The Need to Push Down Silos

A few years ago, a friend of mine, trying to generate additional students for the classes I teach, asked his cousin who works for a very large architecture and engineering firm in the new World Trade Center in New York City, if they would be interested in attending training on integrating security technologies into building design.  His cousin answered something to the effect, “No, we leave that up to the client after we turn the building over to them”.  While his cousin’s answer is not surprising it is disappointing and confusing to me. 

Not surprising because I’ve heard that so many times before.  In essence, everyone stays in their silo and the connection between the disciplines usually only involves answering questions about the project and clarifying requirements; architects architect – engineers engineer – and security securities, if you will.

It’s confusing on two levels.  First, at the beginning of every project the architect gets the client’s desires list; i.e., the building should be blah, blah, blah. Right from the start the architects develop a mental picture of what the building should look like.  Next he or she begins to include all of the regulatory requirements or “best practices” for design.  Best practices are nothing more than this is how it’s normally done.  In New York City, for multi-story buildings in Manhattan the façade default material is glass in the Mid-West it is reinforced concrete or masonry units.  Meeting regulatory requirements deal with disability act, fire and safety codes, such as, hallway width, stairs, doors and windows, and elevator placement, etc. and depending on the region some weather related events.  And second, very seldom are man-made threats considered.  This contributes to the fact that man-made threats continue to occur despite large amounts of money being spent on security measures. I guess the argument could be made, that “well, we’re not required to consider them like we are for natural threats so we don’t need to; besides it will drive up costs”.  On the surface this makes sense but if you dig just under the surface your next thought should be, why don’t “best practices” apply?

The Department of Defense, and some other federal government agencies to a limited degree, requires that integration mitigation strategies be included in their building design review process regardless of where or what type of threat is involved.  In fact, it’s mandated that all threats, including man-made threats be addressed by a group of stakeholders at the onset of any new building construction project and for renovation projects that meet certain thresholds or “triggers”.   The stakeholder group determines the “design basis threat” to the building and its occupants and the level of protection required based on the number of people occupying the space.   These two factors ensure that the appropriate amount of money is spent on protection options and in the unlikely event a catastrophe does occur; injury and death will be kept to a minimum.

By bringing all stakeholders together from a variety of disciplines, everyone 1) has a chance to air their requirements and needs, 2) buys-in to the group’s decision on which threats will be addressed and support the “DBT” and the level of protection required, and costs are kept down.  Adding electronics in the form of surveillance or other technologies lies with the owner after the project is completed.  So in the short term, the cost of this equipment and its installation is currently absorbed by the owner/client and is not part of the building costs.  This “trick” helps keep the building design costs down but doesn’t adequately protect people or the facilities they use.  But more importantly, the real costs to the client come after the installation from the long term requirement for equipment maintenance and manpower. 

Since buildings are currently designed with everyone, remaining in their silos, with  limited exception, the process is treated as if it were a vertical process, when in reality it’s a horizontal one.  The “silo effect” and the isolation it causes make security an “add-on” and limits its efficiency and effectiveness.  

Planning Now for the Terrorist Attack that Won’t Come or Will it?

While radical Islamic-extremist inspire large scale attacks have not occurred in the United States in some time, low scale attacks are more common place than you’d think and not necessarily exclusive to radical-Islamist.  “Bad actor” attacks using terrorist tactics occur all the time.  To prevent, deter and reduce the effects of a terrorist style attack, business owners, facility managers or anyone else charged with the security of those they service must determine if they are an attractive target to, not only terrorist attack, but also criminal activity.

In that regard, two questions come up, 1) “Do I deal with the public?” and 2) “Does the public (or a “bad actor”) have access to my facility?”  If the answer to both questions is “Yes”, then you are at risk.  Even if you answer “No” to the second question, you must remember that a dedicated threat will not be deterred and will bring the tools necessary to carry out the attack.  Answering these questions will be an indicator of threat likelihood.  Additionally, if you ask, “What is the public’s opinion of that service/product?”   The operative word here being “the public’s opinion” and not what you think, you will get an even better understand of your risk.  If there is the slightest likelihood that you could be attacked by a criminal or a terrorist, then you should reconsider if  the procedures you follow and the physical security countermeasures you already have in place are adequate.

