What Message Does Your Security Send – Fear or Trust?

In order to have proper physical security, mitigation strategist and those responsible must understand the types of aggressor groups, what motivates them and the tools they need in order to be successful.
  

Aggressors fall into four main categories: criminals (sophisticated/unsophisticated, organized/unorganized), protesters (organized/unorganized), terrorist (domestic/transnational/State sponsored) and subversives (intelligence agents [State/non-State sponsored]).


And, there are four main aggressor objectives; to inflict injury or death on people, to destroy or damage equipment, facilities or other resources, to steal equipment, material or information, and to create adverse publicity.


Tools on the other hand, don’t fall into any category and are virtually unlimited.


Unfortunately, the security industry has been approaching school security from the wrong angle.  We keep thinking, if one is good two must be better and we can harden our way to a perfect world.  We can’t.  School shootings and worse will continue, I’m sad to say, until we start eliminating the causes that promote this behavior. 


School systems have developed a variety of multi-disciplinary programs that address prevention and response to mental health issues if a student manifests behavior that might precipitate violence on a grand scale; i.e., bullying, addiction and interpersonal violence.  But this is still not enough.

Some security companies offer “social media behavioral monitoring” and are analyzing a person’s social media presence in “real time” and reporting actionable intelligence of patterns or suspicious behaviors to authorities, but this alone isn’t enough.  Using artificial intelligence, and deep learning are great but they’re just another tool.   And, just because a person manifests some type of anxiety or disruptive behavior it doesn’t necessarily mean they’ll act out and it doesn’t mean that that person will become a school shooter.


I believe we need to get to the cause of the angst.  Why does a “perfectly normal kid” decide to go to a school and shoot it up?  Does the “prison look” of many schools contribute to this phenomenon?  Is it possible, that the chain-linked fence surrounding the school yard, the metal detector that everyone passes through and the roaming armed guard all contribute in some way?  Now, just because that has become the “new normal” it doesn’t mean every kid will grow up and commit a criminal act, but there is no doubt that they will carry this angst with them into adulthood.


You don’t have to look very far to see examples of the “big dog” in your face approach and the subliminal message of something bad is expected to happen.  

We can address behavior in the built environment in a non-traditional way as a substitute to the confrontational in your face kind of way.  The approach must be more subtle, in fact, the more transparent it is the more effective it will be.  

Normally, to deter crime, we put up signs that say, “Cameras in Use” and some folks get creative saying, “Smile you’re on camera”.  For access control, we usually mark our territory by placing a chain-linked fence or some other type of “barrier” on our boundary-line.  It has a limited effect because a dedicated threat will bring the tools needed to circumvent it.  Build a big fence; they’ll bring a bigger ladder.  Make it even higher and they’ll bring an even bigger ladder or tunnel under it.  Sure, there is somewhat of a deterrent, but the reality is, a dedicated “bad actor” will bring the tools needed in order to be successful.   


In the early “90’s, Crime Prevention through Environmental Design was introduced to connect these two worlds – unwanted behavior and a physical deterrent.  Research shows that the concepts of natural surveillance, natural access control, territorial reinforcement and maintenance contribute to the deterrence and reduction of criminal activity.  CPTED is not the sole reason, but it helps. https://www.cptedtraining.net/


The basic concept of CPTED is if we can design the space so that it is almost always under observation “bad actors” won’t act bad.  I believe it needs to go further than that.  Not only do we need to design the space using these concepts, but we also must design the space so that “bad acting” can’t occur.  Additionally, in the off chance it does the built environment should help to reduce its effects and not contribute to its severity.  


A couple of years ago researchers in the European Union conducted a survey.  They asked elementary school kids who had emigrated from a country where there was war to draw what they considered safety or security to be.  The kids drew pictures of fencing with razor-wire and “gunships” overhead.  Then the researchers asked the same question to kids from Europe who had not be exposed to hostile environments and those kids drew houses with trees, stick families, a dog and sunshine.  Shouldn’t we be striving for the “sunshine” scenario?


The harder we make it for the “bad guy” to do things the more of a deterrent there is.  There is some truth to that but on the other hand, if security is a tax your people won’t pay it and they will figure out a way to circumvent it.  This in turn defeats its purpose.


Getting away from hardening schools after every incident by using “big dog” philosophies will take time, nonetheless, we can begin immediately.  I submit that beginning this school year, administrators should use the checklist provided by the Partner Alliance for School Safety (PASSK-12) www.PASSK12.org to conduct a physical security risk assessment of their campus and whenever possible replace traditional mitigation solutions they would normally opt for with a hardscaping, landscaping or art strategy.  Creativity and student, staff and community involvement are essential.


