal that you had somebody defraud you as simply as that, why am I trusting you with my money? Right? Why do I want to work in a place like that? Why do I want to shop in a place that can't get its act together? You'd be surprised how much residual, how much that happens after the fact based upon a simple act like that.
Michael Collins: Absolutely. I can think of a few examples of major data leaks that, you know, undermined the company brand. It's just a huge embarrassment for a long time. how did the role in corporate security change over your career and maybe attach to that? what are the older practices that you think are underrated, newer tools or assumptions that are overhyped?
DAN MURPHY: when I went into it, I hate to say it's the dark ages, but comparatively it feels like the Stone Ages to what they're doing today and just the advent of of so much cybercrime, so much stuff being done online as opposed to being in person. Like for example, being the CSO of US Bank, we had bank robberies, of course, every bank has bank robberies. The average bank robbery is what I call like just a moron who walks in with a note looking for money because they need drug money for the weekend. And they call it a bank robbery, I call it begging. but you take it seriously, you give them a thousand dollars, whatever he walks out, and eventually they get caught. It it's they're the the Neanderthals of crime. They haven't figured out that having a computer can make you three thousand times the money. So you have to deal with that. Right. Okay, it's not that big a deal comparatively. What's more important now is having very tight controls on your processes and having great reporting. exception reporting, et cetera, when you can under so you can understand that something it's an anomaly has happened, that the movement of money has to be stopped here. So I went from it was a little more primitive back then, a lot more in-person discussions with people, to I eventually got to the point where I spent a lot of time with the chief information security officer at US Bank. He and I were were teamed far more than I thought I would have been, because of so many things in common. So many things that were in my room that were bleeding over into his, or the pathway to making money nowadays is online. And you have to be, as a corporate security professional, on top of that. Not to mention when it comes to the in person stuff, like the threats to your employees or or to the organization itself made by either disgruntled former employees or disgruntled customers or mental health issues that happen, relationship issues that bleed over into the workplace. All this stuff, a lot of it's happening online. Threats being issued, people are ranting about things, e executive protection fell under my realm everywhere I worked in corporate security. So I've done a lot of it, I've overseen a lot of it, spent a lot of time on corporate jets with executives, spent a lot of time trying to make sure I'm aware of any threat to them. I think we saw the United Healthcare CEO's murder in New York City as a wake up call, a shocking event that's a wake up call. And I can tell you there's been some significant changes at United Health Group since then and how they protect their executives. You have to know what's being said about them. You have to know what's being uttered by anyone It all has to be taken seriously. It all has to be assessed properly by people who know how to do that. And if you're not collecting that data, so my world went very differently from when I started out, you get a phone call, hey, there's a a guy he just got fired over here in this building and he says he's gonna come back and kick his boss's butt. Well, okay. That's a threat. I'll take it seriously. Now everything's is online. So you have to capture it online. You have to be aware. You have to have, searches that are being done on a regular basis to make sure that anything that's being said about your CEO, your board of directors, et cetera, you know about it. Because if you're going to take them to a public event or a venue, or if you're going to secure them in their workplace or in their homes, and when they're an executive like that, you own all of it. You can't just say, you're on your own when you leave the building. That's not how it works. You can see how much negative, how much harm comes from not putting enough effort and energy. Now, that morning, I'm not criticizing anybody, but the morning that the CEO of United Healthcare was shot in New York, his executive protection team was in the hotel lobby. I think they were having coffee, and he just said, I'll walk over. No, you can't do that. This is not nineteen sixty four. This is 2025, 2026. You cannot do that. You have to understand that person, that person has a lot more riding on them getting there safe than just being able to go home. The stability of the organization, the reputation of the organization. I know I everybody in the world that understands executive protection took a look at that and said, You've got to be kidding me. You've got to be kidding me. He just wants to wander on his own. And executives can get like that. And I used to have discussions with them sometimes. I I'm not trying to smother you, but you have to understand what you represent.
Logan Willans: so when you're dealing with a threat environment, And this this can especially happen like a post-incident event, how do you go about managing principal anxiety? And then how do you also determine what is a legitimate threat? versus let's say like a dis standard chatter you might see online or l an average disgruntled customer, let's say.
DAN MURPHY: Well, I think it requires schooling, and I think you know this, Logan. If you don't understand the nature of threats, then you're gonna respond in in different ways than you should potentially. But emotions do kick in greatly. I had a case I did as a consultant once. For an organization that was a an e-commerce organization that sold a variety of products. And their one of their senior VPs I had worked with previously, and she called me up and they were all panicked. They had this this concern. Can you help us with it? I said, sure, sure. Let's have a call and just tell me everything about it so I can understand what's going on. Turned out they had sold, of all things, a bicycle to a gentleman about five states away. And he had called into their customer. service or customer assistance hotline at about two o'clock in the morning, two or three times in a row, different days in a row. And he was con sounded half drunk and he was complaining the bike is broken, kick your butts and you guys stink as a company and all this kind of stuff. And they got very panicked. Very panicked. They wanted to hire twenty four hour armed security for the CEO. They thought this guy was going to come in and kill everybody. And I had to I I said I said all right, look, let's okay, get it all out. Get all your emotions out now. Let's deal with what we actually know. Let's get the person's name. Let's find out is this person somebody who acts upon these sorts of feelings? Do they have a criminal history or not? This person is drunk. Let's listen to the tapes. I listened to the tapes. What the person said was, I don't drive, I rely on my bike. I said, okay, so you're concerned that this person. Who relies on his bike is going to somehow move five states here. He doesn't even have a bike that works by his own admission. He's going to come here five states away and carry out an act of violence. And he's not saying it's going to be an act of violence. I might do something, you know, that kind of stuff. And so after about a half an hour of sitting with him, I said, I'm going to save you guys, I think, a lot of money and a lot of time. Have you considered sending him a new bicycle? They didn't. Nowhere in this discussion was the guy was asking for a new bike. That's all he was doing. It's looking at what's really happening minus the emotion. And I tried to put it as nicely as possible. I said, This is what I'm hearing. Why don't we try that before we start calling out, you know, the Roman army to pro provide protection against the person who has no intention of going further than his mailbox? Let's get real. guy had no criminal history. I called his local police agency. They didn't know who he was, just some local guy. He was not a problem person. He was a drunken person at night who was upset he didn't have his bike. Get him his bike. They sent him his bike and they never heard from him again because it was obvious if you listen to what's being said as opposed to the emotion. How do you get people to calm down enough to do that? Sometimes you have to be the calm person in the room or on the call. And the Zoom calls are better, I think, because we can see each other, okay? All right, I hear you, I get it, I get it. But okay, in my experience, this is what I've seen. Studies have shown that this is what we're dealing with. Let's do A, B, and C. When you come up with a plan and that you feel they feel that they're part of that plan and they're being heard, that calms anxiety. Having no plan causes that anxiety. So if I sit with them, I say, All right, here's what we're gonna do. I'm gonna do A, B, C, and D. Here's my opinion as of right now is we don't need this. But we need to focus on this. And if they've brought you in as a consultant or as a c corporate security leader and you already have a good reputation with them, the chances are good that they will listen. But you have to be the calm person in that room. And sometimes I would even speak very low. Okay, this is what I think. Because then people have to strain to listen to you and they can't be emotion based. Lots of psychology comes to play. It really does, because you have executives throwing orders out. To spend all kinds of money on things. And the other side of the coin is you have situations where all of a sudden the money becomes after about two weeks of somebody threatens, let's say somebody in a bank branch, fired somebody, or customer came in and said he was going to hurt somebody. They said, Let's get some extra security there. Okay. We'll get an armed off-duty cop there every day. After about two weeks, the first bill comes in and they all go, Do we really need them there? To which I would say Okay. If you felt you needed them two weeks ago, what makes you think you don't need them now? Well, because it's two weeks he's probably gotten over it. Probably and hopefully are not life safety plans. So you had a cop there for two weeks, the guy wouldn't come by. You take the cop away, somebody walks in and does what you pray he doesn't, but he does it anyway. And now how are you going to explain? You didn't want to pay the money? Because you thought in your mind and in your shallow understanding of of threats, first of all, did you even look at what the threat really was? Did you look at the person's capability to carry out the threat, their ability to do it? are they aware of the consequences? What statements are being made? Or are you just reacting knee jerk? That's why you have to have a thoughtful, learned way to look at these kind of things. Based upon study, based upon training, based upon cases, based upon experience, then you can make the rational decision to have a practical, reasonable, defendable plan to prevent against it, as opposed to get five guys with guns right there, right now. I I don't want anything happening. And I've seen too much of that. But you're right, emotions are the biggest thing you have to manage.
