The Farmer and the Donkey: A True Fable About Threat Intelligence
In 2023, election strife struck Guatemala when the government in power worked feverishly to disallow election results that presented a reformer as the victor. Outside of Central America, the news likely registered as a blip—if it registered at all.
Automotive component manufacturer Yazaki North America had just opened a major facility in Guatemala, so it was monitoring the situation closely. And when election unrest grew and spread, protestors blocked Central American Highway 2 (CA2), the main—and in many places only—ground vehicle artery connecting North and South America. All of a sudden, dissent surrounding the Guatemalan election became an incident of acute strategic importance.
“You can’t make this stuff up,” says Mike Moorman, CPP, PCI, CSMP, senior manager of corporate security at Yazaki NA, describing getting reports from his shipping contractors that CA2 was being blocked by farmers who had driven their donkeys onto the roadway.
“When we think of a protest, we think of a town square or thousands of people in a big park or downtown area,” he says. “It’s a nice, organized rally, with signs and chants. Down there, it’s more rudimentary. The farmers literally grab their little wooden carts, hitch them to their donkeys, and they’ll get together en masse to block the road in protest. And another group of farmers 10 miles down the road is also upset, hears what’s happening, and does the same thing.”
That adds up to a major supply chain headache to companies who rely on CA2. When the blockades gum up the highway for not just days, but weeks, as happened in 2023, it really messes with companies like Yazaki NA, which has made significant investments not just in Guatemala, but in El Salvador, Nicaragua, Mexico, and other countries in the region.
“We were hit going both ways,” Moorman says. “Anything going south out of Mexico, which is where a lot of our raw materials come into port, couldn’t get through. And we couldn’t get assemblies made in Guatemala further south to our facilities in El Salvador or Nicaragua, where additional work is done before being sent back north.”
Moorman adds that while the CA2 being part of the Pan-American Highway may conjure thoughts of roadways like the U.S. interstate highway system, that is not the case.
“It’s a good road, but it’s probably not what people think of when they think of a major thoroughfare. There are places where it’s long stretches of two-lane road,” he notes.
Crucially, the road runs through many rural areas of mountainous and jungle terrain. The protests in Guatemala were not limited to the larger cities. In fact, the real supply chain headaches in 2023 were in the rural areas. In some places, there were other no ground transportation routes suitable for large trucks to bypass roadblocks. Even where alternatives might exist, protestors often blocked the secondary arteries as well.
“We also have restrictions placed on us by our insurance carrier,” Moorman adds. “There are approved routes, and for routes not approved, you don’t go there.”
Other transportation options exist, but rail freight is underdeveloped in the region, and moving the material from port to port would invite a lot of additional onerous detail-setting and coordination. That left air freight, which would add millions of dollars of expense.
While the incident itself is unique—there aren’t too many places you need to be worrying about a farmer blocking a highway with his cart and donkey—Yazaki NA’s experience is not unusual. In the ASIS International Threat Intelligence: Understanding How Threat Management Supports Resilient Organizations study, sponsored by Esri, more security professionals reported “civil or political unrest” as the source for an incident that “caused a serious business disruption in the previous 18 months” than any other category. The “supply chain disruptions” category came in fourth place, so Yazaki NA hit both of those birds with the same stone.
It sounds like a problem with precious few solutions, and indeed, the situation proved intractable for organizations that rely on CA2, including Yazaki NA. Moorman takes a couple of lessons away from the experience.
One is the importance of intelligence—particularly multiple forms of intelligence.
Combining Intelligence and Analysis
Yazaki NA employs a consultancy with expertise in the region. As large employers in the countries where it operates, Yazaki NA has strategic ties to various national and regional governments. The consultants advise Yazaki NA’s governmental affairs staff while providing intelligence on geopolitical situations of importance. Yazaki NA also utilizes open-source intelligence (OSINT) and specialized intelligence services.
When the Guatemala election situation developed, the consultant company ensured Yazaki NA executives were informed of the developing political ramifications that could affect their new operations in the country. They did not, of course, presage that protests would shut down their important supply chain route for days. The first indication of that came from the OSINT sources, which Yazaki NA was able to verify and dig into because the consultants gave them a boots-on-the-ground presence.
The combination of intelligence sources gave them a good idea of the extent of the problem, and the consultant’s connections provided the analysis that the problem was, unfortunately, not anything that would likely be cleared quickly.