Success in security is sloppy.  It’s entangled.  It’s very hard to distinguish where detection, assessment, policy and procedures, response and engagement begin and end.  Addressing behavior must be coupled with addressing the physical environment.  They require a different amount of time, effort and commitment to produce positive results but nonetheless are equally important.  In order for students, and later as adults, to thrive we must create environments, internal and external, that address the need for “well-being” in both the social and physical ecosystems, and if we can do that in a more aesthetically pleasing way, then why not?

More about a softer approach to security: https://www.securityindustry.org/2018/04/05/the-puppy-movement/

My Book The Solutions Matrix: A Practical Approach to Security Engineering for Architects, Engineers, Facility Managers, Planners and Security Professionals is on sale at https://www.hainessecuritysolutions.com  

Haines Security Solutions is a contributor to the Security Industry Association’s education platform, “Center of Excellence” at https://www.securityindustry.org/center-of-excellence/

The Need to Push Down Silos

A few years ago, a friend of mine, trying to generate additional students for the classes I teach, asked his cousin who works for a very large architecture and engineering firm in the new World Trade Center in New York City, if they would be interested in attending training on integrating security technologies into building design.  His cousin answered something to the effect, “No, we leave that up to the client after we turn the building over to them”.  While his cousin’s answer is not surprising it is disappointing and confusing to me. 

Not surprising because I’ve heard that so many times before.  In essence, everyone stays in their silo and the connection between the disciplines usually only involves answering questions about the project and clarifying requirements; architects architect – engineers engineer – and security securities, if you will.

It’s confusing on two levels.  First, at the beginning of every project the architect gets the client’s desires list; i.e., the building should be blah, blah, blah. Right from the start the architects develop a mental picture of what the building should look like.  Next he or she begins to include all of the regulatory requirements or “best practices” for design.  Best practices are nothing more than this is how it’s normally done.  In New York City, for multi-story buildings in Manhattan the façade default material is glass in the Mid-West it is reinforced concrete or masonry units.  Meeting regulatory requirements deal with disability act, fire and safety codes, such as, hallway width, stairs, doors and windows, and elevator placement, etc. and depending on the region some weather related events.  And second, very seldom are man-made threats considered.  This contributes to the fact that man-made threats continue to occur despite large amounts of money being spent on security measures. I guess the argument could be made, that “well, we’re not required to consider them like we are for natural threats so we don’t need to; besides it will drive up costs”.  On the surface this makes sense but if you dig just under the surface your next thought should be, why don’t “best practices” apply?

The Department of Defense, and some other federal government agencies to a limited degree, requires that integration mitigation strategies be included in their building design review process regardless of where or what type of threat is involved.  In fact, it’s mandated that all threats, including man-made threats be addressed by a group of stakeholders at the onset of any new building construction project and for renovation projects that meet certain thresholds or “triggers”.   The stakeholder group determines the “design basis threat” to the building and its occupants and the level of protection required based on the number of people occupying the space.   These two factors ensure that the appropriate amount of money is spent on protection options and in the unlikely event a catastrophe does occur; injury and death will be kept to a minimum.

By bringing all stakeholders together from a variety of disciplines, everyone 1) has a chance to air their requirements and needs, 2) buys-in to the group’s decision on which threats will be addressed and support the “DBT” and the level of protection required, and costs are kept down.  Adding electronics in the form of surveillance or other technologies lies with the owner after the project is completed.  So in the short term, the cost of this equipment and its installation is currently absorbed by the owner/client and is not part of the building costs.  This “trick” helps keep the building design costs down but doesn’t adequately protect people or the facilities they use.  But more importantly, the real costs to the client come after the installation from the long term requirement for equipment maintenance and manpower. 

Since buildings are currently designed with everyone, remaining in their silos, with  limited exception, the process is treated as if it were a vertical process, when in reality it’s a horizontal one.  The “silo effect” and the isolation it causes make security an “add-on” and limits its efficiency and effectiveness.  

Prediction: An Active Shooter Event Will Occur at Your Child's School Unless Fundamental Security Changes are Made

One more active shooter incident, just a different town, different families but we’ve seen this show far too many times before.  I’m disgusted that everyone is blaming everyone else, the gun lobby oh it’s a mental health issue, the gun control tribe, oh we need gun control, everyone attacking the FBI and the mental health system.  The reality is WE, the collective We, failed.  No single agency or group or person or law is solely responsible.  Non-sensible gun control, non-sensible mental health laws, non-sensible law enforcement and non-sensible governing by public officials who haven’t display even the slightest bit of leadership.  Leaders stand up, admit their failures and take actions to correct course.  I know it’s only been a few days, so maybe just maybe someone will step up but based on previous track records, I kind of doubt it.

