Go Where there is No Path. But, I Can't, I'm Afraid of Snakes

A few months ago, my wife and I were shopping and came across this saying on a night shirt, “Go where there is no path”.  When I showed it to her, her reaction caught me a little off guard.  She said, “I can’t I’m afraid of snakes”. And, of course, being the person I am, I immediately translated that into a language I can understand – security-ish.  My first thought was, that explains why people don’t conduct risk analysis or even more importantly why they don’t even start the process.  They don’t tread into uncharted territory because there are snakes hiding in all that tall grass, so they stay where they’re comfortable – on the path.  Doing what is comfortable causes two problems.  

First, as Defense Secretary Don Rumsfeld, said, “We don’t know what we don’t know”, which translates into, we’re only protecting ourselves against what we can see, expect and believe is likely to occur.  Since, we don’t know what we don’t know, we’re not planning on dealing with its affects either.  This can be extremely more sinister because a lack of action could result in someone getting seriously injured or worse.  

Fortunately, there are methodologies out there that can get rid of the snakes.  I’m consulting on security matters with a local school district.  During our initial meeting, the District Superintendent, said, “Okay, where do we start? With an assessment to see where we are?”  Absolutely! 

Risk management is about managing risks.  In order to do that, you have to accept five factors:

1) You can’t prevent or deter everything

2) Protection from one threat may allow for some protection against another unrelated threat

3) Protection options must be in place before the event occurs

4) Risk Management must address the following pillars; detection, assessment, plans and procedures, response and engagement

5) Risk management and the assessment process is continual and is just part of what we do.

For ways to tame the snakes, read related articles here:

https://view.joomag.com/march-2019-ast-magazine-march-2019-ast-magazine/0952115001553308799/p4?short https://view.joomag.com/july-2019-ast-magazine-ast-july-2019-magazine/0612002001563068627/p60?short

The Need to Push Down Silos

A few years ago, a friend of mine, trying to generate additional students for the classes I teach, asked his cousin who works for a very large architecture and engineering firm in the new World Trade Center in New York City, if they would be interested in attending training on integrating security technologies into building design.  His cousin answered something to the effect, “No, we leave that up to the client after we turn the building over to them”.  While his cousin’s answer is not surprising it is disappointing and confusing to me. 

Not surprising because I’ve heard that so many times before.  In essence, everyone stays in their silo and the connection between the disciplines usually only involves answering questions about the project and clarifying requirements; architects architect – engineers engineer – and security securities, if you will.

It’s confusing on two levels.  First, at the beginning of every project the architect gets the client’s desires list; i.e., the building should be blah, blah, blah. Right from the start the architects develop a mental picture of what the building should look like.  Next he or she begins to include all of the regulatory requirements or “best practices” for design.  Best practices are nothing more than this is how it’s normally done.  In New York City, for multi-story buildings in Manhattan the façade default material is glass in the Mid-West it is reinforced concrete or masonry units.  Meeting regulatory requirements deal with disability act, fire and safety codes, such as, hallway width, stairs, doors and windows, and elevator placement, etc. and depending on the region some weather related events.  And second, very seldom are man-made threats considered.  This contributes to the fact that man-made threats continue to occur despite large amounts of money being spent on security measures. I guess the argument could be made, that “well, we’re not required to consider them like we are for natural threats so we don’t need to; besides it will drive up costs”.  On the surface this makes sense but if you dig just under the surface your next thought should be, why don’t “best practices” apply?

The Department of Defense, and some other federal government agencies to a limited degree, requires that integration mitigation strategies be included in their building design review process regardless of where or what type of threat is involved.  In fact, it’s mandated that all threats, including man-made threats be addressed by a group of stakeholders at the onset of any new building construction project and for renovation projects that meet certain thresholds or “triggers”.   The stakeholder group determines the “design basis threat” to the building and its occupants and the level of protection required based on the number of people occupying the space.   These two factors ensure that the appropriate amount of money is spent on protection options and in the unlikely event a catastrophe does occur; injury and death will be kept to a minimum.

By bringing all stakeholders together from a variety of disciplines, everyone 1) has a chance to air their requirements and needs, 2) buys-in to the group’s decision on which threats will be addressed and support the “DBT” and the level of protection required, and costs are kept down.  Adding electronics in the form of surveillance or other technologies lies with the owner after the project is completed.  So in the short term, the cost of this equipment and its installation is currently absorbed by the owner/client and is not part of the building costs.  This “trick” helps keep the building design costs down but doesn’t adequately protect people or the facilities they use.  But more importantly, the real costs to the client come after the installation from the long term requirement for equipment maintenance and manpower. 

Since buildings are currently designed with everyone, remaining in their silos, with  limited exception, the process is treated as if it were a vertical process, when in reality it’s a horizontal one.  The “silo effect” and the isolation it causes make security an “add-on” and limits its efficiency and effectiveness.  

