Business travel in high-risk areas: Key precautions for leaders

Understanding the risks

Business travel has always come with risk, from theft to unexpected health issues. But the global economy and today's political climate have exposed corporate travelers to new risks.

• Physical security threats. As the recent events in the Middle East showed, corporate travelers in geopolitically volatile environments are vulnerable to several possible threats, including armed conflict, terrorism or kidnapping.
• Cybersecurity threats. Corporate travelers can be easily identified and targeted for state-sponsored surveillance, network interception or device seizure at borders.
• Infrastructure vulnerabilities. Depending on the area, corporate travelers may have to contend with limited medical facilities, unreliable communication networks or power outages.
• Legal and regulatory risks. Travelers may find themselves subject to sanctions violations, visa complications and arbitrary detention.

Risk assessment framework

Before deciding to travel, organizations can monitor the political landscape through government agencies such as the State Department. The Smart Traveler Enrollment Program (STEP) sends security updates, safety alerts and emergency assistance from the nearest U.S. embassy or consulate to U.S. citizens traveling abroad. Local news and threat intelligence reports can also be monitored when evaluating potential business travel.

Managers should consider whether their objectives can be met remotely. If not, they must have adequate protocols to protect their employees and a contingency plan in case conditions deteriorate, as they did recently in the Middle East.

Companies may consider creating a travel risk classification system from standard "low risk" protocols to "extreme risk" travel to volatile areas. Such mission-critical travel would require board-level approval.

Once it's clear that travel is required, management must obtain employee consent, ensure that security measures and emergency response plans are in place, and provide destination-specific training to the employee.

Travel should be denied if travel bans are in place, adequate security measures can't be provided, or if the risk outweighs the business value. In these cases, remote tools, local consultants, or postponement will have to be used until circumstances change or new meeting locations can be determined.

Technology and data security protocols

Cell phones and other personal communication devices transmit and store valuable personal data. Before embarking on a business trip, steps must be taken to protect those devices and any personal identification data, including addresses, dates of birth and Social Security numbers.

Before leaving for a business trip, travelers should remove all sensitive data from their devices, update the software, enable multi-factor authentication and back up all data. Pack devices and chargers, and disable auto-connect features for Wi-Fi and Bluetooth.

While traveling, keep devices secure in public places such as airports or hotel lobbies. Consider using privacy screens on devices. Avoid using public Wi-Fi. Do not use the same passwords and PINs abroad that are used in the U.S.

Legal and compliance considerations

Now more than ever, it's important for organizations to complete due diligence on jurisdiction-specific requirements in the regions where their employees travel. It is their duty to document all risk assessments and obtain adequate insurance coverage.

The organization should research visa requirements, work permit restrictions and the region's anti-corruption laws. Compliance with any applicable export controls, such as International Traffic in Arms Regulations and Export Administration Regulations, should be ensured before travel.

Full disclosure of the risks should be provided to the employee, and an acknowledgement of the dangers and a willingness to travel should be obtained.

Preparation and training requirements

The traveling executive training prepares him or her for any situation that may be encountered while abroad. Hostile Environment Awareness Training (HEAT) is a multi-day course that teaches the skills and attitude needed to enhance personal security in hostile environments. It should be paired with cultural sensitivity training and a briefing on local customs. Protocols for emergency response and possible evacuation should be provided as well.

Other essentials include an emergency contact list, secure communication devices with backup power sources, copies of passports, emergency contacts and a power of attorney.

Accommodations in the host country should include hotels known for high security. Secure transportation should also be arranged in advance whenever possible. Travel arrangements should be kept between the employee and the employer.

During travel protocols

Once on the ground, the traveler should maintain a low profile and check in with superiors at pre-determined intervals. During check-in, they should advise the company of any potential risks reported in local news outlets. The traveler also needs to stay close to their hotel and vary routes to and from to prevent pattern recognition. Social media posts that could compromise the employee's location are not acceptable.

Post-travel procedures

It's important to examine all personal devices for security assessment or malware when the employee returns. If uncompromised, the devices must be reimaged before reconnecting to the corporate network. All passwords should be reset at that time.

A debriefing should be held to discuss any incidents or concerns that arose during the trip. The information can be used to help plan for return trips.

The organization will maintain incident documentation, update risk assessments based on current intelligence, and ensure it has all compliance documentation required for regulatory requirements.

Julie Hanson is a freelance writer who has reported on local news across Massachusetts and New Hampshire.