Logan Willans: So just expanding on that kind of topic of emotions. So you mentioned after an e maybe a disgruntled employee issues a threat, or you know, a a tragic incident happens at a similar company, people's emotions may be elevated. So we're we're seeing that security is a very reactive industry. but as a security leader, what do you do during the happy days when, you know, nothing bad has happened, but you feel like you might need a new program? Or a new tool. So how do you how do you justify that? How do you prove value when things are going smoothly?
DAN MURPHY: You have to really do a business case. which is not easy for security professionals. What is this? What's the value of this? Because all they see is you as a cost center. You're costing your area is costing our company five million dollars a year, and now you want more? And nothing happens. People say nothing happen. Nothing happens because number one, we're very lucky, but we're not always gonna be lucky. And number two, because we take proactive measures to seek out information and intelligence. It's all about what you know. You can't just be reactive anymore. Just being reactive, we see the results, they're disastrous. They're disastrous, and companies are not prepared for it. Up to and including from a communication standpoint. I've seen c companies drop the ball significantly after the fact. By the say saying the wrong things to the media in in a heated, emotion drenched moment in front of a microphone at a press conference thrown together at an active shooter situation. I mean, crazy stuff happens. You have to put together a program and a plan. I actually outlined along with Randy Furrest, my co author in in our book that we came out with Workplace Safety. It's it's the whole the seven points, the seven areas that you will have to touch on, part of the miscommunications, but you have to be proactive in your intelligence gathering. Because if it's out there, I can guarantee you it'll come out afterwards. Let's say, for example, somebody is posting crazy things about your CEO, and you're not aware of it because people who hear about it or see it don't want to get involved and they don't report it. Well, then now you don't know what's going on. You haven't searched the web for threats, and all of a sudden something happens. Within an hour or two, Some intrepid reporter is going to have that posted on a national news show. They're gonna have that web, that page. They'll see it. They'll find it. They'll find it because they bothered to look for it. If you didn't bother to look for it, then shame on you because you just hurt your organization and maybe you lost a life. You have to know as much as you can know. So even in quiet times, there should be wheels churning, just as there are in information security. There's constantly work being done to strengthen the firewalls, to beat back the threats, to ensure that The data is secure. Just because nothing happens, well, that's that's a success, or it can be luck. You want it to be both. It has to be based upon a program and a plan that people don't see. They don't see your successes, they see your failures. I'd rather have a long period of peace where nothing's going on, where people think, well, I don't know what you do really. Well, I'll tell you what we do. And when you sit down and tell them about the plan, they go, I didn't know you did all that stuff. That's what you want.
Michael Collins: Dan, what are your peers talking about right now at the conferences and events in group chats or you know, private conversation? What are sort of what's what's top of mind in the industry,
DAN MURPHY: I think executive protection is going to be there for a while. I think number one, what happened to the healthcare United Healthcare CEO has resonated through the corporate security world in such a way that it has caused quite a few organizations to take an internal look at how they're doing things. So I think they're taking a look at the executive protection piece of it and not just the physical security piece of it. residential security. what travel security, where they're going, making sure that you're involved in organizations like OSAC and you're working with companies like IJET or Corporate Risk International, all these companies that can help you provide for safer travel for your executives. They have to travel. How do you do that safely? How do you mitigate against threats you don't know? You have to know about them. So they're investing in tools that can help them detect things. There are a great many tools that are out there now and organizations that can help you do that those deep dives and send your reports. We came up with this. You wake up in the morning, you you're a corporate security leader, you see an email. Four o'clock this morning on the dark web, this was detected. it's good to know. And it's from this organization. And then who's doing your intelligence work for you? If you hand over this information to somebody who doesn't have all the data, doesn't have all the information about that specific group, let's say the person belongs to, or that person in general. You give it to me, a guy named John Jones from whatever, Kentucky, wrote this this morning. Well, I want to know everything I can about John Jones too. You need to tell me the dossier kind of work. Who is he? Is this a guy that's an activist? Is this a guy that that mouths off a lot but does nothing more? Is this a guy that just got out of prison? Is this a guy that used to work for the company and is now ticked off? What's going on in this person's world, life? What is their goal? So that's the kind of stuff that you have to be on top of. You know, cameras are cameras and they're great. Access control systems are access control and they all do their job. But if you don't understand the nature of the threats against your organization and you're not open-minded enough to seek out tools to help you gain the intelligence that you need and to have it put through the gauntlet of of testing it for veri verif veracity, is it real? Is it true? Who are these people? Then you're failing. You can put all the big six foot five inch muscular guys with guns in black suits outside all the denales you want. But are you really? Doing what you need to do. And I think we can see with a guy like the United Healthcare CEO, and I hate to keep bringing up I hope you're him and his family are I know he hope he's resting in peace. I hope his family is doing okay. But they sh learn from that. We have to learn from that. All it takes is a minute. When your job is to protect somebody, protect them. Think of that person as your four year old kid. Would you let your four year old kid walk across the street right now at six o'clock in the morning, Dark Street, Manhattan, to a meeting because they say, I got this. No. Of course you wouldn't. Well, I'm not equating them mindset or capability-wise to a four-year-old, but value, absolutely. That person's represents a lot to a lot of people and must be protected. This is a big point of discussion I'm seeing. And like I said, tools are out there, there's lots of tools, and I always had experts that were focused on understanding the tools, the physical security pieces, et cetera, but the intelligence piece. understanding what you're dealing with and making informed decisions, having those quality third party partners that can help you assess and manage the threats in a professional way based upon years and years of experience as opposed to turning over a report to a group of executives who sit and look at it and go, what do think we should do? Well it's not your area. Nothing personal. You're great at what you do, but this is not your area of expertise. Find the experts, work with your experts, lean on them. Listen to what they tell you.
