Opportunities and Challenges in Middle Eastern Security

Steven Kenny (: 00:00

Hi, and welcome to today's episode of Security Tech Talk. Joining us is a good friend and colleague of mine, Tertius Wulfart who is the architecture engineering manager from Axis Communications covering the Middle East and Africa. With nearly two decades in the security industry, Tertius has built an impressive career holding various roles in product management, training management, and for the last 10 years, has built business development programs and an architecture engineering team. A respected public speaker, Tertuis is regarded as the fountain of all knowledge when it comes to the unique standards and regulations that influence how security are designed and installed across the Middle East today. Today, we’re diving into Tertius’ insights on navigating regional security standards and his perspectives on designing systems that meet the demands of some of the most challenging and high-profile projects. Tertius, it’s an absolute pleasure and honour to have you on the podcast today. So welcome to today’s episode.

Tertius Wolfaardt (: 01:14

Thanks for having me Steve, thanks for the opportunity.

Steven Kenny (: 01:03

So before we kick off and we do a deep dive into the standards and regulations that we're seeing focusing on the market today, I'd just like to get your views in terms of the size and the scope of the opportunities that we see across the Middle East, because obviously we’re seeing unparalleled levels of investment taking place across this because of that, we see a huge amount of interest from different organizations, whether they be huge consultancies, large system integrators, and even end customers looking to relocate to this market. So I'd just like to get your insight and your views on the market, so a high level overview on where you see it today.

Tertius Wolfaardt (: 01:45

There’s a lot happening in the region. You can go into a lot of details on which countries do have a lot of new things happening. But if you look at the news, you look at everything around us today, you will see that there's such a big focus on countries like Saudi Arabia, where all these massive giga projects is getting a lot of attention. You will see that people talk a lot about projects like the line, there’s so many things in the news. If you go to YouTube, you'll find all these amazing videos. But there's such a big growth and such a big potential in the region and that's probably why everybody's flocking here is because of all these opportunities. There's so much opportunities for a lot of people and a lot of specialization to come to the Middle East and to bring that expertise from other parts of the world and come and apply it here. And if you just drive around, if you've never been to Dubai, just look at some of the buildings that you find in Dubai.

There's all these amazing architecture buildings and some of the things that we've seen in countries like Saudi is even on a higher level. So some of these designs and some of these visions that the countries themselves have, are really revolutionary. But really, it's this really fascinating type of projects that the guys are looking at. So as an overview, I would say there's a real, real focus on things like hospitality, a lot of new, say tourism, the Middle East traditionally is a big focus on things like oil and gas but these resources will only last us for so many years. So, a lot of diversification is happening in where, how can we get revenue from other streams? And if you again, if you use Dubai as an example, Dubai has been exceptional in that way, that reliance on having oil and just money from oil is now next to nothing where tourism is driving Dubai and they're driving the economy. And I think a lot of countries like Saudi as an example want to follow a similar model where, how can we start diversifying and not be completely reliant on one resource as an income stream for the country? There is really a lot of opportunities, but also, as you mentioned in the beginning, there's a lot of things that people need to be aware of and be mindful of. So Dubai, as an example, is a much easier place to work in and to do business where some of the other countries might be a lot more difficult and challenging to actually come and do business. So you don't just fly, get on a plane and do business in a lot of these countries. So these things you also need to consider.

Steven Kenny (: 04:23

It’s an interesting one when you mention the fact that they're looking at some form of diversification in terms of what they're doing to generate money. I think there is some form of mis-preconception in terms of some of the maturity of the regions and how it is heavily oil related. I know the UAE, it does vary across the different Emirates, but the GDP output from, say, oil is vastly different from Dubai to Abu Dhabi. And actually, it's fairly small in comparison to the likes of hospitality. And I think that Dubai is seen as one of the top five holiday destinations of the world. So that is ultimately why there is a huge drive to this marketplace. If we look at some of the developments online, as you referenced, you go online, you see some of these huge construction projects. I don't think globally we've ever seen developments like it on the level of investment, if you take a snapshot in time and you look at that and you see where the investment is coming from, it is not solely from these countries. It is from international banking organizations, finances, from government, it's from a whole plethora of different organizations are investing in these markets. It’s very exciting for the region. So obviously being mindful of the subject today, I look at how regulations and standards influence how we see systems, especially security systems being designed, I think it's fair to say that the Middle East or the Gulf states are very, very unique in what it is that they're looking to deliver. Rather than get into that specifically now, what do you see or why are they creating such stringent rules and regulations on how security systems should be designed, installed, and commissioned?

