FOP Journal

The Mandalay Bay resort and casino in Las Vegas, site of the deadliest mass shooting by an individual in modern U.S. history, is just one example of how public venues can be vulnerable to attack.

It seems as though nothing is off limits to individuals and groups intent on doing harm to others. The Los Angeles County Sheriff’s Department Temple Station, NYPD’s 52nd Precinct and Texas Tech University Police in Lubbock are only a few of the law enforcement agency locations that have fallen victim to attacks in recent years. There have also been cowardly attacks at concerts and other entertainment events around the world, including the Las Vegas mass shooting and the Manchester bombing. These incidents have forced law enforcement to re-evaluate their current tactics, techniques and procedures for mitigating threats to public sites and their own workplaces. Additionally, critical infrastructure facilities and entertainment venues alike are examining their physical security postures to assess their readiness to combat these types of violent attacks. Law enforcement must place great emphasis on securing their own houses as well as public places that may be targets, developing facility-specific strategic response plans that work in conjunction with the venues’ existing security measures.

For many years, active killers and terrorist organizations have claimed victims from all walks of life on a global scale. These threats are very real, and law enforcement must maintain a constant state of readiness and conduct ongoing training and evaluations. Terrorists will indiscriminately seek soft targets and exploit vulnerabilities in an attempt to claim as many victims as possible. These attacks are not random or by accident; they are calculated acts of violence with the intent of achieving a specific outcome. The Federal Bureau of Investigation defines terrorism as “the unlawful use of force or violence against persons or property to intimidate or coerce a government, the civilian population, or any segment thereof, in furtherance of political or social objectives.” Therefore, law enforcement, entertainment venues and music touring personnel, like anyone else, must face the potential threat of global terrorism just as much as they must face random acts of violence.

The tactics, techniques and procedural lines of physical security and personal security are often blurred or confused by personnel not specifically trained in the two disciplines. To clarify this misconception, physical security is the act of protecting assets, whereas personal security focuses on the protection of personnel. Although these are completely separate procedurally, they both have common ground and therefore the security model must work in harmony between the two. This article will focus on the physical security aspects for maintaining a high level of security at a public venue, with the primary focus of creating a harder target and enhancing the level of protection of the site and its occupants.

Military and law enforcement operations all start with information pertaining to a particular operation or event. Once that information is collected, it is then vetted to determine whether it will yield any benefit to the operation. If it is determined to be beneficial, it is considered intelligence and categorized accordingly. The intelligence is then used to build a target package through the utilization of intelligence assets and other resources. Let’s examine the social media aspect of active-shooter incidents. Several case studies show that the attackers either posted their intent on social media prior to the attack or livestreamed during it. There is never a perfect solution to these types of incidents. However, data shows that the use of open-source intelligence (OSINT) may have proved beneficial in mitigating some of these attacks, thereby potentially saving lives. There are numerous companies that provide software platforms for the collection of OSINT. These platforms collect data from the dark web, social networks, public records and numerous other online locations, using keyword searches, geofencing, historical searches and SMS real-time alerts to quickly locate people.

A typical sight in most office buildings, a door being propped open is a simple example of a security vulnerability that has the potential to compromise an entire facility. (Photo by Darren Norris)

The first thing that should be assessed is the physical security posture of each specific potential target, whether it be a law enforcement agency, entertainment venue or critical infrastructure site. This starts with a thorough physical security assessment of the site by examining three key components: risk, vulnerability and real or perceived threats. This is often referred to as a threat and vulnerability or risk assessment. It is important to note that “threat,” “risk” and “vulnerability” are not interchangeable terms. Although they have similarities, each is very different in nature and is part of the overall paradigm for assessing risk and vulnerability.

Threats can often be a very challenging element to factor into a security plan. In most cases, a threat is viewed as the “X-factor” when it pertains to physical security. Threats are typically outside of total control and therefore are usually assessed on a theoretical basis, unless specific threats have been made to a specific site. However, once a threat has been identified, the validity must then be evaluated to determine whether the threat is real or perceived, and then the physical security plan can be tailored to meet it as required.

The risk assessment element is designed to clarify the nature of a risk. Additionally, it is designed to gauge the probability of occurrence, its intensity and what impact it will have on people, property and the surrounding environment. By decreasing existing onsite vulnerabilities, risk can be effectively managed and theoretically mitigated through proper assessments, planning and corrective action.

A vulnerability exists when there is degradation in the physical security design. An inoperable barrier, eroded berm or broken fence are all examples of vulnerabilities in the physical security design. These, coupled with existing threats, may result in a loss of life or catastrophic damage to the venue if existing vulnerabilities aren’t identified and the appropriate corrective actions taken.

For added perimeter security at a recent rally held by President Trump, Houston Police created barriers with M35 2½-ton (aka “deuce and a half”) cargo trucks and dump trucks to close roads around the venue. (Photo by Darren Norris)

A walk-through magnetometer at a concert venue is an example of access control.

In order to determine what level of physical security is required for a facility, a thorough physical security assessment must be conducted in order to identify what vulnerabilities exist. The simplified baseline for this assessment is to deny unauthorized persons access to the facility, equipment or resources. The singular focus is to protect lives and property at the location being assessed. There are seven basic elements that should be evaluated during the assessment. These multilayered elements are interdependent and must be assessed and maintained on a continuous basis.