Planning Now for the Terrorist Attack that Won’t Come or Will it?

While radical Islamic-extremist inspire large scale attacks have not occurred in the United States in some time, low scale attacks are more common place than you’d think and not necessarily exclusive to radical-Islamist.  “Bad actor” attacks using terrorist tactics occur all the time.  To prevent, deter and reduce the effects of a terrorist style attack, business owners, facility managers or anyone else charged with the security of those they service must determine if they are an attractive target to, not only terrorist attack, but also criminal activity.

In that regard, two questions come up, 1) “Do I deal with the public?” and 2) “Does the public (or a “bad actor”) have access to my facility?”  If the answer to both questions is “Yes”, then you are at risk.  Even if you answer “No” to the second question, you must remember that a dedicated threat will not be deterred and will bring the tools necessary to carry out the attack.  Answering these questions will be an indicator of threat likelihood.  Additionally, if you ask, “What is the public’s opinion of that service/product?”   The operative word here being “the public’s opinion” and not what you think, you will get an even better understand of your risk.  If there is the slightest likelihood that you could be attacked by a criminal or a terrorist, then you should reconsider if  the procedures you follow and the physical security countermeasures you already have in place are adequate.

Usually, criminal activity doesn’t result in injury to people or death.  Terrorist activity, regardless of motivation intends to inflict violence on another person in order to hurt them.  That said, most criminal acts involve the theft of or damage to property.  Consideration must be given to common criminal activities, such as; theft, burglary, damage to property, assault and work place violence, just to name a few.  Criminal activity using terrorist tactics on the other hand are directed toward people and try to cause as much injury or death as possible.  Common tactics still include; improvised explosive devices (Yes Virginia, sick people are still building bombs), using a vehicle or automatic weapon to inflict injury or death.  While school and workplace shootings have become the norm they are not necessarily terrorist attacks, although the results may be the same – they produce mass casualties. 

Mitigation strategies for any type of criminal activity, including terrorism, must be in place before the event occurs.  So, we want to deter the activity from occurring in the first place and then delay it so that it can be noticed and responded to by trained forces.  And finally, in the unlikely event it does occur we want to reduce it effects as much as possible.

In the case of IEDs, we want to move vehicle parking away for places where large numbers of people gather and prevent the placement of unidentified objects near buildings. 

To thwart the hostile vehicle threat, we need to place rated barriers between vehicle traffic and people, especially where large numbers of people gather; i.e., street fairs, sidewalks or pedestrian zones.

Since police departments and some security companies are teaching people to “Run-Hide-Fight, which actually means hide, we need to create spaces that actually offer protection.  Two protective options are, 1) retrofitting walls with rated ballistic materials; so that when people do hide they are actually protected and 2) limit movement of the person with the gun. 

Note, there will always be some level of risk no matter how much you plan and implement countermeasures.  The goal is to reduce the risk to a level you can accept and to continually analyze and make changes when warranted.  When you hear or see something in the news, you should ask yourself, “Can that happen here?”  If the answer is “Yes”, then you should take actions to change that to a “No”.

Chances are you are not going to become a victim of a terrorist attack; however, there is a greater likelihood that you will become a victim of a criminal act that resembles a terrorist act.  

The 310 Year Gamble

The Federal Government’s 310 Year Gamble on Your Child’s School Safety

In the days following the Parkland High School shooting, my emotions were out of control; first, because of the lack of “adult” leadership by the Federal government officials and secondly, because when called out by the high school’s young adults they (politicians) attacked the teens.  Whenever asked about how they intended to keep another active shooter event from happening they hid behind thinly veiled comments about how it was someone else’s responsibility to address the causes and fix them.

Let’s be realistic, it’s about guns, it’s about mental help, it’s about a person’s desire for fame, it’s about lack of protection, it’s about lack of designed evacuation routes and the list goes on…  Some causes can be fixed in the short term and others, like mental health issues will take many years to devise systems that are effective in identifying “at risk behaviors” and getting the person the proper treatment.  We also need to address the way schools are designed not only should they be great environments for learning by they must also be safe.  One example is there should always be two ways to egress a space in an emergency.  Currently, many times there is only one and if there are two, they lead into the same hallway.

So, in the meantime, if students and faculty are going to be taught to “hide” in the back of the classroom then the space must provide ballistic protection.  If it doesn’t, the AR-15 bullet will travel through the hallway locker, drywall or classroom furniture.  I thought, if we don’t have specific ballistic protection in place couldn’t we design a system similar to have hotels create additional space by mobile walls.  I reached out to my friends at Amulet Ballistic Technologies and come up with a design for retrofitting existing classrooms or new construction.