Tertius Wolfaardt (: 06:07

If you look at, and again from my perspective, the reason why you would find these type of regulations in various countries is it could be that the climate itself is very strict or very difficult. Again, if you've ever traveled to the Middle East in the summer months, it gets extremely hot here. So there has to be some sort of a guidance from government to say that these devices are actually fit for purpose, fit on the environment. Then you also have to think, what is the outcome? What would they like to achieve by having these type of systems? Now, if you've ever been to the Middle East, you come to a country like Dubai, it's an extremely safe place. And you will see that you feel safe because of the security systems that are in place and you trust the city, you trust the government, you trust what you see around you and you have this general feeling of safety. But also what we do see a lot in these cities these days, is that devices are becoming multipurpose. So you might think that it's only a security camera, but there's so much happening, especially in markets like retail and hospitality where the whole VIP experience is so important for them. So there's so many different elements that needs to be considered and just think to yourself again if you come to Dubai the moment you set your foot off the plane it's all about the experience. You always think to yourself, “what is the experience I had in Dubai?” And you want to come back. You want to come back to Dubai because it's a nice place, it's really good, it's a safe place and you had this amazing experience traveling to this part of the world and it's all about being treated as a VIP. and that all fits into what does devices need to do and what is the purpose of these devices.

Steven Kenny (: 08:00

If we touch Maslow's hierarchy of needs, other than the fundamentals of, you know, water, food, next up on the list is safety and security and how people feel, where people feel safe is that's where they tend to gravitate towards, that's where they tend to relocate to. In the UAE alone, I think they were saying in 2024, there's going to be 250,000 extra children coming to the UAE that need school places. So yeah, the level of development is incredible. What I think we need to address and look at is although the Gulf states countries across the Middle East have very strict guidelines, they're not all a true reflection or there's not one that matches the other. They're all very in their own unique ways. So what does this mean? How do you see that creating challenges or what are the important considerations?

Tertius Wolfaardt (: 08:53

What we do see is that, doesn't mean that if you've designed the project for Dubai, that it will be working and it will be applicable in Abu Dhabi as an example. So typically one of the challenges we see is that a design might happen from outside of the region. So a very good example is typically a project could be designed in the UK and you have your own sets of rules and regulations that you tend to follow when you design a system for a project in the UK. Now, again, if you compare the climate from the UK to the Middle East, it's a completely different story. So if you've not taken local laws and regulations into consideration, it means that when the project gets evaluated by the local regulator, that you will get a non-compliance. Now you think maybe that's not a big deal. What's the worst that can happen? Now the worst that can happen is that a non-compliance means you don't get a trade license. And a trade license literally means you cannot open your shop. Irrelevant if your shop fitting and your shop is 100 % approved, every other aspect of shop, if you don't have a trade license, your security system is not approved by law, you're not opening your doors. The implication of that is customers are having shops that are ready to the public and ready to start doing sales and generating income, but they literally cannot open their doors because the security system is the last checkbox that is not in place.

Steven Kenny (: 10:25

So what you're saying is that a business it can be ready to open its doors to the customers. The video surveillance system that has ultimately been deployed, if that hasn't been designed and installed correctly, that that can impact the business's ability to open up to the public and to trade?

Tertius Wolfaardt (: 10:46

Exactly, exactly.

Steven Kenny (: 10:48

Yeah, I guess, it's both a nice position to be in and also one that's probably very challenging because if we look at many of the other countries around the world, video surveillance, security systems, they’re nice to have and there's very little legal guidance or regulations to determine whether or not a security system is even needed. It's usually done on the threat and risk of the landscape that someone is looking to utilize.

I guess that is a bit of a crazy concept to most people and I guess that's why if a system is being designed from outside of the country that there are some challenges. So I think you've answered the question, but what would you say the biggest implications of getting a system wrong other than to an end client? Obviously not getting your trade license, being able to open your doors for business is a challenging one.