ELECTED OFFICIALS

If you’re an elected official, we’re calling you out.  There is nothing and I mean, NOTHING that is more important than protecting our kids, no … America’s kids.  If you think of them as someone else’s kids, then you’re sorely mistaken.  These are American’s kids, they belong to all of us.  It just so happens that they weren’t my blood relatives – at least, not this time. 

If you’re a public official you serve us – not your own or your party’s agenda – OUR agenda, and right now our agenda is – SAVE OUR KIDS! 

I had written a two-hundred-word rant but I think Emma Gonzalez said it much more eloquently that I.

This is not about anything other than will power.  We, after Presidential leadership, decided to put a man on the moon.  Not because we knew how but because that’s who we are.  We did it because of our willpower to do it. 

SAME OLD SOLUTIONS

I fear that in the aftermath of this tragic event those faced with finding solutions; i.e., security companies, elected officials, and school administrators will rush to add security guards and electronic security systems to their schools.  Unfortunately, these products will not solve the problem.  The school in Parkland had both.  Sadly, the guards will be somewhere else when the shooting starts or will become the first victim.  More cameras will only allow us to capture what happened, because there is no one monitoring and responding in “real time”.  Allowing teachers to carry guns, will not stop the carnage.  In fact, the idea of allowing “responsible” people to carry weapons, whether open or concealed, only puts more people at risk.  We could add fences and gates and metal detectors but all of those can and will be circumvented by a dedicated threat.  Besides, fences and gates and access control add to the issue of aggressiveness[1].  And, I certainly don’t advocate that we turn our schools into prison like compounds. It’s going to take a multi-layered approach.  We need to address the possession and use of guns, especially assault type weapons that are designed to kill as many people as possible in the shortest amount of time possible. Since they’re not for protecting a person and or his/her loved ones I don’t get why you need to have one.  I understand the argument that you have the right to protect yourself and your loved ones in your home, but do you really need an AR-15 to do that?  I’m not writing this to get in an argument over guns.  I’m writing this to voice my concern that if we don’t address the use of these type weapons in a logical way, we’re in for more trouble. 

Regrettably, someone will say, “Hey here’s how we fix this, so it doesn’t happen again”.  And then everyone will run after that solution for a while or until the next shooting happens.  Then we’ll figure out what “fell through the cracks”, plug that hole and wait for the next killings to occur.  Unless we have a comprehensive approach bringing a variety of disciplines to the table the “plug a hole” approach will cost lives.

Just like tackling the root causes of what happened in their totality so is the necessity to take a layered approach to implement security at the detection, assessment, command and control (school administration), response and engagement levels.  Without a holistic approach we will not have comprehensive solutions.

CRY FOR HELP – MENTAL HEALTH

I have to say, that while I detest what the Parkland shooter did, I also can see that this was a desperate cry for help.  The system failed this young man and now we have hundreds of victims to show for it.  So mental health professionals need to be consulted so they can express how they can have a greater impact on the actions of those who are troubled before they act out. Note: After the Isla Vista shooting in Santa Barbara a few years ago, the city formed a coalition of mental health professionals, police and others to respond to “welfare check” requests, instead of leaving it solely up to the police.

If we don’t address associated mental health issues and the laws surrounding when a physician can report his or her suspicions and concerns that a person may act out, then we’ll miss the boat again.  I think we all can agree, if a mental health professional says this person may resort to violence, then our first course of action should be to take away their ability to access firearms.  At least, until a risk assessment is done by a professional panel.

LAW ENFORCEMENT’S FAILURE

Now that the FBI is under scrutiny for its failure to follow up on what seems to be a credible tip, everyone wants to blame them.  In this instance, an investigation needs to be conducted (Director Wray has already announced a probe will be conducted) and if someone needs to be held accountable, at whatever level, then so be it.  But to place the blame solely on the FBI is wrong.  I have high confidence that the FBI will get to the bottom of what happened and correct it.