In 2018, the Federal government allocated $100 million for security upgrades to schools.  The deadline for application to receive some of that money was 31 July 2018.  If your school district didn’t apply, it for sure won’t get any of the money, so you’ll have to wait until next year.  Fortunately, many State legislatures have been setting aside funding and the process seems to be continuous.

Another unfortunately circumstance when it comes to funding is that most of the money will go to hiring school resource officers (RSO) from the local sheriff or police department.  Placing an armed guard is not in of itself sufficient.  While it will help deter possibly, the truth is if a RSO is present he/she will become the first victim and/or will not be where the shooting starts when it starts.  Another key security feature will be electronic surveillance and access control.  Both are useful and effective but have their limits as well.  Cameras must be monitored in “real-time” AND a response must be immediate.  Access control is only effective if it doesn’t become a burden to day-to-day operations.  If it becomes “taxing” people will figure out how to get around it.  

Now, back to $100 million per year for the next 10 years ($1Billion total).  There are an estimated 50.2 – 58 million students in America’s schools.  The average class size in the US is somewhere between 17 and 26, so let’s just say 20-22 students.  If we divide the average size class occupancy into the lower number of total students that tells us we have about 2.5 million classrooms (give or take).  Now, if the average cost of constructing or retrofitting one classroom with ballistic protection is $15,000 (I suspect that once we get going the costs will be lower and more likely to be about $10-12k for a classroom of 20 using the Department of Homeland Security recommended square footage for safe-haven/shelter space occupancy.) then it will take $3,750,000,000,000 to retrofit all existing classrooms.  At one billion every ten years that will be 375[1] years to protect every classroom in the US.

Let me put that into context.  Most people think that during the 2008 financial crisis[2], the treasury department used $700M to save the banks.  This is not true.  The Special Inspector General for the Troubled Asset Relief Program (TARP) in their summary report says that the total commitment of the government is $16.8 trillion with about $4.6 trillion already paid out.

According to a team at Bloomberg News, at one point last year the U.S. had lent, spent or guaranteed as much as $12.8 trillion to rescue the economy.[3]

In either case, more than enough to protect America’s kids in less than 10 years instead of over 300. 

---

[1] I rounded down to 310 years just in case my numbers are off a little, at any rate you get the idea.

[2] https://www.forbes.com/sites/mikecollins/2015/07/14/the-big-bank-bailout/#1c0b5b752d83

[3] http://www.pbs.org/wnet/need-to-know/economy/the-true-cost-of-the-bank-bailout/3309/

Parents and School Administrators are Buying
Security Equipment That Won’t 

Protect Children – Why?

Salesmanship and fear are the two main reasons.  Fear because active shooter events are more commonplace than a few years ago.  The recent discovery in New Mexico of abducted children being trained to carry out armed attacks at schools is frightening.  Since the federal government won’t address some of the underlying issues of gun violence by creating sensible legislation maybe they can concentrate instead on finding the horrifying number of missing kids that occur every year in America[1].  Just saying.

In the meantime, parents and school administrator know that something has to be done and have taken matters into their own hands.  

I applaud many States and school districts that have taken steps for comprehensive security improvements.  Unfortunately, there are an equal number of school districts that have only made superficial changes that really don’t offer protection from the active shooter threat or errant vehicle threats.  

Right after the February 14^th event in Parkland, everyone wanted to put more resource officers on campuses, more cameras and more access control.  While on the surface these may be good ideas, just getting more is not enough.  There must be processes in place that make them effective.  For example, if a school increases the number of CCTV cameras, then who monitors them in real time becomes essential.  Unless monitored in real-time, they only have evidentiary value.  The real value of CCTV is that it allows investigators to go back in time and figure out what happened.  We don’t need after-the-fact protection. 

Students and staff need to rely on protection that will actually protect them[2].

Bulletproof - C'mon really?

I saw a news report a couple days ago about a company offering “bullet proof” backpacks.  My antennae went up – way up.  There is no such thing as “bullet proof”!  The correct term is “ballistic resistant” or “bullet resistant”.  It may stop some types of bullets but it won’t stop all.  Therefore it is bullet resistant and not bullet proof.  Shady salesmen will play on your fear and lack of knowledge in knowing the difference.  Anyway, the news reporter had a marksman fire two types of handguns, which the backpack manufacturer said would be stopped, and they were, but when rounds from an AR15 (the most common type of weapon used in school mass shootings) were fired and the rounds went straight through the backpack and into the dirt berm behind.  The reporter asked why, and a guy whom I believe to be a company spokesman, said something to the effect, “well, it was shot at without books and binders being inside. That would change everything”.  To suggest that books and binders offer ballistic protection is just ludicrous.  Backpack manufacturers if I’m wrong AND you have the data to prove it!  Then do so and I will publically admit I was wrong.  