Yazaki NA took the actions it could, rerouting what could be rerouted and making adjustments to facilities both downstream and upstream of the supply chain blockage. Moorman says the company’s response was enhanced because of the human intelligence provided by the consulting company.
Interestingly, the company’s relationship with the consultants developed because of a somewhat similar previous incident—one that predates Moorman’s time at Yazaki NA. Yazaki was the largest nongovernmental employer in Nicaragua, but it did not have good insight into the government there. When student uprisings created havoc in the country, the company reached out to a crisis management firm with expertise in the geopolitics of the area.
“When you’re operating in these countries that are still developing, it’s a lot different than what we’re used to in the United States,” Moorman says. “We operate in countries with dictatorships, which is a different dynamic. You really need someone that when you see something developing, you can pick up the phone and give someone a call,” and they can instantly give you an assessment of what is going on and where it is likely to go.
“I have Dataminr and 20 other different programs in here, and I have analysts looking at all of that, and that’s one piece of the picture,” he continues. “But that’s just one piece. You really do need someone you can trust to confirm what you think you’re seeing and to help you understand the implications.”
You really do need someone you can trust to confirm what you think you’re seeing and to help you understand the implications.
Demonstrating Value Amid Disruption
A second lesson was the confirmation that the way the company approaches its corporate security function drives value in these situations. Moorman describes security at Yazaki NA as a “jack-of-all-trades” function. It has all the common physical security responsibilities, such as access control, perimeter security, and surveillance, and security also plays a central role in the company’s risk and crisis management functions.
Take the security operations center (SOC) as an example. The SOC has hybrid responsibilities that include physical security operations as well as serving as a risk intelligence and analysis center.
“Whenever something like [the Guatemala election unrest] pops up, quick phone calls get made,” Moorman says. “We gather intel quickly and then assess the event to see what we need to do about it. Having that visibility in a centralized location is very helpful. So, while we’re doing some physical security things in here, we’re also doing situational awareness and risk intelligence.”
This allows Yazaki NA’s corporate security function to be successful as the company’s primary convener of the crisis management team.
“In this instance, it was a crisis for our supply chain people and manufacturing and our transportation people,” Moorman explains. “Those are the people sitting around the table, and we’re talking to our government relations people who are interacting with our consultants in-country. So, while the crisis is occurring in these other areas, they all turn to look at corporate security for help. And that’s a good thing. We are able to facilitate the process. We ask the questions: What do we know? What do we need to know? What is the status and how is it changing? We are able to guide the various areas through the process to making the decisions they need to make.”
In the Threat Intelligence study, 79 percent of security professionals said threat intelligence played a highly important role in crisis management (and another 20 percent said it was somewhat important, leaving just 1 percent who said it was not important).
The CA2 as a point of risk for Yazaki NA was always part of the equation. Impacts from weather (the area is prone to tropical cyclones and the occasional Atlantic hurricane) and earthquakes and volcanic activity (Central America features five tectonic plate boundaries) have caused disruptions that can last several days. In the case of weather, the company would typically have a day or more to plan for possible adverse effects.
So, while the crisis is occurring in these other areas, they all turn to look at corporate security for help.
When asked to give an example of intelligence leading to a critical success for the company, Moorman related a weather-related incident.
“It’s maybe not as glamorous as a farmer and his donkey, but just last winter brought a forecast of abnormal weather coming through the [south]-central part of the U.S.,” he explains. Yazaki NA has two plants that were in the line of the storm in Tennessee, one in Memphis, the other in Nashville.
“You dump 8 inches of snow up here in Michigan, and I just put my truck in four-wheel drive. There? Nothing moves.”
The intelligence enabled the company to avoid a crisis by making changes to operating hours and days in the affected facilities, as well as the facilities downstream from the affected ones.
“We got hammered in Tennessee, but our factories in Missouri and Illinois and Indiana didn’t get hammered. They’re still expecting finished good product to come to them for their car lines,” he says. “The last thing we ever want to do is shut a customer line down. …To able to see that coming and have a plan in place with almost no disruption was really important.”
Stray donkeys, or incidents that are so unique they simply can’t be planned for, could potentially impact every organization. When companies face their own farmer and the donkey experience, Yazaki NA’s experience shows they will be best served if they have a strong intelligence function that is integrally plugged into crisis management, risk management, and business continuity practices.
Scott Briscoe is the content development director at ASIS International. He served as project lead on the Threat Intelligence: Understanding How Threat Management Supports Resilient Organizations study, and he will now always be on the lookout for donkeys when driving on highways in Guatemala.