ARMING TEACHERS AND SCHOOL ADMINISTRATORS

Many people will want to have officials pass legislation so that teachers and school administrators can carry weapons at school.  Bringing more wood to a burning building only makes the fire grow.  While on the surface, armed teacher/administrators may seem like a good idea but when you think it through it’s not.  These active shooter incidents most often start outside the classroom, somewhere on the periphery.  This means, that in order to be effective armed school officials would need to be outside of the classroom to engage and neutralize the threat.  Second, if everyone has a gun then what is the triggering mechanism for suspicious behavior or “See Something, Say Something”.  The tip that came in to the FBI was initiated because the behavior of the shooter was out of the ordinary.  If everyone is walking around with a loaded weapon, then how do we distinguish the good guys from the bad guys?  Besides, when the shooting starts who’s to say it won’t become the “wild west”?  I fear there would be many more casualties.  We’ve become accustomed to armed security officers or policeman because they’re uniformed, which identifies them as a good guy, and because they receive regular firearms safety training.  Yet accidents do happen.  I doubt teachers and administrators would receive the same degree of rigorous and routine situational training.

Curious note here: A Presidential Pool reporter was stopped this morning because he had a gun in his bag and was attempting to travel with the President.  If gun advocates think everyone should be allowed to “conceal carry” a weapon wherever they go, then why not let the reporter carry his legally registered firearm while accompanying the President to his golf game?  Just saying.

CHANGE IN ARCHITECTURAL DESIGN

Additionally, schools are not designed for protection, they’re designed for education.  Now, that said, some newer schools have been designed with security in mind but most of the effort has been on creating a perimeter that is impenetrable.  The reality is, what happens if a person gets past the perimeter[2], then what?  No places to hide that offer ballistic protection.  Especially in the newer facilities with open floor plans that foster the interaction of students.  The idea of stacking desks and chairs behind a door and expecting the dry-wall to offer protection from a high caliber bullet is just insane. 

We need a change in the way we design inhabited space, especially when the occupancy is higher than 20 people or so.  There should always be two possibilities for escape[3]. 

And we should be teaching to run at all costs; hiding and fighting is not an option.  Throw a chair through the window, kick or punch a hole in the wall (after all it’s just dry-wall) and get out no matter what, the only time a person should stay behind is if they don’t have time to escape.  With that in mind, we need to start creating ballistically protected spaces throughout that provide sanctuary and keep people safe when it’s too late for them to run.

There are off-the-shelf ballistic materials available that can be used to create safe-havens, in new construction or existing facilities and can be embedded in white boards, desks and chairs. 

THE COST OF CHANGE

Now, don’t get me wrong, I think space exploration and figuring out a way that’s economical to get to Mars is a great and necessary thing.  I’m using this as only one of many examples that I could use.  I’m just saying, if we can find the money to this, then why can’t we find the money and willpower to protect our schools.

The fiscal conservatives will say that it will drive the budget up.  So!  I can’t think of a better return on investment.

The cost to launch the Falcon Heavy was somewhere close to $90,000,000.  Not to mention the costs of the R&D that came before hand.  There’s not allot of information about how much money is has been allocated to this program so I’m going to make some guesses here.  Let’s say there were 10 launches (ground tests and orbital) at $50M each.  So that’s $500,000,000. 

So, let’s just say, that to make a space that’s approximately 100 square feet, that can accommodate a classroom full of students and teacher, we use the occupied floorspace guidance provided by DHS for saferooms/shelter (spaces where a person can seek shelter for up to two hours) costs, $20,000.  If, you divide half a billion by $20k that’s 25,000 classrooms that could be built or retrofitted.  And let’s say on average a classroom has 20 students then that’s roughly 500,000 students and teachers that would have been afforded protection in the same period.  Using the same formula and using just the latest launch cost of $90M, equates to protecting 90,000 lives. 

This doesn’t look like rocket science to me.

REAL CHANGE

For real change to occur two actions are required;

First, we need to stop thinking about this as a singular issue to resolve.  This is a multi-layered issue and can only be resolved with a multi-dimensional approach.  No topic or option, no matter how painful, needs to be off the table[4].  Folks need to check their emotions at the door and get to work.

And second, and much more importantly, we need to change our way of thinking.  We need to think that although it didn’t happen in my town or to my family it did happen to me personally – these are not someone else’s kids and teachers, they are OUR kids and teachers – they belong to America!

We claim to be the greatest nation in the history of the earth yet we sure aren’t acting like it.

Related article https://view.joomag.com/ast-digital-magazine-august-2017-digital-aug/0415224001503451917?short

---

[1] Security Update Opinion: Little empirical evidence #security measures can really stop school shootings ow.ly/kRah30irCS0

[2] Security guidelines for safer schools can be downloaded from the PASSK12 website http://passk12.org/

[3] “Active Shooter Threat:  Why Run-Hide-Fight is Wrong and Two Ways to Fix It” appeared in the 16 May 17 edition of the New York Real Estate Journal

[4] Toolkits on how to change the safety culture at your school are available here  https://www.safeandsoundschools.org/

Is the Defeat of Terrorism Linked to Hidden Security?