I’m amazed that Walmart and Costco are selling these backpacks for upwards of $100 and apparently do not make this distinction.  

Even if the backpack will stop a .9mm or .45mm, a person would have to be wearing it and be shot from the back.

Use Whatever You Can  

Police Departments and some companies have made a very profitable business out of teaching Run-Hide-Fight.  A defense strategy that teaches: run if you can, hide if you can’t and fight if you have to.  At first, this concept makes sense but the reality is the instructions being given during the R-H-F training actually teaches people to hide and use whatever they can for protection, or in worse case scenarios, use whatever they can to fight.  With this in mind, the idea that a student could hold a backpack in front of them and hide behind it, to me seems a little unreasonable.  I have a hard time imagining a ten year old reducing herself down to the size of a book-bag.  

Instead we should be teaching, to get out - Run-Run-Run - no matter what. Throw a chair through the window, punch thru the dry-wall - but do something that allows you to escape.  The idea of waiting for the "cavalry" to arrive and save the day is just crazy.  We could start designing all occupied spaces with, at least, two avenues of escape.  

This will take a considerable amount of time because first, we have to change our mindset about how we think about high occupancy spaces and how to design them to our advantage, and second, we have to actually implement these concepts into retrofitting classrooms or building new ones.

Don't D-I-Y This

A couple weeks ago, I was sitting next to a second grade teacher on a flight to Houston.  Of course, the conversation got around to school safety.  She said, “I don’t think about it.  I mean, I know what the security measures are for sheltering-in-place and fire drills and such but I really don’t give it much thought, and especially the “big stuff”.  I assumed she meant events like active shooters or terrorist attacks.  She’s right – she shouldn’t be worrying about security.  She should concentrate on teaching.  Educators should not try to D-I-Y this.  Instead, they should contact security professionals that are agnostic to products and are concerned solely with providing effective security solutions.  

That way, educators will get honest protection options that address issues on multiple levels and not just be sold more products.

---

[1] National Center for Missing & Exploited Children   http://www.missingkids.com/KeyFacts

[2] One More Town – One More Family – One More Angel – One More Funeral February 22^nd 2018 on-line edition of American Security Today.  https://americansecuritytoday.com/one-town-one-family-one-angel-one-funeral/

Prediction: An Active Shooter Event Will Occur at Your Child's School Unless Fundamental Security Changes are Made

One more active shooter incident, just a different town, different families but we’ve seen this show far too many times before.  I’m disgusted that everyone is blaming everyone else, the gun lobby oh it’s a mental health issue, the gun control tribe, oh we need gun control, everyone attacking the FBI and the mental health system.  The reality is WE, the collective We, failed.  No single agency or group or person or law is solely responsible.  Non-sensible gun control, non-sensible mental health laws, non-sensible law enforcement and non-sensible governing by public officials who haven’t display even the slightest bit of leadership.  Leaders stand up, admit their failures and take actions to correct course.  I know it’s only been a few days, so maybe just maybe someone will step up but based on previous track records, I kind of doubt it.

ELECTED OFFICIALS

If you’re an elected official, we’re calling you out.  There is nothing and I mean, NOTHING that is more important than protecting our kids, no … America’s kids.  If you think of them as someone else’s kids, then you’re sorely mistaken.  These are American’s kids, they belong to all of us.  It just so happens that they weren’t my blood relatives – at least, not this time. 

If you’re a public official you serve us – not your own or your party’s agenda – OUR agenda, and right now our agenda is – SAVE OUR KIDS! 

I had written a two-hundred-word rant but I think Emma Gonzalez said it much more eloquently that I.

This is not about anything other than will power.  We, after Presidential leadership, decided to put a man on the moon.  Not because we knew how but because that’s who we are.  We did it because of our willpower to do it. 

SAME OLD SOLUTIONS

I fear that in the aftermath of this tragic event those faced with finding solutions; i.e., security companies, elected officials, and school administrators will rush to add security guards and electronic security systems to their schools.  Unfortunately, these products will not solve the problem.  The school in Parkland had both.  Sadly, the guards will be somewhere else when the shooting starts or will become the first victim.  More cameras will only allow us to capture what happened, because there is no one monitoring and responding in “real time”.  Allowing teachers to carry guns, will not stop the carnage.  In fact, the idea of allowing “responsible” people to carry weapons, whether open or concealed, only puts more people at risk.  We could add fences and gates and metal detectors but all of those can and will be circumvented by a dedicated threat.  Besides, fences and gates and access control add to the issue of aggressiveness[1].  And, I certainly don’t advocate that we turn our schools into prison like compounds. It’s going to take a multi-layered approach.  We need to address the possession and use of guns, especially assault type weapons that are designed to kill as many people as possible in the shortest amount of time possible. Since they’re not for protecting a person and or his/her loved ones I don’t get why you need to have one.  I understand the argument that you have the right to protect yourself and your loved ones in your home, but do you really need an AR-15 to do that?  I’m not writing this to get in an argument over guns.  I’m writing this to voice my concern that if we don’t address the use of these type weapons in a logical way, we’re in for more trouble. 