1. Perimeter security: The perimeter is the boundary that separates the secure areas from those the public can access. There are numerous types of perimeters that are used to security a facility, ranging from fences to solid walls. The physical security assessment will aid in identifying which perimeter control measures should be added or enhanced for each individual location. This should also include the perimeter or security buffer zone.
2. Security guard force: Security guards with the appropriate jurisdictional authority to enforce the laws on the property in which they are paid to protect. In most cases, a properly deployed guard force will serve as a deterrent for those with the intent to do harm.
3. Access control: Access to any facility should be restricted to persons authorized to be in specific areas of the property. Access control is typically designed to allow access through the use of human-controlled methods such as a receptionist or security guard, or through mechanically controlled methods such as key locks or biometrics.
4. Intrusion detection system (IDS): Intrusion detection monitors the security system for both malicious activity and violations of facility policy. The system network will immediately alert security personnel in the control center of any irregularities. Typically, the intrusion detection system will integrate with other systems, such as perimeter control and video monitoring systems.
5. Video monitoring system (VMS): Video monitoring systems are a valuable asset because they can function as a facility-wide force multiplier when sufficient guard force does not exist to patrol the facility. Additionally, they serve as a visible deterrent and provide video documentation that can be used for analysis of previous events.
6. Security lighting: Proper security lighting must be utilized to protect persons and property from criminal activity. Proper lighting also serves as a deterrent and gives the perception of an increased security posture. Security lighting should be installed along perimeters, buildings, pathways, parking lots and any other area determined to be a potentially vulnerable zone.
7. Occupant emergency plan (OEP): Law enforcement or a physical security specialist should assist in the development of a comprehensive OEP for agency as well as all civilian sites. This is done through the physical security assessment process. The OEP is a critical part of the security plan, as it instructs personnel on how to respond during an incident. Comprehensive incident response guidelines for personnel should include the following elements:
   • Supervisory role
   • Rally points
   • Accountability of personnel
   • Communications
   • Medical aid
   • Law enforcement response and how personnel should interact during an incident

All personnel who work within the facility should be educated on the OEP so that they have a complete understanding of how they should respond to an incident, either individually or in a group.

Landscaping should be designed to deny access to the facility. This berm providing easy access to the roof is an example of what not to do. (Photos by Darren Norris)

Jersey barriers should be properly placed and properly filled. Empty barriers will not provide the required level of protection to deny access to unauthorized vehicles.

Crime prevention through environmental design is a widely used technique in the physical security design process. Not every facility has the fiscal means within its budget to purchase state-of-the-art security equipment or pay personnel for security staffing. The CPTED method is widely used in conjunction with all security designs, as it provides an additional layer of security for facilities with existing physical security assets. For facilities with limited budgets, CPTED will provide a fundamental layer of security. CPTED is not designed as a means to deny access to any location, but as a means of redirecting direct access to certain areas and deterring crime. The CPTED concept consists of four basic principles:

1. 1. 1. Natural surveillance is the “see and be seen” concept. A person is less likely to commit a crime if they believe that someone can see them committing it. During the design process, lighting and landscape should be assessed to provide maximum site-wide visibility.
      2. Natural access control is a method to direct pedestrian and vehicular traffic to a desired location through a predetermined route. In order to achieve the desired result, landscape, signage, fencing, lighting and walkways are used.
      3. Territorial reinforcement is used to create a sphere of influence giving the perception of an increased security posture at the facility. Public and private areas are clearly distinguished. The physical security design process may include the use of concrete planters, landscaping, signage or other devices to make a statement of proprietorship on the facility grounds.
      4. Maintenance is an often-overlooked component in all security programs. The “broken window theory” implies that if one broken window exists, it will lead to others. Neglected and poorly maintained properties will ultimately become an attractive target for the criminal element. Therefore, scheduled and as-needed repairs and preventive maintenance should be ongoing.

Portable barriers are an outstanding method for controlling access in the absence of fixed equipment.

Physical security assessments are not a “one and done” concept. Law enforcement should conduct regular training and evaluations at their own agency as threats against law enforcement continue to increase. Additionally, training and security assessments should be conducted on a regular basis with partner agencies and designated high-value targets within the community at locations such as stadiums, arenas, schools, water treatment facilities and other facilities that would be detrimental to the public and community infrastructure if attacked.

Unfortunately, numerous facilities have allowed their onsite equipment assets to degrade and essentially become ineffective. A good example is a cracked water-filled Jersey barrier that allows the water to drain out. A Jersey barrier, depending on design, ranges in weight from 1,500 to 2,000 pounds when full, versus an empty weight of approximately 150 pounds. Another good example would be the triple strand of barbed wire atop a chain-link fence. The triple-strand wire routed through the “Y” arm atop the fence post creates an ominous sight to most. However, the majority of fences are easily defeated, as many of the arms are not welded in place, thus rendering them ineffective from an access-control standpoint.

Officers tasked with conducting physical security assessments must be certified as a physical security specialist, train regularly, and build a comprehensive network with open lines of communication with the various high-value entertainment venues, educational sites and infrastructure facilities within the community.

Darren Norris retired as the assistant chief of police with the Pelion Police Department. He is the chief operations officer with MUR Strategic, a company that specializes in protective security operations. He has over 28 combined years of military and law enforcement experience. A state-accredited law enforcement instructor since 1995, he has served in command, patrol, K-9, SWAT and investigations assignments throughout his career and is an active member of Midlands Lodge #1.

See this story in the Winter 2018 FOP Journal issue.