Truly Effective Security Is Hidden

Image provided courtesy of Marshalls Landscaping Products

I’m truly amazed when I travel around the country and see closed circuit cameras everywhere; airports, shopping malls, street intersections – everywhere!   I read recently, that my image is captured several hundreds of times a day.  That’s scary.  So I guess, Big Brother is watching!  At least, that’s what I’m thinking and that's how I'm feeling.  The space makes me feel uncomfortable.  But should I be?

If I'm using the space shouldn't I feel comfortable while using it?  If the answer is, "Yes", and I believe it is, then the question is, “What makes good space?”  The factors range from access and linkage to other services, uses and activities within the space, comfort and image, and sociability.  All of these factors come in to play.  I'd like to focus on the comfort and image part of the equation.

Security as an Enabler and Not a Tax

A British friend of mine, says, “Security has to be an enabler and not a tax”.  By that he means, the environment must allow people to transit “freely and confidently”.   I hate to say it (after all he’s an Arsenal fan) but he’s right.  People will use the space because they can move within it freely and because of this freedom they feel confident that they are safe.

Where there is good quality of life, people want to live and raise their families.  The true measure of a Smart or Safe City is a place where the grandkids want to live and raise their families!

To make this happen Smart City planners will need a holistic approach.  They won’t be able to address a certain sector of society, say utilities for instance and voila’ everything is good.  It will require good infrastructure systems, good inhabited space design, good governance and good community involvement.  The right mix of technology from all sectors and behavioral sciences will be needed. Due to this holistic approach to community planning, companies wishing to compete in this space will need to bring in a variety of specialties in order to adequately meet the consumer’s needs.  As an example, inhabited space design cannot be a function of only architects and engineers.  It must also include security professionals, transportation experts, government officials, behaviorists, and even community members, both retailers and residents.

The reliance on physical security engineering will become paramount as we use inhabited space to mitigate unwanted behaviors and reduce its effects.  We cannot lose sight of the human aspect of using new technologies as we move forward. 

Electronic vs. Non-electronic Technologies

Unfortunately, electronic technologies are invasive.  They assault our daily lives as they collect more and more data about our habits, preferences and routine.  On the other hand non-electronic technologies are not invasive.  They “socially engineer” the space so that people using the space act how we want them to act.  Not because they feel threaten that “Big Brother” is watching but because good behavior begets good behavior.  The use of invasive technologies will need to give way to non-intrusive technologies.  This will take time.  But there’s no better time to start than now.

Immediately after the vehicle attack in Barcelona, jersey barriers started popping up in pedestrian zones and near sidewalk cafes.  This use of concrete barriers systems is extremely unsightly and only limitedly effective.  Instead of using barriers that worsen the quality of the space, we should think about the quality of space we are protecting and integrate aesthetically pleasing barriers into the environment that actually blend in and keep it picturesque – complimenting instead of spoiling.  Remember, no one wants security to be a tax, even if it’s only a visual burden.  Having ugly concrete jersey barriers right next to you while sipping your Brunello di Montalcino at an outdoor café table doesn’t project the atmosphere we are trying to achieve; however, flower planters, benches, light poles, bicycle racks, trash bins and the like that have been crash tested and proven effective against vehicle-ramming threats can enhance the atmosphere instead of hindering it.

Recently, Stefano Boeri, Architect[1] was cited by Dezeen Magazine as saying, “Cities should be redesigned to include trees with bulky planters rather than concrete barriers to prevent vehicle attack”.  He went on to say, “A big pot of soil has the same resistance as a Jersey (modular concrete barrier), but it can host a tree – a living being that offers shade; absorbs dust, CO2 and other subtle pollutants; and provides oxygen and a home for birds”.  We agree.

Hiding Security in Plain Sight

I believe we can “socially engineer” inhabited space.  We can incorporate specific urban design strategies that cause positive behaviors so that there is less reliance on the invasive use of electronic means to keep us safe. 

As an example; the use of “crash rated” street furniture.  It provides a measure of security from a ramming vehicle threat without making the space look like a threat is anticipated.  Another example, and perhaps even more hidden, is the use of furniture that incorporates ballistic materials, so people have something to hide behind during an active shooter threat.  Both solutions are currently available and in use in many unsuspecting areas.

Ultimately citizens don’t want cameras that watch their every move; instead they want space that is functional and free of crime and unwanted behaviors.  By increasing the effectiveness in controlling the social behaviors of the people using or transiting the space, and adding “passive” defensive mechanisms the environments will become safer and need fewer electronic gadgets.