Regrettably, someone will say, “Hey here’s how we fix this, so it doesn’t happen again”.  And then everyone will run after that solution for a while or until the next shooting happens.  Then we’ll figure out what “fell through the cracks”, plug that hole and wait for the next killings to occur.  Unless we have a comprehensive approach bringing a variety of disciplines to the table the “plug a hole” approach will cost lives.

Just like tackling the root causes of what happened in their totality so is the necessity to take a layered approach to implement security at the detection, assessment, command and control (school administration), response and engagement levels.  Without a holistic approach we will not have comprehensive solutions.

CRY FOR HELP – MENTAL HEALTH

I have to say, that while I detest what the Parkland shooter did, I also can see that this was a desperate cry for help.  The system failed this young man and now we have hundreds of victims to show for it.  So mental health professionals need to be consulted so they can express how they can have a greater impact on the actions of those who are troubled before they act out. Note: After the Isla Vista shooting in Santa Barbara a few years ago, the city formed a coalition of mental health professionals, police and others to respond to “welfare check” requests, instead of leaving it solely up to the police.

If we don’t address associated mental health issues and the laws surrounding when a physician can report his or her suspicions and concerns that a person may act out, then we’ll miss the boat again.  I think we all can agree, if a mental health professional says this person may resort to violence, then our first course of action should be to take away their ability to access firearms.  At least, until a risk assessment is done by a professional panel.

LAW ENFORCEMENT’S FAILURE

Now that the FBI is under scrutiny for its failure to follow up on what seems to be a credible tip, everyone wants to blame them.  In this instance, an investigation needs to be conducted (Director Wray has already announced a probe will be conducted) and if someone needs to be held accountable, at whatever level, then so be it.  But to place the blame solely on the FBI is wrong.  I have high confidence that the FBI will get to the bottom of what happened and correct it.

ARMING TEACHERS AND SCHOOL ADMINISTRATORS

Many people will want to have officials pass legislation so that teachers and school administrators can carry weapons at school.  Bringing more wood to a burning building only makes the fire grow.  While on the surface, armed teacher/administrators may seem like a good idea but when you think it through it’s not.  These active shooter incidents most often start outside the classroom, somewhere on the periphery.  This means, that in order to be effective armed school officials would need to be outside of the classroom to engage and neutralize the threat.  Second, if everyone has a gun then what is the triggering mechanism for suspicious behavior or “See Something, Say Something”.  The tip that came in to the FBI was initiated because the behavior of the shooter was out of the ordinary.  If everyone is walking around with a loaded weapon, then how do we distinguish the good guys from the bad guys?  Besides, when the shooting starts who’s to say it won’t become the “wild west”?  I fear there would be many more casualties.  We’ve become accustomed to armed security officers or policeman because they’re uniformed, which identifies them as a good guy, and because they receive regular firearms safety training.  Yet accidents do happen.  I doubt teachers and administrators would receive the same degree of rigorous and routine situational training.

Curious note here: A Presidential Pool reporter was stopped this morning because he had a gun in his bag and was attempting to travel with the President.  If gun advocates think everyone should be allowed to “conceal carry” a weapon wherever they go, then why not let the reporter carry his legally registered firearm while accompanying the President to his golf game?  Just saying.

CHANGE IN ARCHITECTURAL DESIGN

Additionally, schools are not designed for protection, they’re designed for education.  Now, that said, some newer schools have been designed with security in mind but most of the effort has been on creating a perimeter that is impenetrable.  The reality is, what happens if a person gets past the perimeter[2], then what?  No places to hide that offer ballistic protection.  Especially in the newer facilities with open floor plans that foster the interaction of students.  The idea of stacking desks and chairs behind a door and expecting the dry-wall to offer protection from a high caliber bullet is just insane. 

We need a change in the way we design inhabited space, especially when the occupancy is higher than 20 people or so.  There should always be two possibilities for escape[3]. 

And we should be teaching to run at all costs; hiding and fighting is not an option.  Throw a chair through the window, kick or punch a hole in the wall (after all it’s just dry-wall) and get out no matter what, the only time a person should stay behind is if they don’t have time to escape.  With that in mind, we need to start creating ballistically protected spaces throughout that provide sanctuary and keep people safe when it’s too late for them to run.

There are off-the-shelf ballistic materials available that can be used to create safe-havens, in new construction or existing facilities and can be embedded in white boards, desks and chairs. 