Michael Collins: Thank you. This has been incredible, Dan. you. we've heard some reservations or awkwardness from security leaders in conversations occasionally, where when it comes to the the PII of the folks that they protect, how do you navigate that? where you can manage their security and sort of maybe educate them on navigating those sensitivities, you know, w whether they're providing their IP address or other things to help secure them digitally and and physically, how do you cut through it? We've heard folks that are reluctant to have those conversations.
DAN MURPHY: It all starts with building a relationship with the executive. They have to trust you. They have to trust that what you're saying is for their best interest and for the organization's best interest. And you're not just doing it willy-nilly. You're talking to them on a person to person level, based upon my experience, based upon my expertise, and the people that I am dealing with who are experts in this area. A best practice in the industry is that a person in your position, their family, is minimal. About what they put out on social media. If you're going to go on vacation, post pictures after the fact. You really want to show that water slide you're at? That's great when you're home. Don't give somebody a chance to go meet you there. You have to have these conversations with them, but you have to first have that trust. If they don't believe in you, they don't trust in what you're doing, they don't see that what you're doing is based upon because I've been asked, well, who else does this? What other company does that? Always have those answers ready. It's never just I thought of this, let's do it. It's I thought of this, I looked into it, I found out these people were doing it, I found out this one was doing it, I talked to these guys, they like it. This is why. If you can answer the questions, you should be able to anticipate about why are you telling me how my eighteen year old daughter should post on her social media. I let her do what she wants. I'm the CEO, and I've had discussions With CEOs that haven't wanted to hear this at all. And I've had some of them who are great, and I've had a couple who are just, nope, I don't want to hear it. You still have to work around that, which means you have to tighten up your ability to gather information around that. And people will do what's counter to their well-being because they feel it's an infringement upon their freedom and their movement and their lifestyle. And I get that. And I would always preface it by saying, I understand, I do. I am trying to balance protecting you, your family, this organization, and allowing you to be who you are. But when you accept these roles and you get seven figure paychecks and you're a national, if not global, presence in media, you have to understand your position.
Michael Collins: Fantastic. What did we not ask you? what else should be included, please?
DAN MURPHY: I think with so many organizations going global in in many ways, because they either have subsidiaries that are working in foreign lands or they have employees in foreign countries and they have all that sort of stuff going on. I think it's it's easy to not understand the global landscape of where you're doing business. I had an executive once travel to a foreign country and the CEO was surprised to see me. He wasn't happy I was there. And at first I took it personally, and then I realized he just got off a plane, he's exhausted, he looks at me, he doesn't want to talk to me. I get it. That's fine. I really don't want to talk to you either, but I'm here to make sure you make it home alive. And so we were out running around, and I made sure there was two cars because in this specific country if something happens in the car that the executive is being driven and gets into an accident, the locals handle the accident on the scene. There's no calling the police and police reports. I was in the second car. If that happened, he was being extracted and we were moving on. He's like, What do we need two cars for? I said, Yeah. Abundance of caution. But I knew the landscape. I had bothered to look into it. I had people talk to me locally. This is something you should think about. And you have to be okay with that. You have to be flexible. You have to adapt. And you have to give your organization reason to trust you.
Michael Collins: Thank you. what are you working on now? And and how can others find you and and connect with you, please?
DAN MURPHY: Sure. Well, first of all, I have a lot of fun doing the podcast. I I'm a co-host of the Gold Shields podcast. I do that. We started almost four years ago, Tom Smith and I. Tom and I worked together in the MYPD. We interview people from whether it be law enforcement, victims of crime, military operators who've had incredible experiences, We had on the detective that arrested Scott Peterson for killing Lacey Peterson. Tom and I also have a company we call Impact Solutions. about five years ago or so, I met with a chemist and I decided There has to be a better way than pepper spray. and for a year and a half we went through sixty-something different iterations of of chemical formulations Impact is four simple ingredients. They're all food grade, mostly water, but they work very effectively at neutralizing a suspect by taking the eyes out. But the thing is it doesn't cause any lasting injuries. You don't need any of that stuff to happen. You just wanna be able to get away. and that's all it takes. And other than that, I'm enjoying life in sunny Florida, which is beautiful. And I'm gonna go enjoy the rest of today in sunny Florida when I get done with you two gentlemen. But
Michael Collins: Yes.
DAN MURPHY: I really appreciate the opportunity to speak with you both and I hope it's been of some value.
Michael Collins: Yes, sincerely has been amazing. so grateful, Dan.
DAN MURPHY: No, it's been my pleasure.
Logan Willans: Yes, thank you, Dan.
DAN MURPHY: Thank you very much, Michael Logan. It's a pleasure to be here with you.
Michael Collins: can you summarize your career background? What led you to ultimately become a corporate security executive and the public service leading up to that?
DAN MURPHY: Sure. I'd say the long and winding road to that kind of started when I was probably eighteen years old, living in Queens. My neighbor who was a retired cop had a security company he started and he got a contract at the South Street Seaport Museum in Lawrenhattan while it was under construction in the early eighties. And most of the guys from my neighborhood took a job there and we just did basic security work and it led me to consider law enforcement. My uncle was with the MYPD for thirty-eight or thirty-nine years before he retired. And I didn't know what I wanted to do. And he sort of said to me one day at a family barbecue, Why don't you take the police test? And I was in college and I was communications major and I was floundering a bit, didn't really have a direction. And so I really hadn't thought of it. So I took the test and I did very well, to my surprise and Got hired within a year and really loved it. Really loved the concept of being out and being able to protect people, look out for people. And it was just it was great fun, great excitement. At the time in New York City, was completely out of control. Nineteen eighty four. Crime was through the roof. the next year crack hit and crime went even further through the roof. and it was only about four years I did in patrol before I was able to get into investigative track, which is the Manhattan Warren Squad, which was searching for fugitive felons all throughout the city, people who had either skipped
Michael Collins: Wow.