But what about those that sit within the supply chain? What about those that are actually providing these to a customer? What are the consequences for them not getting this right?

Tertius Wolfaardt (: 11:50

There’s a few consequences that you need to consider. So again, if you've followed a completely different design philosophy and the design standard, some of the other things is you can have, for instance, your system completely under designed. So which means, first of all, that you maybe need to add 50 % or 20 % or X amount of additional devices that you did never take into consideration. So that's the extreme case where you will get an inspection, you'll get a rejection, and then they'll give you a list of comments and say, you need to buy additional equipment. You need to expand the system because there are areas which you are not actually covering as per the law. So until you've rectified this, you're not getting anything.

The second side is talking about supply chain is that because it's not approved, you're not getting a sign off and literally things like payments and everything. The commercial side of the project is literally getting delayed. People can get penalties because of the shop itself probably not opening on time. So there's a whole financial aspect that you also have to take into consideration. And then there's also the legal aspect that you have to take into consideration that what if something goes wrong and you don't have footage. So for instance, if there's an incident on site, somebody gets hurt or the shop gets robbed, police come to do an inspection and you don't have that incident on evidence, what is actually happening from a police perspective? So there's a lot of considerations that you also have to take into that account. And lastly, what we also see is in some countries, they go as far as to say, you have to be a security approved consultant by law.

So meaning, if you haven't gotten that stamp of approval from a local consultant that has gone through the checks and balances as needed by government, again, you open up a whole can of worms which you don't want to open, where you didn't follow the procedures as per what you need. Somebody didn't validate this, which was actually supposed to validate this. And then you can literally delay the whole process.

So depending on how far you are from the right design can literally mean delays of months from the shop actually opening up. Because in some countries you also have to take things like the storage period into consideration. So, in some parts of the Middle East, you need as much as 180 days worth of retention on your storage.

14:38

And what it means is if you don't have 190 days today, the authority will come back in 190 days from today and double check, do you actually have 190 days footage? So, these checks and things are really, really, really important. You should not underestimate the complexity of not being compliant.

And also you should really take it serious because in the long term the customer himself is actually having a financial hit on not opening a shop, his reputation. You can imagine if you go to say a shopping center and you see a shop that is not open for the last six months, you think to yourself, what's happening here? Why are these guys not opening up? And just think to yourself, the last sales and revenue of that last six months, what is the implication of that to the customer?

Steven Kenny (: 15:20

Yeah, I guess from a liability point of view, that is, it's going to be incredible, isn't it, to think that you've got potential loss of earnings, you've got any costs related to reputational damage. But I also think that the interesting one will be okay, right? We have a mandatory set of regulations that dictate and influence how these systems should be designed and installed.

And if that isn't met, I can imagine there is no end customer in the world that says, it's our responsibility to cover the additional costs because ultimately we passed over that responsibility to you, our contractor. It is your responsibility to make sure that that is compliant. Have you got any examples, not by customer name, where someone may have designed a system from a different part of the world and when it's been pushed out into the marketplace or it's been open for review, someone's gone, that doesn't comply because say in Europe, that type of site we need to 300 cameras. But actually in the Middle East and a bigger project to comply with the local regulations there, we need a thousand. Is that a common occurrence or are people more up to date and understanding that, okay, these are things we need to consider now. We cannot design systems in the same way. We need to be up to speed with the localized standards and regulations.

Tertius Wolfaardt (: 16:46

Out of experience, what I've seen during the last few years, I would say that you wouldn't have those extreme cases where you would have a completely under-designed project. What we do see, for instance, is that the wrong use cases and the wrong devices were selected. So let me give an example. In countries like Qatar, by law, you have to have...

a specific rating on your cameras which is called IK10 and IP66 and that's applicable to all cameras even indoor cameras and what people tend to do is they tend to say but why do I need to use an outdoor camera in indoor environment?