THE COST OF CHANGE

Now, don’t get me wrong, I think space exploration and figuring out a way that’s economical to get to Mars is a great and necessary thing.  I’m using this as only one of many examples that I could use.  I’m just saying, if we can find the money to this, then why can’t we find the money and willpower to protect our schools.

The fiscal conservatives will say that it will drive the budget up.  So!  I can’t think of a better return on investment.

The cost to launch the Falcon Heavy was somewhere close to $90,000,000.  Not to mention the costs of the R&D that came before hand.  There’s not allot of information about how much money is has been allocated to this program so I’m going to make some guesses here.  Let’s say there were 10 launches (ground tests and orbital) at $50M each.  So that’s $500,000,000. 

So, let’s just say, that to make a space that’s approximately 100 square feet, that can accommodate a classroom full of students and teacher, we use the occupied floorspace guidance provided by DHS for saferooms/shelter (spaces where a person can seek shelter for up to two hours) costs, $20,000.  If, you divide half a billion by $20k that’s 25,000 classrooms that could be built or retrofitted.  And let’s say on average a classroom has 20 students then that’s roughly 500,000 students and teachers that would have been afforded protection in the same period.  Using the same formula and using just the latest launch cost of $90M, equates to protecting 90,000 lives. 

This doesn’t look like rocket science to me.

REAL CHANGE

For real change to occur two actions are required;

First, we need to stop thinking about this as a singular issue to resolve.  This is a multi-layered issue and can only be resolved with a multi-dimensional approach.  No topic or option, no matter how painful, needs to be off the table[4].  Folks need to check their emotions at the door and get to work.

And second, and much more importantly, we need to change our way of thinking.  We need to think that although it didn’t happen in my town or to my family it did happen to me personally – these are not someone else’s kids and teachers, they are OUR kids and teachers – they belong to America!

We claim to be the greatest nation in the history of the earth yet we sure aren’t acting like it.

Related article https://view.joomag.com/ast-digital-magazine-august-2017-digital-aug/0415224001503451917?short

---

[1] Security Update Opinion: Little empirical evidence #security measures can really stop school shootings ow.ly/kRah30irCS0

[2] Security guidelines for safer schools can be downloaded from the PASSK12 website http://passk12.org/

[3] “Active Shooter Threat:  Why Run-Hide-Fight is Wrong and Two Ways to Fix It” appeared in the 16 May 17 edition of the New York Real Estate Journal

[4] Toolkits on how to change the safety culture at your school are available here  https://www.safeandsoundschools.org/

THE EVOLUTION OF RISK MANAGEMENT,

WAS DARWIN RIGHT?

In the Theory of Evolution, Darwin suggests that evolution is about survival of the fittest.  Was he right?  While he was talking about the natural world, his theory also applies to the security business.

In order to survive in today’s world businesses must adapt to their environments.  The threats that were around twenty years ago have changed.  They’ve become more sophisticated and must be adapted to.  What worked before won’t necessarily work in today’s world.  Not only have threats scenarios evolved but with the increase in technologies so have a new variety of threats come about. 

It used to be that a person who wanted to commit a breach of security had to be physically present in the space in order to carry out the attack.  That is no longer the case.  Since just about everything that has a moving part to it is somehow connected to the Internet of Things (IoT), a hacker does not have to be present in the physical sense in order to disable a closed circuit television (CCTV) camera, for example.  This means, a new way of thinking about threats, vulnerabilities and risk is necessary.

Threats used to be pretty much two-dimensional.  That no longer is true.  Those involved in the risk management business must think in three-dimensional terms.  In fact, they need to think about security as if it were a cube or box.  It’s six-dimensional and the approach to risk management must be carried-out that way.  This will require, pardon the pun, “outside of the box” thinking.

Additionally, without the “it’s part of the culture” way of doing business threat scenarios will continue to be played out with varying degrees of impact – and, some will be catastrophic.  Since we cannot prevent threats from occurring one hundred percent of the time we have to get the results down to a level that we can accept and handle with available resources.  This requires us to include scenario that are improbable but the results will overwhelm resources.  I call this “impact centric planning”.   I know most of us will not encounter an active shooter situation within our lifetime but active shooter threats must be planned for wherever high concentrations of people gather.  The adage, it won’t happen here cannot be the flavor of the day.  You’re right it probably won’t happen here, BUT if it does?  What will be the impact?

Not only must we deal with threats that are likely but we also must deal with threats that would be catastrophic even though very unlikely.   An excellent example of a highly unlikely event is the Las Vegas shooting incident.  That event was so improbable that if I would have brought it up during a planning session those in the room would have thrown their coffee at me. 

In order to survive, we must ensure we are the fittest.  So, Darwin was absolutely right.