Usually, criminal activity doesn’t result in injury to people or death.  Terrorist activity, regardless of motivation intends to inflict violence on another person in order to hurt them.  That said, most criminal acts involve the theft of or damage to property.  Consideration must be given to common criminal activities, such as; theft, burglary, damage to property, assault and work place violence, just to name a few.  Criminal activity using terrorist tactics on the other hand are directed toward people and try to cause as much injury or death as possible.  Common tactics still include; improvised explosive devices (Yes Virginia, sick people are still building bombs), using a vehicle or automatic weapon to inflict injury or death.  While school and workplace shootings have become the norm they are not necessarily terrorist attacks, although the results may be the same – they produce mass casualties. 

Mitigation strategies for any type of criminal activity, including terrorism, must be in place before the event occurs.  So, we want to deter the activity from occurring in the first place and then delay it so that it can be noticed and responded to by trained forces.  And finally, in the unlikely event it does occur we want to reduce it effects as much as possible.

In the case of IEDs, we want to move vehicle parking away for places where large numbers of people gather and prevent the placement of unidentified objects near buildings. 

To thwart the hostile vehicle threat, we need to place rated barriers between vehicle traffic and people, especially where large numbers of people gather; i.e., street fairs, sidewalks or pedestrian zones.

Since police departments and some security companies are teaching people to “Run-Hide-Fight, which actually means hide, we need to create spaces that actually offer protection.  Two protective options are, 1) retrofitting walls with rated ballistic materials; so that when people do hide they are actually protected and 2) limit movement of the person with the gun. 

Note, there will always be some level of risk no matter how much you plan and implement countermeasures.  The goal is to reduce the risk to a level you can accept and to continually analyze and make changes when warranted.  When you hear or see something in the news, you should ask yourself, “Can that happen here?”  If the answer is “Yes”, then you should take actions to change that to a “No”.

Chances are you are not going to become a victim of a terrorist attack; however, there is a greater likelihood that you will become a victim of a criminal act that resembles a terrorist act.  

Getting Everyone to Speak a Common Language

A couple weeks ago, I was teaching a class about using building design to deter criminal activity, including terrorist attack, and when it fails reduce its effects and prevent mass casualties.  After the obligatory introductions, I said something to the effect, that building design is a matter of reducing risk whenever and wherever possible.  But in order to do that you have to the know your “DBT”.

Based on the blank stares, I got back, I knew something was wrong.  So, I said it again.  Still the deer in the headlights looks.  So, I said, “Everyone knows what DBT stands for, right”?  Still nothing.  Not one person raised their hand.  I was taken aback.  After all the class was made up of seasoned architects, engineers, planners and security folks.  I would have thought, at least, one or two would have known what I was talking about.

So, we spent the new few minutes talking about Design Basis Threat or DBT, if you will.  DBT is identifying your threats, their tactics, the tools they may use and then designing your building to deter or prevent them from happening, in the first place, and understanding that if they do happen you can reduce their effects if you’ve included reduction strategies into the design.

The very first thing to do is to assemble “the planning team”.  The idea that “it takes a village” needs to be used here.  The team should include architects, engineers, facility manager, security, end users and others.  It’s important to bring these folks together, so that they can discuss the parameters of what they are trying to accomplish and “buy in” to the project.  If done correctly at the beginning of a project, security costs can be kept to a minimum, usually somewhere around five percent of the total project costs.  If security comes in at the end of the project this cost may skyrocket to thirty-forty percent, because of the long term cost of equipment maintenance and especially, personnel costs.