DAN MURPHY: out on bail or skipped out in their trial or just plain didn't want to go to court on their felony. And so you learn how to find people, and so I did that for a couple of years, got a chance to go into the narcotics division after that, nineteen eighty-nine, New York City was exploding with drug violence. I was assigned to Brooklyn North, which was we used to like to say it was the most dangerous stretch of real est real estate in the world. murder central. these are high, high crime precincts with lots of violence. And we were out there doing plain clothes, narcotics work with undercovers and working with informants and and stuff. And moved on from there to a task force with the Drug Enforcement Administration, which was a higher level. I ended up you know working a bunch of wiretaps. I ended up developing a case that became my first racketeering case, Rico case. in the Southern District of New York with some fantastic US attorneys, great detectives I work with, and we we developed this case and I ended up going over to Hong Kong and doing some undercover work over there, which was an incredible experience for me, considering I started out not too many years before swinging a nightstick on a footpost in Brooklyn. And now all of a sudden here I am in Hong Kong negotiating a transfer of millions of dollars worth of heroin, securing audio tape. evidence that would put these people in American prisons, which it did. Moved on from there after a few years of doing that onto the major case squad of the Detective Bureau, put a suit on and was a real detective now. And now I'm tracking down kidnappers and I'm doing RICO cases on violent gangs. And it was incredibly fascinating work. Kidnapping cases are among, if not the most tense, stressful cases you can ever work as a detective because you have someone's life on the line. Homicide's one thing. You go there, the person's already deceased. Now you have to figure out, unravel who did it. A kidnapping, where is my live victim? Did that for about three years and then I was promoted to sergeant, went back to uniform in the Bronx in the 46th precinct, and anybody who ever hears this, who's familiar with the 46th precinct, knows that it is one square mile at the time, at least, of massive amounts of drugs, crime, child abuse, robberies, shootings, homicides, stabbings, i everything. On a given night, you could have anything. moved on from there and had to do my two years in the Internal Affairs Bureau, Did a couple of years there and then moved on to to the gang unit, And I was a sergeant in the Bronx gang squad, a where we had thirteen detectives, and our job was to do something about the gang situation in the Bronx. We had about forty-five thousand identified gang members in the Bronx at the time. A couple of years are there, and I was transferred to the unit that I was in on 911, which was technic technical assistance response unit, we they called it Taru, which was a all-purpose unit that did a variety of things, many of them covert. We'd put the bug in a gangster's house in the middle of the night. we would do put tracking devices on cars, we would do Hostage negotiation, communications, setup and control. We would do videotaping of of s events, wire up undercovers, wire up informants, set up wiretaps, We had all the tools, the toys, and the know-how, and it was fun. And on 9 11, responded to the World Trade Center and shortly thereafter, I was called by Chief of Counterterrorism Phil Pulaski, want you to come work in the terrorism task force. We're beefing it up and I want you to take a squad as a sergeant. I said, Absolutely. I had lost many friends there, and it was really a horror horrific experience. And I went and did that for the last stretch of my career. And that took me into retiring. had a business briefly with my old partner, John O'Boyle. we did some security technology work. We we really couldn't find our niche, so to speak. And I I moved on from that. I went to the Bank of New York and I became a senior investigator for them. And part of the concern then was because the squad that I had ran in the terrorism task force was telecommunications and terrorist financing, I had had experience being an end user for suspicious activity reports or SARS. Our group every morning, myself and my FBA partner, Dave Schaeffer, we would get from the bank banks in in and around the New York area a stack of suspicious activity reports, all indicating some sort of of movement of money that's either questionable or had a terrorist link or potentially. And we had a lot of them and we would go through them every morning over coffee The Bank of New York, when they hired me, part of the reason was because they really didn't have any of that sort of insider expertise with what happens to the SAR afterwards, And so I did some work in that area and it was it was a great opportunity. from there I was asked to move on. I actually met the CEO of Albertsons Corporation in New York. Jonna Boyle and I had done some protective work for him. and I ended up being asked to take a role with his company. and start a corporate security program with a Fortune fifty company based out of Boise, Idaho, which was Albertsons at the time. So I didn't know how to build one, but I certainly leaned on people I knew. And that's actually where I got acquainted with the Gavin DeBecker and Associates folks there. I ended up going to the Threat Assessment and Management Academy And I started delving into the world of threat assessment. Worked there for a number of years. That company was purchased by Supervalue, I was asked to move to Minnesota, which I did. And I was asked to flex the muscle of the corporate security program within that company. And it was an again a great opportunity. Had a chance to work overseas. We opened up subsidiary in India. did quite a bit of work establishing the protocols, the physical security equipment, selecting the guard companies, doing all that kind of work. That's what corporate security is. You own all the crazy stuff that can happen, did happen, or that you're preventing from happening. Took that with me to optim, for a couple of years where I worked in the compliance section. Now, it wasn't corporate security per se, it was compliance and privacy as well, helping them do investigations. How do you make sure that compliance is kept? You have to have a system in place where allegations of of violations of that or of privacy have to come in to dedicated people who understand how to how to work those, and report it when necessary to the government. one of the things I learned is that the attorneys that worked there, many of them were very, very smart, but they were not Adept in the areas that I was skilled in, which is interviewing, in information gathering, intelligence gathering. They were good at understanding the law, but often were not good at getting detail from people during interviews. So I di I put together a training program internally for Optim's compliance investigators. This is how you can get the most out of an interview over the telephone, let's say. Because you can't travel everywhere for every case. Left Optimum after a couple of years for an opportunity to be to become the chief security officer at US Bank, which that that's a title in a role that if you're in the security world, it's the top of the heap. because it has tremendous amount of responsibility. It was a heavily regulated banking industry, the financial sector, where I was meeting with regulators on a fairly common basis. Money laundering is is everywhere. moving the proceeds of criminal activity to wash them to appear legitimate, moving them around the world, et cetera, et cetera, is a constant challenge for the banking industry as well as for law enforcement to stay on top of. And so we have to have great communication between. So working in the capacity I work with at US Bank, it allowed me not to do the money laundering pieces so much. There was a separate person there, but to make sure that my team, with regards to anything fraudulent, we were catching it, we were being notified, we were doing the right thing with it in a timely manner, and agencies that were taking the ball from there could do it knowing they had everything they needed. And that's just one piece of it. There was many other aspects of it. The bank robbery aspect, bank burglaries, insider threats that happen, working with the Chief Information Security Officer on on various things like that. And of course, an organization with 77,000 employees has its share of individual problems, right? Who's threatening who? Who needs to be terminated. So I teamed very closely with human resources, legal risk throughout all these roles, because you are a partner with them at the table and you can often be the common, not the common, but the calm voice That leads you to a rational solution to a problem when emotion is happening. And that's something that I prided myself on was the ability to say, okay, let's take it easy for a second and let's figure out what we're really dealing with here and the best way to deal with it.
Michael Collins: we're super curious about the transition from public service to corporate. But first before we go there, what was sort of the best and worst part of that public service, please?