Case Study at European Simulation and Validation Center (ESVC)

Protecting Students and Staff from Active Shooters

A Case Study at the European Simulation and Validation Center (ESVC)

THE TASK AT HAND – PROTECTING STUDENTS AND STAFF

Protecting the students at the European Simulation and Validation Center (ESVC) was our objective and specifically, reducing the mass casualty count during active shooter scenarios.  With the increase in terrorist attack, it was only logistical that the Executive Director would seek out protection for her staff and cadre of instructors, but primarily, for the students attending simulation modeling at the ESVC.

“We pride ourselves in being a professional organization with extensive safety and security knowledge. Protection of our staff and students in any way is a main priority”, says, Karen Zwart, Executive Director from her offices in Ede, The Netherlands.  

Because CPK United BV is known for their expertise in training senior government leaders and industry executives, as well as, their key staff elements, especially in the transportation and aviation fields, the ESVC is the “go to” place when it comes to conducting serious gaming models for evaluating emergency plans and the actions required by them.  The ESVC provides a comfortable environment that is conducive to leadership training at the highest levels in lieu of costly field exercises.  The ESVC can create an organization specific built (physical) environment virtually; use existing company or agency plans, while allowing “players” to travel down a variety of decision paths in a virtual environment.  This allows them to test plans through their interaction, individually and collectively to evaluate efficiencies – without the additional expense of a full-scale exercise and without anyone getting hurt.   Using ESVC simulation allows plans and procedures to be tweaked before a real incident occurs and damage or injury occur.   

KNOWN COMPONENTS OF THE RISK FORMULA

All good risk formulas have some commonalities.  The formula usually goes something like this; C (asset criticality) X Threat (What can harm us) X Vulnerability (How susceptible we are to the harm) = Risk (How bad is it?).  In this particular instance, two of the essential elements in calculating risks were already known to the assessment team.  Those elements included the criticality of the asset, (high value targets/students).  To understand the criticality, imagine for a second, if a multi-national corporation’s entire senior leadership along with key staff were on-site being trained and ESVC were involved in a catastrophic incident.  It would not only mean damage and death but could also influence the future of the organization and could very well be the end of that company. 

And, the second known element – threat – was an active shooter scenario.

ASSESSING VULNERABILITIES – A SNAPSHOT IN TIME

The next element of the formula was to determine the vulnerabilities of the site as they related to the threat.  Haines Security Solutions was called in to do the assessment due to its extensive experience in conducting risk analysis and developing mitigation strategies as they relate to building design.  Experts in forced entry, building design, antiterrorism and structural engineering repaired to the site to conduct the evaluation.

It should be noted that during conversations with the staff it was noted there was a low-moderate probability of occurrence of this type of attack; however, due to the catastrophic impact on the corporate structure of an organization attending training if impacted (low/moderate risk – critically high impact), it was determined to be of extremely high importance to conduct a full range of assessments.

Each area of the facility (reception area, training facility, staff offices, storage areas, coffee/snack center, bathrooms and print shop) was examined from both the owner’s and the aggressor’s points of view.

USING THE ASSET BASED RISK ANALYSIS METHODLOGY

This dedicated team of subject matter experts collected physical security, as well as, operational data on-site in order to allow them to fill-in the vulnerability element and complete the risk formula

They then started collecting physical data from the curb inward.   Data was collect on three layers where vulnerabilities could occur; i.e., property perimeter, building façade and internally controlled spaces.  Data about the IT system or software used at the ESVC was not collected because the ABRA, in this case, did not call for the protection of data on the IT system.  Instead, it called for the protection of lives.

Once back at their offices, the Haines Security Solutions team members used an assessment methodology called Asset Based Risk Analysis[1] or ABRA to analyze the data and make effective recommendations. 

The primary purpose of ABRA is to quantitatively measure threats, assets, vulnerabilities, and risks associated with large and/or small government or private facilities.  It establishes a security baseline, explores upgrades, recalculates vulnerabilities and risks, and recommends optimized features or improvements for facilities.  In essence, ABRA identifies current levels of vulnerability and risk and then identifies improved levels with the implementation of specified countermeasures.  Basically, a snapshot of where the organization is today and where it could be after countermeasures are implemented.  In addition, ABRA identifies the associated cost and impact of the improvements.  ABRA includes the performance of six sub-analyses: threat, target, vulnerability, optimization, risk, and cost–benefit.

  

Threat Analysis

The treat analysis is based on information collected during the site visit.  The information produces a threat rating, which measures the threat likelihood (the probability an attack will occur), and an effectiveness rating (the probability that an attack will be successful).

ABRA takes into account the current local threat environment for five conditions; i.e., stand-off, explosive; covert, overt and chem/bio.  Although the project only called for the assessment of an active shooter threat, since we were already on site, it only made sense to conduct all five analyses.