As the great migration from the country-side to urban centers becomes an increasing phenomenon, community leaders must meet the challenges that lie ahead.  As systems of urbanization become ever more complex so will the solutions to resolve the problems they cause.  It’s imperative that not only will smart cities be highly functioning and efficient but they must also be, first and foremost – safe. 

---

[1] Boeri is known throughout the architectural and design world for his “plant and tree” covered buildings. 

Case Study at European Simulation and Validation Center (ESVC)

Protecting Students and Staff from Active Shooters

A Case Study at the European Simulation and Validation Center (ESVC)

THE TASK AT HAND – PROTECTING STUDENTS AND STAFF

Protecting the students at the European Simulation and Validation Center (ESVC) was our objective and specifically, reducing the mass casualty count during active shooter scenarios.  With the increase in terrorist attack, it was only logistical that the Executive Director would seek out protection for her staff and cadre of instructors, but primarily, for the students attending simulation modeling at the ESVC.

“We pride ourselves in being a professional organization with extensive safety and security knowledge. Protection of our staff and students in any way is a main priority”, says, Karen Zwart, Executive Director from her offices in Ede, The Netherlands.  

Because CPK United BV is known for their expertise in training senior government leaders and industry executives, as well as, their key staff elements, especially in the transportation and aviation fields, the ESVC is the “go to” place when it comes to conducting serious gaming models for evaluating emergency plans and the actions required by them.  The ESVC provides a comfortable environment that is conducive to leadership training at the highest levels in lieu of costly field exercises.  The ESVC can create an organization specific built (physical) environment virtually; use existing company or agency plans, while allowing “players” to travel down a variety of decision paths in a virtual environment.  This allows them to test plans through their interaction, individually and collectively to evaluate efficiencies – without the additional expense of a full-scale exercise and without anyone getting hurt.   Using ESVC simulation allows plans and procedures to be tweaked before a real incident occurs and damage or injury occur.   

KNOWN COMPONENTS OF THE RISK FORMULA

All good risk formulas have some commonalities.  The formula usually goes something like this; C (asset criticality) X Threat (What can harm us) X Vulnerability (How susceptible we are to the harm) = Risk (How bad is it?).  In this particular instance, two of the essential elements in calculating risks were already known to the assessment team.  Those elements included the criticality of the asset, (high value targets/students).  To understand the criticality, imagine for a second, if a multi-national corporation’s entire senior leadership along with key staff were on-site being trained and ESVC were involved in a catastrophic incident.  It would not only mean damage and death but could also influence the future of the organization and could very well be the end of that company. 

And, the second known element – threat – was an active shooter scenario.

ASSESSING VULNERABILITIES – A SNAPSHOT IN TIME

The next element of the formula was to determine the vulnerabilities of the site as they related to the threat.  Haines Security Solutions was called in to do the assessment due to its extensive experience in conducting risk analysis and developing mitigation strategies as they relate to building design.  Experts in forced entry, building design, antiterrorism and structural engineering repaired to the site to conduct the evaluation.

It should be noted that during conversations with the staff it was noted there was a low-moderate probability of occurrence of this type of attack; however, due to the catastrophic impact on the corporate structure of an organization attending training if impacted (low/moderate risk – critically high impact), it was determined to be of extremely high importance to conduct a full range of assessments.

Each area of the facility (reception area, training facility, staff offices, storage areas, coffee/snack center, bathrooms and print shop) was examined from both the owner’s and the aggressor’s points of view.

USING THE ASSET BASED RISK ANALYSIS METHODLOGY

This dedicated team of subject matter experts collected physical security, as well as, operational data on-site in order to allow them to fill-in the vulnerability element and complete the risk formula

They then started collecting physical data from the curb inward.   Data was collect on three layers where vulnerabilities could occur; i.e., property perimeter, building façade and internally controlled spaces.  Data about the IT system or software used at the ESVC was not collected because the ABRA, in this case, did not call for the protection of data on the IT system.  Instead, it called for the protection of lives.

Once back at their offices, the Haines Security Solutions team members used an assessment methodology called Asset Based Risk Analysis[1] or ABRA to analyze the data and make effective recommendations. 

The primary purpose of ABRA is to quantitatively measure threats, assets, vulnerabilities, and risks associated with large and/or small government or private facilities.  It establishes a security baseline, explores upgrades, recalculates vulnerabilities and risks, and recommends optimized features or improvements for facilities.  In essence, ABRA identifies current levels of vulnerability and risk and then identifies improved levels with the implementation of specified countermeasures.  Basically, a snapshot of where the organization is today and where it could be after countermeasures are implemented.  In addition, ABRA identifies the associated cost and impact of the improvements.  ABRA includes the performance of six sub-analyses: threat, target, vulnerability, optimization, risk, and cost–benefit.