Once the team is assembled, the first step is to identify the threat or threats.  Threats can be divided into two categories; natural and man-made.  Fortunately, laws and ordinances exist that address natural threats in building design; i.e., earthquake, flooding, fire, tornado, etc.  Man-made threats on the other hand – not so much.  Although, that is changing slowly.  Last year, federal legislation was signed into law that addresses the use of hostile vehicles as a method of attack in public spaces.  We’re still waiting for the DHS report the law requires and its subsequent findings and recommendations.  I’m particularly concerned that our government hasn’t the courage to attack hostile shooter legislation, when it is so needed.  But that’s another Blog topic for another time.

The second step is to identify the motives of the man-made threat,; i.e., causing injury or death, theft or unlawful removal of property or equipment, damage to property or facilities and causing adverse publicity.  Then we need to figure out what type of groups commit these acts; criminals (sophisticated/non-sophisticated, organized/unorganized), protesters (organized/non-organized), terrorist (domestic/trans-national/state-sponsored) and subversives.  

Then we look at the tactics they use; stationary or moving vehicle, different types of weapon usage, forced entry, etc.  Each tactic uses a different set of tools. That said, each type of tool use has a countermeasure available to reduce its effectiveness.

If we understand their motives, tactics and tools, we can design countermeasures into inhabited space that reduces the possibility that they will occur and when that falls short reduces their effects. 

My book, The Solutions Matrix: A Practical Guide to Soft Security Engineering for Architects, Engineer, Planners and Security Professionals, will be available in September.  It will outline the processes used to determine DBT, have a quick reference chart that outlines how to counter each type of man-made threat and provide examples of practical real-world solutions.  

They We're My Boys, too!

They We're My Boy's, Too!

One afternoon, this past summer I was watching TV with my 11 year old grandson.  He said, “Grandpa, what do you do?”  I responded, “I teach architects, engineers and security people how to incorporate security into building design”.  His next question was more of a statement, “so that’s why you travel all over”.  “Yep”, I said.  “But why do you do that”, he went on.  So, I told him, “when you see all that stuff on the TV about terrorism, well, that stuff’s personal to me”.  He asked why and I told him my story about being at Rhein–Main Air Base when the dead Marines were brought back after the Beirut bombing.  

See full story in My View Blog from October 2015 here http://hssview.blogspot.com/ . 

We went back to watching TV.

A few hours past, then he came to me while I was in my office checking emails, and gave me a really big hug and said, “Thank you for keeping Grandma, Mom, Dad and me safe”.  “You’re welcome Philip. Now you can do something for me. Be the best YOU, you can be, to make sure that what I’ve done was worth it”.  “Okay, Grandpa I will, I promise”, he replied.  He went back to playing and I went back to doing what I’ve been doing since October 1983, thinking that those Marines, my country, my friends and especially my family and doing what I can to protect them. 

I finish each workshop I do telling the students why I'm there.  I tell them about the 283 Marines that were killed by terrorist and the event that changed who I am.  Over the years I've told this story many, many times, and yet, every time I get emotional - even 33 years on.  You see, they were my boys too!

DESIGNING INHABITED SPACE

Social Engineering

Spaces that are occupied are designed with a specific purpose in mind.  If the space is private then the space is designed to perform a particular function, such as, office space or a factory work floor.  On the other hand, if the space is public it is normally designed to allow open access to it, to allow people to either use the space or transit through it.

The concept of using design to “socially engineer” public and private space has been around for some time now.  Building designers have been designing spaces to achieve a variety of desired effects.  Back in the Middle Ages, castles were designed to withstand an enemy’s siege and when that didn’t work and the invaders breached the walls divide the aggressors into small enough numbers in order for the hometown folks to kill them.

So it really should come as no surprise that over the years new concepts and technique have been developed to address new threats.  Although we’ve come a long way in our tactics based on new threats the purpose remains the same – cause people to do what we want them to do or suffer the consequences of their actions; detection or capture.

In the modern era, threats come in a multitude of forms, either natural and man-made.  We’ve done a pretty good job in regulating construction standards for natural threats, such as, high winds, tornadoes, earthquake and fire but we’ve done less of a good job for man-made threats.