DAN MURPHY: one of the more rewarding pieces by far of all of it is the simple act of doing something like being involved in a kill that wasn't simple, a kidnapping and breaking the door open and rescuing a kidnapped victim. helping people, going to a domestic where a a woman is being beaten, writing the situation, making an arrest, getting her help, getting her referred to social agencies when she has nobody. Those are great things. Bad things, well, you are a witness, a front row witness to some of humanity's worst. You see the violence that people are capable of to each other, the brutality, and some of it is deeply shocking. Even to an experienced cop and detective, And then towards the latter part of my career when I thought I had seen everything comes nine eleven, which was a whole new level of shock to the system, having to work on the pile twelve to fourteen hours a day, seven days a week for the first month or so, and doing what we were there for. Our job was to go down and find at first people who had survived it, which was Very few. And then it was find remains so that families could have some sense of a I hate to use the word closure, but a but a funeral or a service or feel like they they got their loved one back. And then two months after that we had American Airlines Flight five eighty seven crash in Queens, where we all responded and spent about twelve hours there and That was the job there too, was picking up human remains. You go home to your family and you try to shake that off and it's difficult. So there's there's tough, tough parts to it, absolutely. And there's a lot of stress involved in police work. You you're worrying about your safety, other people's safety, people you work with. you're dealing in environments where when I first started, we had a six-shot Smith Wesson revolver and a ten-layer Kevlar vest. And we're out there seizing, you know, sort of shotguns, tech nines, you know, nineteen eleven forty fives, all these things that easily could have penetrated our vests and we would have lost a gunfight with and members of the police department in New York lost gunfights because they were dealing with revolvers versus versus semi automatics. And that's and that those things are hard. The funerals are always hard. Members of the service who died in line of duty, very hard. Those are the tough parts. All in all, though, I look back with great memories, fondly of my twenty year career there. And well, like we like to say I I I miss the the clowns, not the circus, so to speak. And so the people I I worked with and I stay in touch with a bunch of them. And so that's that's my little short and take of some of the ups and downs of that world.
Michael Collins: Incredible. Dan, the transition to the private sector. leaving public service. what was that transition like for you and your family?
DAN MURPHY: At first initially it was a wave of relief. I'll never forget the day that I I I formally retired, which was right before Christmas, turned in my gun until I could come back and get it with a with a with a permit. Walked across the street to the Joint Terrorism Task Force, my last assignments to the Christmas party. And I walked in and I saw these amazing people. And I realized at that moment, number one, I had a weight off my shoulders. I didn't have to worry anymore about if I'm walking down the street and somebody, you know, does something I don't have to I don't have to do anything anymore. I I can be a human being, a regular citizen. But there was also the realization I had just left my identity. I had just walked away from and most pe everybody does at some point, the greatest group of people in the world. The most interesting work. And I was questioning it up and down, but I I was very tired and I was ready to try something new. However, the transition isn't always smooth for a variety of reasons. Now, I transitioned into the business that John and I started, and we had fun. We weren't making much money, but we were having fun and we enjoyed each other's company. But my financial obligations to my kids going to college and stuff started to sink in and it became obvious I had to do something different. And when the Bank of New York called I took it. To my benefit, most of the people I was working with, just about all of them, were were retired members of police agencies, some in New York, some outside. And we had very much a detective squad feel. And that was comfortable for me. It was okay. It was different kind of work But I think the overriding thing you have to do is you ha when you leave any public service and you go to another private sector, let's say, job, you have to recognize that you're new and keep In your head, what it is that you've learned, but don't pretend you know what you're doing yet. You can't, you don't. Be humble. Seek out mentors, people who can help you on that walk because you'll need them. Because it is a different mindset. I mentioned earlier, the mindset shift that takes place. I was lucky enough to be open-minded enough to let that happen. I've seen people who haven't been able to. Like for example, you go to work for XYZ Corporation as a security manager or something. Frankly, they don't care how many how many arrests you made. They don't care how many homicides you've cleared. They don't care. They care, what are you doing here? What are you doing today? And that's a different mindset. But it's it's a transition. Prepare for it. It's it's amazing how many folks leave it and they feel, I'm burnt out, I'm fried, I'll just do a little bit of this, a little bit of that. Well, that doesn't satisfy long. It really doesn't. Not fine, not only financially, it doesn't satisfy you as a person Because if you're not learning and growing, you're stagnating. And so when it comes to the private sector, you are not guaranteed your job like you are in law enforcement unless you get convicted of a felony or you're hurt. For the most part, you're guaranteed a job in those worlds. In the private sector, mm mm Come in any day and they can decide they found somebody better. So you have to earn your position all the time, which is a bit of a different mindset.
Logan Willans: So you mentioned when you're working at Albertsons you had to learn to think differently than a police officer. So can you be a bit more specific in what you mean by that?
DAN MURPHY: Sure. If we became aware of an individual within our organization, or even a contractor that was doing something that was kind of criminal in nature. Immediately as a cop you look at and go, Okay, I have probable cause for A, B, and C. I'm locking them up. That's it. Case closed. I learned in the corporate world that may not always be the best solution. It depends upon the type of criminal activity. It depends upon whether it's the kind of thing that if it hits the newspaper and if it takes up my time going to court, is it worth it or is it better to just bring the person in, interview them, work them out of the organization? Wish them well, move on, and keep everything going. The organization has to maintain its productivity, it has to maintain whatever services or or goods it provides on a regular bas and you don't want to interrupt that. That's something that the upper leaders of the company are always looking at, not to mention reputational. If you get a reputation as a as a company where everybody who goes to work there, they're always trying to looking for ways to lead them out of the building in cuffs. You Become a place nobody wants to work. Not because they think they're going to be involved in criminal activity, but because there's that fear, they're gonna plan something on me. There's so many different ways to look at it. And I quickly became I remember one time Mike DePaula, rest in peace, Mike, he told me, you think too copy. Like you wanna have you wanna set up a case with the postal inspectors to have this guy exposed. I said, Well, yeah, well, I I see this clear avenue. I used to do this. I could he's like, No, you don't do that anymore. That's not what we're doing here. We're getting rid of our problems. We're not looking to put them on trial. Unless of course it's something serious, But for certain lower level stuff, it was not making an arrest, it was working the person out of the organization for the benefit of the organization.
Michael Collins: Dan, what are the big misconceptions in corporate security and the investigations work that you've done?