So now you find the projects being designed, typically the locations and everything is okay. But once it reaches the evaluation, immediately the customer will say, but or the evaluation or the MOI or the person actually evaluating this will then say, but you used the wrong type of device in an indoor environment. This is non-compliant because you didn't follow the rules and the standard. So please change this to the correct model that is compliant with these standards that we need. And it's not a big job, but the difference in cost between, say, an indoor versus an outdoor device that has those additional housings and certifications and things could be 15 to 20 percent price difference from changing from an indoor to an outdoor device. Now, again, if you have 10 cameras, it might not be such a big deal, but imagine you work on a project where you have a thousand cameras and 70 % of your cameras are indoor and 70 % so again in your thousand camera example so means 700 of your cameras you need to change from an indoor to an outdoor model and now all of a sudden you have 20 % additional costs. Where's that going to come from, who's going to pay for that, is that covered by the consultant is that covered by system integrator is that covered by the manufacturer so who's the ownership and who's the responsibility is then to say okay I made a mistake, I didn't follow the regulations, please change from model X to Y and these are some very very common challenges that we typically see.

Steven Kenny (: 19:15

Yeah, I like the way you talk around, sort of thousand camera systems. You do realize in the rest of the world it's abnormal, sorry in the way that these systems don't really exist other than in the Middle East. So making these mistakes is incredibly expensive. One question that I'm trying to fathom and get my head around is obviously we've got all these standards and these regulations. Is this applicable to all environments, all businesses?

20:01 - Tertius Wolfaardt (Guest)

So if you look at different countries for instance, you will find that in the UAE, Dubai is an example, and what is applicable to Dubai and what is applicable to Abu Dhabi is totally different. So some countries break it down into a lot more detail. So you will find in some of the regulations they'll say if you have, for instance, a hospitality project, this is what is applicable to hospitality. If you have something in airports or critical infrastructure, this is typically what is applicable to hospitality. If you have something in airports or critical infrastructure, this is typically what is applicable. Now, the exception typically to this is when you go to Saudi Arabia, where, in Saudi, you typically have the two main regulations. The one is from the Ministry of Interior and that pretty much covers any project except critical infrastructure and typically any industrial type of project. Now industrial projects are covered by something called HCIS, which is the High Commission of Industrial Standards in Saudi Arabia, and that is applicable typically to critical infrastructure. So they go into a lot of detail on what do you need for the perimeter, what do you need for different areas of the site, etc. So they break it down into quite a lot of detail. But most commonly we see that the standard or the regulation is broken down into what is the type of project that you're working on? So, is it a commercial? Is it hospitality? Is it a stadium? Is it an airport? And then in those areas they would say okay, for a stadium, you need to consider cameras in areas a, b, c, d, e and for the stadium, you need to typically have a retention period of 30 days or 60 days or 90 days, depending on the country. But then again they would go into detail like what resolution do you need to consider, what frame rate do you need to consider? And in some cases they would even go on to say if you work in certain environments, you also need to consider things like failover. So if something goes wrong and the system goes down again, if you work in a project with 1,000 cameras, what happens if that server goes offline? How long should it take the system to go into a recovery type of scenario? Because you don't imagine you lose a camera, 1,000 cameras for five minutes. It's chaos, it's literally both sides blind for five minutes, which can create absolute chaos in those environments.

22:32

he DORI standard, which is EN: 62676

23:29 - Steve Kenny (Host)

Let's be honest, the Middle East is an incredibly unique environment in terms of temperature. You know what's the thought process around that? Because there is absolutely no way, if you have a device in the UK, at best it just needs to be waterproof and it needs to be very, you know, consistent in grey, wet weather, that's absolutely fine. But the Middle East, the temperatures, the environmental conditions, they are extremely, extremely extreme. What's the thought process around that? How do organizations test, how do they do proof of concept and what are the requirements there?

24:06 - Tertius Wolfaardt (Guest)

People tend to think only of the temperature element of it. So if you've ever been to Dubai, say August, september month, then there's something else which becomes a huge problem and that's the humidity. So, for instance, if you go to countries like Saudi Arabia and you go to cities like Riyadh, it's very hot and very dry, but then if you come to Dubai or you go to Abu Dhabi, or you even go to the eastern side of Saudi Arabia, you go to Daman, or you go to the western province, you go to Jeddah the humidity certain times of the year is extreme. So you have this unique challenge where you have very high temperatures but you also have very high humidity that you need to consider. Now, what we typically tend to do is we tend to go into some specific temperature standards that you need to look at, but also what the government itself looks at when they look at standards from a regulatory perspective is they would say that that product needs to be tested and validated for typically GCC or Gulf environments. Now, for those of you again who've never been to the Middle East, we typically can buy cars in the Middle East that are a Gulf or a GCC specification. Now, that's very unique in this part of the world and that means that that device has, for instance, or that car has upgraded cooling to cope with the temperatures.