THE ENVIRNOMENT

In 1991, Crime Prevention through Environmental Design (CPTED) was introduced as a concept to reduce crime in neighborhoods.  The program has become so successful that most cities have ordinances that require implementation of CPTED principles during all new construction projects or phased in during major renovations.

CPTED controls the surrounding environment of a building thru four strategies:

Natural Surveillance – developing opportunities for observation of all spaces within an area by those occupying, using or transiting the area.

Natural Access Control – causing access control to be part of the environment by allowing design to create “choke points” and paths to and from buildings so that there is no doubt this is the proper way to enter/egress the area, even for first time users.  Non-adherence would cause detection and a response by authorities.

Territorial Reinforcement – identifying public and private space.  There should be a clear distinction of who the property belongs to.  This doesn’t mean putting up a fence; instead this can be achieved by using different materials, shrubbery/bushes, and cobble stone paver instead of poured concrete for example.

Maintenance – although not really a concept, the fact remains, if the space doesn’t have continuous upkeep it will come into disrepair through normal use and before too long become unsightly and bred criminal activity.

THE BUILDING ITSELF

After the Khobar Tower terrorist attack in Saudi Arabia in 1993, the Department of Defense identified the lack of a comprehensive overarching standard for building construction for the protection of personnel.  During the investigation of that incident it was observed that most of the victims were not killed or injured by the blast itself but instead were injured because of how the building reacted to the blast.  This was again proven in Oklahoma City in 1995.  Most fatalities were the result of the building collapsing upon them and not from the bomb blast itself.  Over the course of the next few years, through analysis and a lot of painstaking work, 21 standards were developed for the construction of DOD Buildings.  When implemented correctly the standards will reduce the effects of terrorist attack to personnel in the inhabited space.  While these standards are regulatory for DOD buildings the concepts are proven and can, and I believe should be implemented for all new construction or during major renovation projects for buildings that house 10 or more folks.  Implementing these standards at the beginning of a project may add 2-5% in increased costs to the project.  Adding the features later can add an additional 20-30% in cost overruns.  So just from a cost benefit perspective it makes good sense.  Not to mention, the reduction of injuries and number of dead during a catastrophic event.  You can’t put a price on that.

THE INTERIOR

Over the course of the last 10 years or so, we have seen a dramatic increase in criminal activity within inhabited space – in schools, hospitals, theaters, police station, etc.  Those involved in planning mitigation strategies and designing inhabited and uninhabited spaces, basically anywhere the public gathers, should now consider criminal activity within the confined spaces they are designing.  Recent events prove this activity can include, knife attacks in hospitals, shootings in schools, theaters and police stations and bombings at military facilities.  Unfortunately, this trend will continue for the foreseeable future.

So what can we do about it?  First, we would be well served if we required our leaders to implement legislation that addresses these current crises and looks to the future for emerging threats.  Unfortunately, the criminal threat and terrorist threat will be with us for some time to come, probably forever.  Both have changed over the years and as we address them we need to change too.  Second, even without the government we can start designing spaces addressing these three components; the environment, the building and its interior.  We really shouldn’t wait on the government to act; we should take it upon ourselves to do the right thing even without government intervention or supervision.  We can start by implementing these concepts on all new construction or whenever a renovation project meets a certain threshold (to be established locally).

I sincerely believe that when all three design components are incorporated into the building design “from the curb inward”, risks to personnel can be significantly reduced and their effects on people minimized.  We have to design the inhabited space so that people do what we want them to do and when they don’t they’re detected and captured, and the results of their bad actions are kept to a minimum.  It won’t happen on its own – we have design it that way!

 

How to Use Building Design To Increase Security Effectiveness

 

The Aesthetics vs Design Basis Threat Approach

 

Did you know that adding security measures after the design process has reached the 35% designed phase can increase the cost of a construction project by 20% in the short term and much more long term.  Think about it.  Adding security at the beginning may add a mere 2% to the overall project costs.  Why is that?