DAN MURPHY: I think a lot of people don't understand just how valuable to a an organization a strong investigations and corporate security team can be. How important it is to mitigate risk, Cyber, y I mean cyber is enormous. You have to have an incredibly powerful chief information security officer or An IT security team, whatever whichever how big your organization is, you have to have that. You have to protect your information. And then the human piece of it. If you're not protecting your people, if you're not caring for them, if not sh if you're not demonstrating for them that they matter above everything else because they do, then you are gonna fail. And a lot of organizations don't do well because they send a message to their employees through individual actions that the employee is last. Give quick example of that. And I don't mean to put this person down. I won't name them, but when I first arrived in Minnesota as the director of corporate security for Supervalue, the corporate building itself, the main headquarters with the CEO and all the executives came and worked on the third floor, was an easily accessible building, parked, walked in. There was a a front reception desk with two very nice ladies sitting behind it who answered the phones and helped people, and there was a way to walk through these procs readers to go up the stairs. And if you wanted to, you could walk in, wave to people, walk directly through. A sound would go off because you didn't have a badge, but you could be up in the third floor sitting in the CEO's desk in 45 seconds. It was completely open. That kind of shocked me. So I said to the individual who is tasked with security at that building, who was the facilities manager, I said, totally different worlds in my world. I said Why is it that there is no guard on the day shift? But we have a guard on the 4 to 12 and the midnight. And he said to me, Because we have two receptionists in the front and they watch things. I said, Okay, let me walk you through the mindset. What you're saying to every employee in this building is that their safety and security doesn't warrant having an Unarmed guard even, watching the cameras, dedicated full time to that, doing rounds during the daytime. But the building, the walls, the computers, and the carpeting do on the midnight. And he looked at me. I never thought of it that way. We're gonna start having one. Where are we gonna get the money from? I said, I'll argue for it. We'll get the money, but you cannot have that open of a situation. Then there are investigations. I mean, I got involved in investigations that involve large sums of money, embezzlement cases, or people who used ACH fraud because we had a million different vendors we we dealt with who who provided us their goods. And the channels by which the funds move back and forth for that for those transactions can be easily manipulated. We have one case where they were. And in the course of a week we lost, I think it was ten or eleven million dollars. And I I got a panicked call from a bunch of executives saying, We just lost all this money. What what are you gonna do? I used to work in in counterterrorism and I did terrorist financing and I am aware of the DOJ and the FBI's capability in this area, So I made a call, got the right person on the phone, worked with the local FBI office because eight ten million dollars in the New York office wouldn't bet an eye. Whereas in Boise, Idaho, it was big mu big money. The agents there were great. We put together a great report, sent it in, and within Not too long a period of time we were able to freeze funds. They had moved three times around the world already. Somebody had manipulated the email address for returning and and and put in a a new change of routing and account information for the money. And so what it all fell to was a girl who was making thirteen or fourteen dollars an hour. She would receive these emails and send the money off. Now the director was supposed to do it, but he put it on her. And she did it and she made a mistake. She had an oversight. Somebody, company they had changed the email, just modified a little bit to make it look like it was legit. And that much money moved very quickly. And so we managed to get the money back. It was held up in courts for a while, but we managed to stop and seize it, freeze it and seize it, and as a result, the company got that money back, But the organization was Panicked, panicked that this might be happening in other places. And what else are we losing? Turns out it was a one-off, but that's the kind of thing that can hurt an organization. We were big and we were able to absorb it without much issue. But a smaller organization, all of a sudden you have investor flight. Investors become aware. If you hit the Wall Street Journal that you had somebody defraud you as simply as that, why am I trusting you with my money? Right? Why do I want to work in a place like that? Why do I want to shop in a place that can't get its act together? You'd be surprised how much residual, how much that happens after the fact based upon a simple act like that.
Michael Collins: Absolutely. I can think of a few examples of major data leaks that, you know, undermined the company brand. It's just a huge embarrassment for a long time. how did the role in corporate security change over your career and maybe attach to that? what are the older practices that you think are underrated, newer tools or assumptions that are overhyped?
DAN MURPHY: when I went into it, I hate to say it's the dark ages, but comparatively it feels like the Stone Ages to what they're doing today and just the advent of of so much cybercrime, so much stuff being done online as opposed to being in person. Like for example, being the CSO of US Bank, we had bank robberies, of course, every bank has bank robberies. The average bank robbery is what I call like just a moron who walks in with a note looking for money because they need drug money for the weekend. And they call it a bank robbery, I call it begging. but you take it seriously, you give them a thousand dollars, whatever he walks out, and eventually they get caught. It it's they're the the Neanderthals of crime. They haven't figured out that having a computer can make you three thousand times the money. So you have to deal with that. Right. Okay, it's not that big a deal comparatively. What's more important now is having very tight controls on your processes and having great reporting. exception reporting, et cetera, when you can under so you can understand that something it's an anomaly has happened, that the movement of money has to be stopped here. So I went from it was a little more primitive back then, a lot more in-person discussions with people, to I eventually got to the point where I spent a lot of time with the chief information security officer at US Bank. He and I were were teamed far more than I thought I would have been, because of so many things in common. So many things that were in my room that were bleeding over into his, or the pathway to making money nowadays is online. And you have to be, as a corporate security professional, on top of that. Not to mention when it comes to the in person stuff, like the threats to your employees or or to the organization itself made by either disgruntled former employees or disgruntled customers or mental health issues that happen, relationship issues that bleed over into the workplace. All this stuff, a lot of it's happening online. Threats being issued, people are ranting about things, e executive protection fell under my realm everywhere I worked in corporate security. So I've done a lot of it, I've overseen a lot of it, spent a lot of time on corporate jets with executives, spent a lot of time trying to make sure I'm aware of any threat to them. I think we saw the United Healthcare CEO's murder in New York City as a wake up call, a shocking event that's a wake up call. And I can tell you there's been some significant changes at United Health Group since then and how they protect their executives. You have to know what's being said about them. You have to know what's being uttered by anyone It all has to be taken seriously. It all has to be assessed properly by people who know how to do that. And if you're not collecting that data, so my world went very differently from when I started out, you get a phone call, hey, there's a a guy he just got fired over here in this building and he says he's gonna come back and kick his boss's butt. Well, okay. That's a threat. I'll take it seriously. Now everything's is online. So you have to capture it online. You have to be aware. You have to have, searches that are being done on a regular basis to make sure that anything that's being said about your CEO, your board of directors, et cetera, you know about it. Because if you're going to take them to a public event or a venue, or if you're going to secure them in their workplace or in their homes, and when they're an executive like that, you own all of it. You can't just say, you're on your own when you leave the building. That's not how it works. You can see how much negative, how much harm comes from not putting enough effort and energy. Now, that morning, I'm not criticizing anybody, but the morning that the CEO of United Healthcare was shot in New York, his executive protection team was in the hotel lobby. I think they were having coffee, and he just said, I'll walk over. No, you can't do that. This is not nineteen sixty four. This is 2025, 2026. You cannot do that. You have to understand that person, that person has a lot more riding on them getting there safe than just being able to go home. The stability of the organization, the reputation of the organization. I know I everybody in the world that understands executive protection took a look at that and said, You've got to be kidding me. You've got to be kidding me. He just wants to wander on his own. And executives can get like that. And I used to have discussions with them sometimes. I I'm not trying to smother you, but you have to understand what you represent.
Logan Willans: so when you're dealing with a threat environment, And this this can especially happen like a post-incident event, how do you go about managing principal anxiety? And then how do you also determine what is a legitimate threat? versus let's say like a dis standard chatter you might see online or l an average disgruntled customer, let's say.