25:37

Now in our world, from a camera perspective, the temperature is one thing, but very common in our part of the world there's also people repainting cameras and we see sites where cameras are painted black of all colors and then these devices are supposed to run 24, 7, 3, 6, 5 with no issues. So there's a lot of elements from from a temperature perspective, which adds additional challenges and really it's actually very, very difficult to to test and to validate, because what we also see, sometimes you do the proof of concept in in the cooler months, like January, and then everything looks amazing because it's not that hot outside, it's really pleasant in January in Dubai. Come the summer months June, July, August, September and then things go pear-shaped because the device has not been validated and tested to really work in those hot climates. So it is definitely a real challenge.

26:33 - Steve Kenny (Host)

It is a very, very unique environment certainly. You touched on something earlier and it was in terms of not just licensing of businesses. You referenced licensing of consultants, licensing of people that are installing kit. What's the thought process behind that? Is that something sort of across the whole Middle East? Is it in certain countries? What's needed by organizations looking at the Middle East thinking this is a market I want to work in? What are their considerations for that?

26:58 - Tertius Wolfaardt (Guest)

Again, it depends on where you are in the Middle East. So, as an example, Dubai is very advanced in this process or very far along in this process. So if you look at Dubai, if you want to be a security consultant, and in Dubai we have something called CIRA, which is the security regulator, they validate and they actually test consultants. They give them an actual exam and then you are, you get a certificate to say you are a zero approved security consultant for projects in Dubai. Now the same thing applies to system integrators. So system integrators are tested and validated on their knowledge and they would typically get a license to say you have been tested and you can actually work according to the local laws and local regulations and standards, to say you know what you're doing. So the reason why the security consultants in Dubai are very important is there is something that is required by law and that is that one of these security consultants literally validates your design. So he literally puts a stamp on a drawing and says, “I am happy, as a local approved consultant, to say that this project has been designed according to the local laws and regulations and I am happy that you proceed and go ahead with this project.” Now that gets very important down the line, because at some point, somebody from the government will come and do an inspection and they will ask you for this drawing that was stamped and submitted as a reference guide, and during the inspection, somebody will come and say okay, show me the design.

28:48

You said that this device installed at entrance a. This is the purpose of this device. Okay, show me this on the drawing. Show me this on the camera system. Show me the device in real life. Is it actually compliant as which you said it was going to do, and is it actually doing what you were supposed to say it's actually going to do? So there's a lot of checks and balances in place to make sure that what is designed and what is implemented is actually correct and is actually done correctly to follow local laws and local regulations.

29:06 - Steve Kenny (Host)

Yeah, I think, as a concept that's very interesting to make sure that actually the people that are going to be designing or installing, maintaining, commissioning these systems have gone through some form of checks and balances from the government to make sure that what they are going to deliver is going to be fit for purpose, and they've gone through probably all of the necessary security checks, because they're going to be linked to people's visas and that is not something that we see globally, that is not something that many countries have.

29:48

There are some countries that you could walk out of prison and in the following day you could be installing a security system somewhere in the world, and it's just nice to know that in the Middle East, especially the UAE and Dubai, that actually you can probably go and ask for someone's license so you know that that person has gone through security checks and you've got something linked to their credentials to make sure that they're an experienced individual. Can you give me a list of Middle Eastern countries, that if you’re an external organization looking to work within this environment, what countries do people really need to consider and read up on to make sure that whatever they're doing in that country is compliant?

30:38 - Tertius Wolfaardt (Guest)

That is actually something that is continuously evolving. Typical countries that you would find sets of rules and regulations. The UAE, of course, is the big one, but in the UAE you would find some sort of regulations per smaller emirate in some cases. So in Abu Dhabi you would find that Abu Dhabi has their own sets of rules and regulations. In Dubai, you would find. But then in some of the other emirates, like Fujairah, for instance, or Ras al-Khaimah, you might find that they have their own sets of rules and regulations.

