CARVER: Criticality vs Accessibility

CARVER: Criticality vs Accessibility

The relationship between criticality and accessibility has been studied habitually by military, law enforcement and security personnel since the Vietnam war. Criticality and accessibility are only two of the six factors measured using the CARVER model, which has been an accepted methodology in the security industry since its inception. CARVER is an acronym used by industry professionals to assess overall client risk and is comprised of the following elements: Criticality, Accessibility, Recuperability, Vulnerability, Effects and Recognizability.

Criticality is the measurement of the degree to which an organization or individual depends on a person, system, or information for what they have defined as success. Some examples of critical individuals include but are not limited to C-suite employees, politicians, professional athletes, artists, and celebrities. These high performers are typically high net worth individuals and are at an increased risk for death threats, assassination attempts, kidnappings, and extortion. However, many people that occupy these positions understand their criticality and have hired security professionals to protect them and their assets.

Most entities recognize the criticality of these high performing individuals but many individuals and organizations overlook the need of security for their family members. This has been a well- documented issue for a century and was most recently highlighted in December of 2021 in the attempted kidnapping of NHL legend Patrick Marleau’s son at a hotel pool. Patrick did not have a personal security team and the kidnapping would have likely been a success if not for a random hotel guest intervening on the child’s behalf.

Tushar Atre, the CEO of Atrenet, a digital marketing firm, was kidnapped while sleeping in his bed and later killed in October of 2019. The assailants were disgruntled employees that collected a ransom and then decided to kill him anyway. He was found in his BMW parked on a property that he owned. Besides the horrific effect that his death had on his family, Atrenet suffered as well and is now attempting to revitalize the company. It is also relevant to acknowledge that this story indicates that people do not have to be instantly recognizable to the public to be targeted by criminals.

The budget and personnel required for effective security may look different for different people and organizations based on the CARVER measurements and the Executive Security Risk Assessment. Higher risk requires additional resources to preserve the safety, security, and reputation of the client. For example, in 2020, Facebook spent 23.4 million dollars for personal security for Mark Zuckerberg and his family. An additional consideration for publicly traded companies, is the effect that a security related incident may have on the share price. If an incident affects the share price, it will likely increase the volatility of the stock and deter large investors. This can result in short term financial damage for the company.

Accessibility is the measurement of how likely a person or group can exploit a system or entity. This measurement has proven to be one of the most relevant and one of the most overlooked by individuals and organizations. Individuals that have been chosen as targets are usually chosen because they are deemed to be more accessible than other potential targets. Criminals generally weigh the probability of success with what is to be gained from their criminal activities. If a politician has a Secret Service detail with them around the clock, they are not as accessible as a person who has a no security or a limited security presence. A common mistake is to assume that assailants are not interested in targeting people that are not easily recognizable to the public. It is improper to assume that these people do not need protection.

A good example of this mistake is the kidnapping of Kevyn Wynn the daughter of casino operations manager Steve Wynn. Steve had overseen the construction and operation of several Las Vegas casinos including the The Mirage. Two men broke into Kevyn’s condo and forced her to call her father on his car phone. When Steve received this call, he thought that it was a joke
because he had assumed that his status was not high enough to attract this kind of behavior towards his family. The men demanded that he consolidate and deliver bags of cash from The Mirage as a ransom for his daughter. The ransom was paid and they recovered Kevyn around midnight in an airport parking lot. Steve later learned that the assailants forced Kevyn into an
inappropriate photo shoot which they threatened to release publicly if there was an investigation into the crime. Steve was not a celebrity or even a CEO but he was critical enough to serve the purpose of the assailants.

Criticality and accessibility are not restricted to the physical security of people. They also apply to critical infrastructure and cyber security as well. Hiring a trained security professional to analyze and optimize the information that can be found on the open web is a necessity because the internet is the primary source of general information for criminals. For example, the children’s sports teams, game schedules, locations, and times can usually be found online. This information cannot always be restricted but having the awareness of its existence allows security teams to accurately assess the risk and reduce the impact of vulnerabilities. When analyzing the relationship between the two, it is important to recognize that risk lies where criticality and accessibility intersect. Although these two are truly relevant factors in assessing risk, they are not enough by themselves to properly identify and understand entire picture. The other elements of the CARVER model are also important for creating a comprehensive risk profile. I would recommend hiring an experienced, licensed, and reputable security company to perform an Executive Security Risk Assessment and explain the details of their findings.


David Hobson, MBA is a project manager for LaSorsa and Associates, and former US Army Airborne Infantryman.

Leave a Reply