  

Threat Analysis

The treat analysis is based on information collected during the site visit.  The information produces a threat rating, which measures the threat likelihood (the probability an attack will occur), and an effectiveness rating (the probability that an attack will be successful).

ABRA takes into account the current local threat environment for five conditions; i.e., stand-off, explosive; covert, overt and chem/bio.  Although the project only called for the assessment of an active shooter threat, since we were already on site, it only made sense to conduct all five analyses.

The assessment team started the assessment asking a series of about 50 questions to the staff to further determine the asset’s criticality and threat environment.   Additional soft intelligence was collected via the internet and a clear threat picture emerged.

Target Analysis

The target analysis is designed to evaluate and measure the value of all targets to the user and to the aggressor.  Targets could include any type of asset or target including facilities, people, equipment, money, processes and systems.  The end result of the target analysis is a numeric rating based on the target value or criticality to the user and the target value or usefulness to the aggressor.

Vulnerability Analysis

Our vulnerability analysis is designed to quantitatively evaluate and measure how vulnerable a specific asset is to a specific threat. This phase of ABRA identifies the countermeasures currently in place for a specific target and is assigned a value based on their effectiveness in mitigating threats (Baseline Vulnerability Rating [BVR]).

Optimization Analysis

The optimization analysis is the reapplication of the vulnerability analysis after implementing hypothetical improvements resulting from countermeasures that could be used for a specific asset.  Hypothetical countermeasures could include programmatic or procedural options.  The end result is an optimized vulnerability rating (OVR) associated with the specific target being analyzed, in this case, a training facility.  Based on the optimization analysis, the average vulnerability and risk rating can be identified and stated as a percentage.

Risk Analysis

The risk analysis is the aggregation of the threat, target, vulnerability, and optimization analyses to determine the calculated value of risk associated with a specific asset that is being targeted by a specific threat.

Cost–Benefit Analysis

The cost–benefit analysis compares the potential results of specific countermeasures for reducing or mitigating threats against specific assets.  The cost–benefit analysis is based on cost versus reduction in vulnerability and risk.

MAKING RECOMMENDATIONS THAT WORK

Most risk analyst make recommendations that bring the facility up to code compliance or base solutions on costs.  The recommendations made during this assessment were made based on risk reduction and not costs.   Our analysis showed that all recommendations were either extremely or highly cost effective.  Those recommendations included four main or specific areas.

Inhabited Space Hardening

Windows – Replacing the existing exterior windows with 6 mm laminated or poly-bicarbonate glazing.

Walls – Retrofitting the walls with a ballistic resistant material and continuing that concept to other features.

Furniture – Retrofit any interior elements, such as, reception desk, student chairs, tables, white-board (basically, anything or anywhere a student could hide behind if they were unable to exercise their first option of running away).

Electronic Security Systems

Electronic Security Systems – Install integrated access control and surveillance (CCTV) systems.

Mass notification system – Install internal and external speakers, alarm signals and visual message boards.

Crime Prevention through Environmental Design (CPTED)

Natural Surveillance/Natural Access Control – Use landscaping to reroute pedestrian traffic entering the building, so that as people approach they are observed from within the building.

Plans, Policies and Procedures

Use internal resources/corporate expertise to update plans, policies and procedures

IN SUMMARY

The recommendations would be implemented in all areas of high occupancy or critical areas (inhabited spaces); i.e., training facility, staff offices, coffee/snack center and stairway.  It should be pointed out that normally stairways or other transit type spaces would not receive the same level of protection because they are usually considered to have low occupancy, but input from the ESVC indicated it to be mission critical and a single-point-failure location for their operations.

Bathrooms, storage rooms, print shop and garage were not recommended to be retrofitted with ballistic protection because of their low occupancy density (uninhabited spaces).

Overall the risk reduction to the active shooter threat was calculated at 84 percent.  In other words, the Delta if you will, from where the risk is today to where it will be when all of the recommendations are implemented.   If implementation of all of the recommendation in the report were accomplished the risk reduction of the other threat scenarios would be between 74 and 98 percent.  The total project costs, including the data collection, evaluation and analysis and implementation of all of the recommendations was Euro72,130 ($76,200).  If only the recommendations pertaining to ballistic protection from the shooting threat were adopted the costs would be Euro53,560 ($56,700).  Recommendations were also prioritized to be implemented based on risk reduction and protection to the largest number of people first, and to allow their implementation as funding becomes available.