31:11

Saudi Arabia, of course, is a big one. They have their own typical regulations. In countries like Qatar, you have very, very specific regulations. Then in Kuwait, as far as I know, Bahrain, as far as I know, doesn't really have something official. Oman, I believe, is currently finalizing something, and then there is something sort of in process, also coming quite soon in Egypt. But as far as I know, the big ones are typically Saudi, UAE, Qatar, Kuwait, these countries. But it doesn't necessarily mean that there aren't more coming to other parts of the world or other parts of the Middle East in the near future.

31:55 - Steve Kenny (Host)

If we could, or you could, make any sort of small changes or influence what these standards might look like in the future. Are there any specific areas that you think, actually, whilst they are incredible in X, Y and Z, if they could just improve this small area, it would improve the whole security posture of a system. What would that be?

32:18 - Tertius Wolfaardt (Guest)

Honestly, what we've seen, and what I've personally seen, is probably it would be very good to have a better link between the physical and the cyber world. In a lot of countries, there are very good physical security regulations and there are very good cyber security regulations, but the reality is these two live in different parts of the world and very rarely do these regulations actually refer to each other. So I would say that if there's more from a cybersecurity perspective built into the physical side and from the cyber side, take more into consideration the physical side, and we have very large security systems. But have you considered ABCD in regards to cybersecurity and have you considered how these devices and how these systems actually influence each other and how they influence the bigger picture?

33:19 - Steve Kenny (Host)

Yeah, I guess, when you're talking about this sheer volume of devices that are being installed around these countries and around these regions, the sort of proliferation of this kit can only increase the potential risk and vulnerabilities if cybersecurity isn't addressed. So yeah, I think that is a fabulous point. So just to wrap up, if you were to try and give some guidance or advice to companies looking to explore the potential of working in the Middle East, what would your first steps be?

33:47 - Tertius Wolfaardt (Guest)

Wow, interesting question. I would say be open-minded. Honestly, if you look at what we see around us today in the press and social media and all of these things, it doesn't always give you the full picture. So I would say, first of all, maybe go to the country where you want to do business and try and actually talk to some of the people on the ground and try and understand what are the actual real challenges. So a lot of things that we see around us might not always give you a full picture of what's actually happening in the country, and some of these countries are difficult to work in.

34:24

From things like a customs perspective, from a compliance perspective, there's a lot of challenges and if you're used to doing business, for instance, in Europe, coming to the Middle East is a bit of a mind shift that you have to make. And you also just have to be mindful that because of all these different regulations and standards that apply in different countries, it's nearly impossible to work in multiple countries at the same time if you want to start in the Middle East. So I would say, focus on one country, maybe the UAE, as an example, where it's very mature in the way they do business. Get yourself an understanding of how it works here and don't try to work in five countries at the same time. It's not feasible at all. It's just the amount of time and effort you have to put into getting something up and running in a country that is very regulated and very difficult to to work in can be really a headache at the end of the day. That'll probably be my recommendation is to be a bit more realistic about what you want to achieve also.

35:47 - Steve Kenny (Host)

Yeah, thank you very much. So, Tertius, thank you for taking the time to share your insight on Security Tech Talk today. It's been an absolute pleasure and I think it is crystal clear that the opportunity is huge in the Middle East. But the cost of a non-compliance not abiding by the rules and regulations and making sure that systems are compliant can have huge financial consequences, not only for the end customers that are deploying these systems, but actually all of the different organizations within the supply chain. So, thank you very much. I look forward to next time. And yes, Tertius, it's been an absolute pleasure, thank you.

36:13 - Tertius Wolfaardt (Guest)

Thank you, Steve.

36:18 - Steve Kenny (Host)

Thanks for tuning in to Security Tech Talk. If you've enjoyed today's episode, be sure to check out the other episodes for more insightful discussion and expert perspectives. Don't forget to subscribe so you never miss an episode. This podcast is brought to you by Axis Communications. Axis enables a smarter and safer world by creating solutions for improving security and business performance.