The assessment team started the assessment asking a series of about 50 questions to the staff to further determine the asset’s criticality and threat environment.   Additional soft intelligence was collected via the internet and a clear threat picture emerged.

Target Analysis

The target analysis is designed to evaluate and measure the value of all targets to the user and to the aggressor.  Targets could include any type of asset or target including facilities, people, equipment, money, processes and systems.  The end result of the target analysis is a numeric rating based on the target value or criticality to the user and the target value or usefulness to the aggressor.

Vulnerability Analysis

Our vulnerability analysis is designed to quantitatively evaluate and measure how vulnerable a specific asset is to a specific threat. This phase of ABRA identifies the countermeasures currently in place for a specific target and is assigned a value based on their effectiveness in mitigating threats (Baseline Vulnerability Rating [BVR]).

Optimization Analysis

The optimization analysis is the reapplication of the vulnerability analysis after implementing hypothetical improvements resulting from countermeasures that could be used for a specific asset.  Hypothetical countermeasures could include programmatic or procedural options.  The end result is an optimized vulnerability rating (OVR) associated with the specific target being analyzed, in this case, a training facility.  Based on the optimization analysis, the average vulnerability and risk rating can be identified and stated as a percentage.

Risk Analysis

The risk analysis is the aggregation of the threat, target, vulnerability, and optimization analyses to determine the calculated value of risk associated with a specific asset that is being targeted by a specific threat.

Cost–Benefit Analysis

The cost–benefit analysis compares the potential results of specific countermeasures for reducing or mitigating threats against specific assets.  The cost–benefit analysis is based on cost versus reduction in vulnerability and risk.

MAKING RECOMMENDATIONS THAT WORK

Most risk analyst make recommendations that bring the facility up to code compliance or base solutions on costs.  The recommendations made during this assessment were made based on risk reduction and not costs.   Our analysis showed that all recommendations were either extremely or highly cost effective.  Those recommendations included four main or specific areas.

Inhabited Space Hardening

Windows – Replacing the existing exterior windows with 6 mm laminated or poly-bicarbonate glazing.

Walls – Retrofitting the walls with a ballistic resistant material and continuing that concept to other features.

Furniture – Retrofit any interior elements, such as, reception desk, student chairs, tables, white-board (basically, anything or anywhere a student could hide behind if they were unable to exercise their first option of running away).

Electronic Security Systems

Electronic Security Systems – Install integrated access control and surveillance (CCTV) systems.

Mass notification system – Install internal and external speakers, alarm signals and visual message boards.

Crime Prevention through Environmental Design (CPTED)

Natural Surveillance/Natural Access Control – Use landscaping to reroute pedestrian traffic entering the building, so that as people approach they are observed from within the building.

Plans, Policies and Procedures

Use internal resources/corporate expertise to update plans, policies and procedures

IN SUMMARY

The recommendations would be implemented in all areas of high occupancy or critical areas (inhabited spaces); i.e., training facility, staff offices, coffee/snack center and stairway.  It should be pointed out that normally stairways or other transit type spaces would not receive the same level of protection because they are usually considered to have low occupancy, but input from the ESVC indicated it to be mission critical and a single-point-failure location for their operations.

Bathrooms, storage rooms, print shop and garage were not recommended to be retrofitted with ballistic protection because of their low occupancy density (uninhabited spaces).

Overall the risk reduction to the active shooter threat was calculated at 84 percent.  In other words, the Delta if you will, from where the risk is today to where it will be when all of the recommendations are implemented.   If implementation of all of the recommendation in the report were accomplished the risk reduction of the other threat scenarios would be between 74 and 98 percent.  The total project costs, including the data collection, evaluation and analysis and implementation of all of the recommendations was Euro72,130 ($76,200).  If only the recommendations pertaining to ballistic protection from the shooting threat were adopted the costs would be Euro53,560 ($56,700).  Recommendations were also prioritized to be implemented based on risk reduction and protection to the largest number of people first, and to allow their implementation as funding becomes available.

In summary, that’s a very small amount to pay to protect the lives of students and staff.  The added protections afforded by the recommendations help reduce risk and provide safety from a host of criminal and terrorist activities.  

Zwart added, “The conclusions made were rock solid and provided clear vision of the budget choices we need to make in the years to come.  By using their proprietary formula, Haines Security Solutions was able to demonstrate the tangible risk reduction of their recommendations.  Something we’ve not seen in other assessment methodologies”. 

Making it a safe and secure environment for those attending training – after all isn’t that what it’s all about?

---

[1] Haines Security Solutions was awarded a 2017 Platinum level Government Security award in the Risk Analysis category for its Asset Based Risk Analysis (ABRA) methodology.  The GOVIE awards are presented by Security Today magazine to outstanding products that address security challenges within the municipal, government, Safe Cities and law enforcement markets.