In summary, that’s a very small amount to pay to protect the lives of students and staff.  The added protections afforded by the recommendations help reduce risk and provide safety from a host of criminal and terrorist activities.  

Zwart added, “The conclusions made were rock solid and provided clear vision of the budget choices we need to make in the years to come.  By using their proprietary formula, Haines Security Solutions was able to demonstrate the tangible risk reduction of their recommendations.  Something we’ve not seen in other assessment methodologies”. 

Making it a safe and secure environment for those attending training – after all isn’t that what it’s all about?

---

[1] Haines Security Solutions was awarded a 2017 Platinum level Government Security award in the Risk Analysis category for its Asset Based Risk Analysis (ABRA) methodology.  The GOVIE awards are presented by Security Today magazine to outstanding products that address security challenges within the municipal, government, Safe Cities and law enforcement markets.

The Really Big Fat Stupid Thing the Media is doing to help the Terrorist and They Don’t Even Know It, or Do They?

Times Square car bombing attempt. Sandy Hook. San Bernardino. Pulse Night Club.  Any College Campus shooting.  Take your pick.

Each time there is an incident involving mass murder or attempted mass murder the media is all over it with their “Breaking News” or “This Just In” coverage.  They call out the “Big Dog” correspondents and send them to the scene.  They get panels of “experts” with very sexy titles and ask them questions, so that they can glorify the perpetrator by associating them with terrorist groups.   They almost always say, “Well, Chet it’s too early to tell but….”.  What people hear is the “but ….” because they’ve associated these murderers with terrorist organizations.  They are now legitimate. The media arm of the terrorist organizations just loves the compliment and they exploit it in their propaganda and quite effectively I might add.  Additionally, they exploit any speech from the US about the mistreatment of its citizens or the failures and uncertainties of western governments.  This plays right into the hands of the propaganda machine.  For their part, there is no failure or mistreatment or uncertainties as it all fuels the narrative of dominance for the cause.

The western media, primarily in the US, has turned the news into a type of reality show, with sensational headlines, you heard it here first acclamations and the like.  They’ve effectively, knowing or unknowing, turned the news cycle into entertainment.  The rush to “get the scope” and break the news that the murderer is connected or wanted to be affiliated with a terrorist group is their top priority because “it sells copies”.  So, I think they, the media, have done it knowingly in order to gain the top spot in the ratings.  The rush to be on top in turn gets more advertising which in turn makes them money.  And that’s the bottom-line.  The shareholders want them to maximize profits so they get the best return on their investment.  It doesn’t matter that the narrative fuels terrorist because it gives their cause a certain amount of legitimacy.  While this is shameful on a variety of levels, I can’t blame the shareholders.  I can and do blame the media though, because this is where the “rubber meets the road” and it’s the only place in the news cycle process that can affect the outcome of what we see and hear.

There have been many more actual terrorists attacks executed outside of the United States in the last, insert number of years.  Many, in fact, the clear majority carried out by actual “card carrying members”.  When a suicide bomber blows himself or herself up, there is no “I wanted to be part of that group”.  They are or more poetically were part of that group.  A couple of recent attacks come to mine, e.g., the attack at the Brussels airport and the attack at the military base in northern India.  In both cases, these “bad guys” were members of actual terrorist cells and carried out their mission to kill the enemy – any non-believers.  The incidents were reported locally for a short period and globally for an even shorter period.  And some very recent low-sophistication style attacks have barely received coverage.  This is what needs to happen here.

Whenever there is a mass murder in the US, especially in a public place, the media immediately floats the idea that it is somehow terrorist related.  In the clear majority of these incidents, we see that they were “wanna be’s” and amateurs, at best.  For example, it seems to me, that the guy in Orlando was a gay guy that couldn’t cope with his identity because of his upbringing and scorn within his community, so he lashed out at the innocent victims enjoying their evening and claimed jihadist affiliation to justify his actions.  And, the media helped him obtain this affiliation but calling him a jihadist.  They legitimized his actions.  Instead, they should have called him what he was, a murderer or better yet a “piece of S… that preyed on the innocent.

I’ve been confused before.  As I’m sure most of us have, not about our sexually, but about life in general.  But I’ve never had the thought that I should go kill some people on a campus, at work or at a club because of it.

One man’s terrorist is another man’s freedom fighter.

The media should keep that in mind, when they rush to make this connection between the perpetrator of a criminal act and its relationship to terrorism - in essence, legitimizing them and their cause.  Most of the time it’s just not there, even if they really, really want it to be, you know for entertainment’s sake.