Most buildings are designed for aesthetics and not the threat that the building must face – whether those threats are man-made or from natural causes.

There are plenty of regulations that address fire and earthquakes but rarely are their construction codes for incorporating security measures for the myriad of other threats.  That can change.  By bringing architects, engineers, planners, facility managers and security professionals together at the beginning of the design process the building design including the surrounding area can actually be used to deter criminal activity and reduce the effects of catastrophic events; such as, high winds or terrorist attack.

The design team needs to know and agree on what possible threats there are to the building, people and information inside.  This is called the “design basis threat” or DBT.  By knowing the DBT the design team can ensure each potential threat is mitigated through the design of the building.  Possible mitigation measures could be maximizing the stand-off distance from legal parking spaces to the building façade.  For example, the further the stand-off distance is, the less likely it is that the building will be affected by a stationary vehicle borne improvised explosive device.  Also by keeping the “unobstructed space” (the area immediate adjacent to the façade) free of shrubs or other places where small explosive devices or tools could be concealed, will eliminate that potential threat.  These are just two threats that can be affected through design.  Most others can be too.

In order to be effective the design team must consider all threats that are capable of effecting the building, whether they control the surrounding property or not.  If adjacent property offers the opportunity for people will “ill intent” to compromise the building then that area must also be considered. 

We usually call this “designing from the curb”.  There are four general rules to follow in providing mitigation strategies in building design. 

First, deter bad behavior.  We do this by training personnel on what is expected of them during on-boarding orientation.  We should also teach what constitutes “bad behavior” and how to report it.  An additional deterrent is a well-trained and well-equipped security force.  A common practice is to post a warning sign or a fence but rarely will this deter a determine advisory.  That said, we can design inhabited space so that a would be perpetrator will choose another “softer” target.

Secondly, we should delay “the bad guy” so that through effective design their presence and the activity they are conducting will be noticed.  A very effective way of doing this is creating as much distance as possible from the entrances of the building to the uncontrolled/public space.  The longer it takes to transit the space the more likely it is that someone will notice.  We commonly forget that each perimeter layer provides an opportunity to delay.  Perimeter layers are:

o   Layer 1 – property boundary

o   Layer 2 – exterior enclave or enclosure
o   Layer 3 – facility façade or elevation
o   Layer 4 – internal enclave or controlled/restricted space

Third, detect bad behavior. We can do this by limiting the number of access points, so that someone attempting to enter in a different fashion will stand-out and be noticed.  The use of combined landscaping; i.e., rocks, meandering pathways, shrubs, trees, water obstacles can be very effective tools in channeling persons to the correct access point.   Another good design tool is to make walkways pass by windows where people in the building, either from their workstations or a public space, such as, a break room, will be able to see people approaching.  In the 80’s we relied on security guards to do the watching for us.  As man-power cost rose over the next couple of decades, we replaced the guards and started to rely heavily on electronic security systems (ESS); i.e., Close Circuit Television (CCTV) or Access Control Systems (ACS).  While ESS is a great force multiplier, I submit that by designing approaches to the building so that they can be observed by persons inside will add tremendous detection capability and reduce long term costs in maintaining and monitoring the ESS systems.  Some assistance is provided by biometrics and analytical video but remember technology is a tool to be used by a human.  A recent article in the Chicago Tribune reported that less than one half of one percent of crime is solved by cameras. 

And finally, the fourth element of design is to defend against bad behavior.  One of the most common mistakes in using too much technology is that the requirement to respond to bad behavior is forgotten.  Therefore, a response force must be readily available.  They must be well-trained through drills and exercises and they must be well-equipped. 

Remember, the building does not have to look like a fortress in order to be secure.   By working together, architects, engineers, planners, facility managers and security professional can ensure it’s aesthetically pleasing and still provide adequate measures of security that are transparent to the public.  When these disciplines collaborate and security is incorporated at the beginning of the project, an immediate gain can be realized in keeping the project costs down and in the long term by limiting the need for maintenance and manpower.