DAN MURPHY: Well, I think it requires schooling, and I think you know this, Logan. If you don't understand the nature of threats, then you're gonna respond in in different ways than you should potentially. But emotions do kick in greatly. I had a case I did as a consultant once. For an organization that was a an e-commerce organization that sold a variety of products. And their one of their senior VPs I had worked with previously, and she called me up and they were all panicked. They had this this concern. Can you help us with it? I said, sure, sure. Let's have a call and just tell me everything about it so I can understand what's going on. Turned out they had sold, of all things, a bicycle to a gentleman about five states away. And he had called into their customer. service or customer assistance hotline at about two o'clock in the morning, two or three times in a row, different days in a row. And he was con sounded half drunk and he was complaining the bike is broken, kick your butts and you guys stink as a company and all this kind of stuff. And they got very panicked. Very panicked. They wanted to hire twenty four hour armed security for the CEO. They thought this guy was going to come in and kill everybody. And I had to I I said I said all right, look, let's okay, get it all out. Get all your emotions out now. Let's deal with what we actually know. Let's get the person's name. Let's find out is this person somebody who acts upon these sorts of feelings? Do they have a criminal history or not? This person is drunk. Let's listen to the tapes. I listened to the tapes. What the person said was, I don't drive, I rely on my bike. I said, okay, so you're concerned that this person. Who relies on his bike is going to somehow move five states here. He doesn't even have a bike that works by his own admission. He's going to come here five states away and carry out an act of violence. And he's not saying it's going to be an act of violence. I might do something, you know, that kind of stuff. And so after about a half an hour of sitting with him, I said, I'm going to save you guys, I think, a lot of money and a lot of time. Have you considered sending him a new bicycle? They didn't. Nowhere in this discussion was the guy was asking for a new bike. That's all he was doing. It's looking at what's really happening minus the emotion. And I tried to put it as nicely as possible. I said, This is what I'm hearing. Why don't we try that before we start calling out, you know, the Roman army to pro provide protection against the person who has no intention of going further than his mailbox? Let's get real. guy had no criminal history. I called his local police agency. They didn't know who he was, just some local guy. He was not a problem person. He was a drunken person at night who was upset he didn't have his bike. Get him his bike. They sent him his bike and they never heard from him again because it was obvious if you listen to what's being said as opposed to the emotion. How do you get people to calm down enough to do that? Sometimes you have to be the calm person in the room or on the call. And the Zoom calls are better, I think, because we can see each other, okay? All right, I hear you, I get it, I get it. But okay, in my experience, this is what I've seen. Studies have shown that this is what we're dealing with. Let's do A, B, and C. When you come up with a plan and that you feel they feel that they're part of that plan and they're being heard, that calms anxiety. Having no plan causes that anxiety. So if I sit with them, I say, All right, here's what we're gonna do. I'm gonna do A, B, C, and D. Here's my opinion as of right now is we don't need this. But we need to focus on this. And if they've brought you in as a consultant or as a c corporate security leader and you already have a good reputation with them, the chances are good that they will listen. But you have to be the calm person in that room. And sometimes I would even speak very low. Okay, this is what I think. Because then people have to strain to listen to you and they can't be emotion based. Lots of psychology comes to play. It really does, because you have executives throwing orders out. To spend all kinds of money on things. And the other side of the coin is you have situations where all of a sudden the money becomes after about two weeks of somebody threatens, let's say somebody in a bank branch, fired somebody, or customer came in and said he was going to hurt somebody. They said, Let's get some extra security there. Okay. We'll get an armed off-duty cop there every day. After about two weeks, the first bill comes in and they all go, Do we really need them there? To which I would say Okay. If you felt you needed them two weeks ago, what makes you think you don't need them now? Well, because it's two weeks he's probably gotten over it. Probably and hopefully are not life safety plans. So you had a cop there for two weeks, the guy wouldn't come by. You take the cop away, somebody walks in and does what you pray he doesn't, but he does it anyway. And now how are you going to explain? You didn't want to pay the money? Because you thought in your mind and in your shallow understanding of of threats, first of all, did you even look at what the threat really was? Did you look at the person's capability to carry out the threat, their ability to do it? are they aware of the consequences? What statements are being made? Or are you just reacting knee jerk? That's why you have to have a thoughtful, learned way to look at these kind of things. Based upon study, based upon training, based upon cases, based upon experience, then you can make the rational decision to have a practical, reasonable, defendable plan to prevent against it, as opposed to get five guys with guns right there, right now. I I don't want anything happening. And I've seen too much of that. But you're right, emotions are the biggest thing you have to manage.
Logan Willans: So just expanding on that kind of topic of emotions. So you mentioned after an e maybe a disgruntled employee issues a threat, or you know, a a tragic incident happens at a similar company, people's emotions may be elevated. So we're we're seeing that security is a very reactive industry. but as a security leader, what do you do during the happy days when, you know, nothing bad has happened, but you feel like you might need a new program? Or a new tool. So how do you how do you justify that? How do you prove value when things are going smoothly?
DAN MURPHY: You have to really do a business case. which is not easy for security professionals. What is this? What's the value of this? Because all they see is you as a cost center. You're costing your area is costing our company five million dollars a year, and now you want more? And nothing happens. People say nothing happen. Nothing happens because number one, we're very lucky, but we're not always gonna be lucky. And number two, because we take proactive measures to seek out information and intelligence. It's all about what you know. You can't just be reactive anymore. Just being reactive, we see the results, they're disastrous. They're disastrous, and companies are not prepared for it. Up to and including from a communication standpoint. I've seen c companies drop the ball significantly after the fact. By the say saying the wrong things to the media in in a heated, emotion drenched moment in front of a microphone at a press conference thrown together at an active shooter situation. I mean, crazy stuff happens. You have to put together a program and a plan. I actually outlined along with Randy Furrest, my co author in in our book that we came out with Workplace Safety. It's it's the whole the seven points, the seven areas that you will have to touch on, part of the miscommunications, but you have to be proactive in your intelligence gathering. Because if it's out there, I can guarantee you it'll come out afterwards. Let's say, for example, somebody is posting crazy things about your CEO, and you're not aware of it because people who hear about it or see it don't want to get involved and they don't report it. Well, then now you don't know what's going on. You haven't searched the web for threats, and all of a sudden something happens. Within an hour or two, Some intrepid reporter is going to have that posted on a national news show. They're gonna have that web, that page. They'll see it. They'll find it. They'll find it because they bothered to look for it. If you didn't bother to look for it, then shame on you because you just hurt your organization and maybe you lost a life. You have to know as much as you can know. So even in quiet times, there should be wheels churning, just as there are in information security. There's constantly work being done to strengthen the firewalls, to beat back the threats, to ensure that The data is secure. Just because nothing happens, well, that's that's a success, or it can be luck. You want it to be both. It has to be based upon a program and a plan that people don't see. They don't see your successes, they see your failures. I'd rather have a long period of peace where nothing's going on, where people think, well, I don't know what you do really. Well, I'll tell you what we do. And when you sit down and tell them about the plan, they go, I didn't know you did all that stuff. That's what you want.
Michael Collins: Dan, what are your peers talking about right now at the conferences and events in group chats or you know, private conversation? What are sort of what's what's top of mind in the industry,
DAN MURPHY: I think executive protection is going to be there for a while. I think number one, what happened to the healthcare United Healthcare CEO has resonated through the corporate security world in such a way that it has caused quite a few organizations to take an internal look at how they're doing things. So I think they're taking a look at the executive protection piece of it and not just the physical security piece of it. residential security. what travel security, where they're going, making sure that you're involved in organizations like OSAC and you're working with companies like IJET or Corporate Risk International, all these companies that can help you provide for safer travel for your executives. They have to travel. How do you do that safely? How do you mitigate against threats you don't know? You have to know about them. So they're investing in tools that can help them detect things. There are a great many tools that are out there now and organizations that can help you do that those deep dives and send your reports. We came up with this. You wake up in the morning, you you're a corporate security leader, you see an email. Four o'clock this morning on the dark web, this was detected. it's good to know. And it's from this organization. And then who's doing your intelligence work for you? If you hand over this information to somebody who doesn't have all the data, doesn't have all the information about that specific group, let's say the person belongs to, or that person in general. You give it to me, a guy named John Jones from whatever, Kentucky, wrote this this morning. Well, I want to know everything I can about John Jones too. You need to tell me the dossier kind of work. Who is he? Is this a guy that's an activist? Is this a guy that that mouths off a lot but does nothing more? Is this a guy that just got out of prison? Is this a guy that used to work for the company and is now ticked off? What's going on in this person's world, life? What is their goal? So that's the kind of stuff that you have to be on top of. You know, cameras are cameras and they're great. Access control systems are access control and they all do their job. But if you don't understand the nature of the threats against your organization and you're not open-minded enough to seek out tools to help you gain the intelligence that you need and to have it put through the gauntlet of of testing it for veri verif veracity, is it real? Is it true? Who are these people? Then you're failing. You can put all the big six foot five inch muscular guys with guns in black suits outside all the denales you want. But are you really? Doing what you need to do. And I think we can see with a guy like the United Healthcare CEO, and I hate to keep bringing up I hope you're him and his family are I know he hope he's resting in peace. I hope his family is doing okay. But they sh learn from that. We have to learn from that. All it takes is a minute. When your job is to protect somebody, protect them. Think of that person as your four year old kid. Would you let your four year old kid walk across the street right now at six o'clock in the morning, Dark Street, Manhattan, to a meeting because they say, I got this. No. Of course you wouldn't. Well, I'm not equating them mindset or capability-wise to a four-year-old, but value, absolutely. That person's represents a lot to a lot of people and must be protected. This is a big point of discussion I'm seeing. And like I said, tools are out there, there's lots of tools, and I always had experts that were focused on understanding the tools, the physical security pieces, et cetera, but the intelligence piece. understanding what you're dealing with and making informed decisions, having those quality third party partners that can help you assess and manage the threats in a professional way based upon years and years of experience as opposed to turning over a report to a group of executives who sit and look at it and go, what do think we should do? Well it's not your area. Nothing personal. You're great at what you do, but this is not your area of expertise. Find the experts, work with your experts, lean on them. Listen to what they tell you.
Michael Collins: Thank you. This has been incredible, Dan. you. we've heard some reservations or awkwardness from security leaders in conversations occasionally, where when it comes to the the PII of the folks that they protect, how do you navigate that? where you can manage their security and sort of maybe educate them on navigating those sensitivities, you know, w whether they're providing their IP address or other things to help secure them digitally and and physically, how do you cut through it? We've heard folks that are reluctant to have those conversations.
DAN MURPHY: It all starts with building a relationship with the executive. They have to trust you. They have to trust that what you're saying is for their best interest and for the organization's best interest. And you're not just doing it willy-nilly. You're talking to them on a person to person level, based upon my experience, based upon my expertise, and the people that I am dealing with who are experts in this area. A best practice in the industry is that a person in your position, their family, is minimal. About what they put out on social media. If you're going to go on vacation, post pictures after the fact. You really want to show that water slide you're at? That's great when you're home. Don't give somebody a chance to go meet you there. You have to have these conversations with them, but you have to first have that trust. If they don't believe in you, they don't trust in what you're doing, they don't see that what you're doing is based upon because I've been asked, well, who else does this? What other company does that? Always have those answers ready. It's never just I thought of this, let's do it. It's I thought of this, I looked into it, I found out these people were doing it, I found out this one was doing it, I talked to these guys, they like it. This is why. If you can answer the questions, you should be able to anticipate about why are you telling me how my eighteen year old daughter should post on her social media. I let her do what she wants. I'm the CEO, and I've had discussions With CEOs that haven't wanted to hear this at all. And I've had some of them who are great, and I've had a couple who are just, nope, I don't want to hear it. You still have to work around that, which means you have to tighten up your ability to gather information around that. And people will do what's counter to their well-being because they feel it's an infringement upon their freedom and their movement and their lifestyle. And I get that. And I would always preface it by saying, I understand, I do. I am trying to balance protecting you, your family, this organization, and allowing you to be who you are. But when you accept these roles and you get seven figure paychecks and you're a national, if not global, presence in media, you have to understand your position.
Michael Collins: Fantastic. What did we not ask you? what else should be included, please?
DAN MURPHY: I think with so many organizations going global in in many ways, because they either have subsidiaries that are working in foreign lands or they have employees in foreign countries and they have all that sort of stuff going on. I think it's it's easy to not understand the global landscape of where you're doing business. I had an executive once travel to a foreign country and the CEO was surprised to see me. He wasn't happy I was there. And at first I took it personally, and then I realized he just got off a plane, he's exhausted, he looks at me, he doesn't want to talk to me. I get it. That's fine. I really don't want to talk to you either, but I'm here to make sure you make it home alive. And so we were out running around, and I made sure there was two cars because in this specific country if something happens in the car that the executive is being driven and gets into an accident, the locals handle the accident on the scene. There's no calling the police and police reports. I was in the second car. If that happened, he was being extracted and we were moving on. He's like, What do we need two cars for? I said, Yeah. Abundance of caution. But I knew the landscape. I had bothered to look into it. I had people talk to me locally. This is something you should think about. And you have to be okay with that. You have to be flexible. You have to adapt. And you have to give your organization reason to trust you.
Michael Collins: Thank you. what are you working on now? And and how can others find you and and connect with you, please?
DAN MURPHY: Sure. Well, first of all, I have a lot of fun doing the podcast. I I'm a co-host of the Gold Shields podcast. I do that. We started almost four years ago, Tom Smith and I. Tom and I worked together in the MYPD. We interview people from whether it be law enforcement, victims of crime, military operators who've had incredible experiences, We had on the detective that arrested Scott Peterson for killing Lacey Peterson. Tom and I also have a company we call Impact Solutions. about five years ago or so, I met with a chemist and I decided There has to be a better way than pepper spray. and for a year and a half we went through sixty-something different iterations of of chemical formulations Impact is four simple ingredients. They're all food grade, mostly water, but they work very effectively at neutralizing a suspect by taking the eyes out. But the thing is it doesn't cause any lasting injuries. You don't need any of that stuff to happen. You just wanna be able to get away. and that's all it takes. And other than that, I'm enjoying life in sunny Florida, which is beautiful. And I'm gonna go enjoy the rest of today in sunny Florida when I get done with you two gentlemen. But
Michael Collins: Yes.
DAN MURPHY: I really appreciate the opportunity to speak with you both and I hope it's been of some value.
Michael Collins: Yes, sincerely has been amazing. so grateful, Dan.
DAN MURPHY: No, it's been my pleasure.
Logan Willans: Yes, thank you, Dan.
