It hasn't happened. By due diligence or pure luck, no major outdoor spectator venue in the United States has experienced a significant security breach - much less an act of premeditated, catastrophic terrorism - in the decade since the Sept. 11 attacks.

It hasn't happened. By due diligence or pure luck, no major outdoor spectator venue in the United States has experienced a significant security breach - much less an act of premeditated, catastrophic terrorism - in the decade since the Sept. 11 attacks.

"I thought we'd surely have seen an attempted large-scale, organized terrorist attack on an entertainment venue by now," says Missouri State University associate professor of management Ben Goss, author of numerous articles on venue security. "Instead, the primary issue - and by a wide margin - is spontaneous terror, those instances of danger deliberately created by patrons who attack other patrons or otherwise cause unplanned or semi-planned safety issues. Fortunately, many of the operational measures taken to prevent organized terror can be and have been used to help thwart or contain spontaneous terror, too."

U.S. Homeland Security director Janet Napolitano, who encouraged security diligence among fans with her "If You See Something, Say Something" policy at Super Bowl XLV in Dallas, reported no credible threats in advance of Super Bowl XLVI. Nonetheless, game day in Indianapolis, which began with the stadium opening to X-ray scans and small purse screenings (larger bags were not allowed) four and a half hours before kickoff, included 8,000 workers and volunteers who had undergone security training, 3,000 private security workers and thousands more Indianapolis police officers and firefighters. By then, city buses had been cleared by bomb-sniffing dogs and all cargo entering the stadium had been checked for contraband and explosives. A photo purported to be an interior view of a sniper's nest perched among the Lucas Oil Stadium rafters even made the postgame sports blog rounds.

"I'm around a lot of these guys who are bomb techs, and on the one hand, they sometimes feel that we've been lucky, and on the other hand I think we really have hardened sports facilities by becoming much more aware of best practices and standards," says Walter Cooper, director of research and education for the University of Southern Mississippi's National Center for Spectator Sports Safety and Security (NCS4). "I really think we've made a difference."

Beginning in 2006, Cooper and USM colleagues began researching security measures surrounding what they now refer to as "sports and special events," taking into account not only athletic contests, but the commencement ceremonies and concerts often held in sports venues. Backed by a grant from the Mississippi Office of Homeland Security, the researchers identified the key security stakeholders within each of the state's public university communities (the athletic facility manager, the campus police chief, the local emergency management director, the fire/hazmat chief and the head of emergency medical services) and presented each group with hypothetical scenarios during three separate Delphi rounds. From this, 133 best practices emerged in nearly a dozen categories ranging from risk management to emergency management.

Additional studies involved not only key college-town stakeholders, but subject-matter experts representing the NFL and the U.S. Department of Homeland Security, as well. Through prioritization, the 133 were winnowed down to a less daunting 33 "baseline protective measures - those items you must have in place," according to NCS4 associate director Stacey Hall, lead author of Security Management for Sports and Special Events, published earlier this year by Human Kinetics.

These include, first and foremost, a risk assessment that identifies threats and vulnerabilities. "You're talking about all hazard incidents," Hall says. "Depending on where you are in the country, you're going to have different risks, different threats. If you're in the South, clearly weather is going to be one of those. I know terrorism is kind of far-fetched for some people, but it's still something that you have to consider. So is crowd control, right down through fraudulent tickets and merchandise."

Next comes developing measures to counter identified vulnerabilities and then training the aforementioned multiagency stakeholder team as to policies, procedures, roles and responsibilities. This is followed by training of event staff, "your parking attendants, ticket-takers and ushers - those frontline people who are basically the eyes and ears of the organization," Hall says.

Key to the training process is exercising the security plan, so that (as Hall puts it) "the plan's not just on paper and sitting on a shelf. It's actually being tested to make sure that the stakeholders can do what they say they can do, and you can follow the capabilities, identify gaps and make improvements. It has to be a continuous cycle of improvement where folks are not just saying, 'Okay, we've done it and that's it.'"

The USM research findings haven't been gathering much dust, either. Based on that work, what was then known as the Center for Spectator Sports Security Management received a $3.5 million grant from U.S. Homeland Security to develop a risk-management curriculum for sports and special events and then take it national. Between April and August (essentially the NCAA's off-season) in 2008 and again in 2009, two-person teams of trainers visited NFL stadiums and other locations within easy commute of multiple colleges and universities to conduct two-day security workshops. According to Cooper, who helped train the trainers, 68 workshops were attended by more than 500 individuals from schools representing all three NCAA divisions. The curriculum was based on a four-day brainstorming session among subject-matter experts, where response models developed by Homeland Security (in particular, the National Incident Management System, or NIMS) and the Federal Emergency Management Administration were adapted to sports and special events.

Meanwhile, the NCS4 has made adjustments to its own Sport Event Security Aware (SESA) system. Developed in 2006 to audit and approve measures in place on Mississippi's seven public university campuses, SESA now awaits Homeland Security's Safety Act approval. Such approval, based on a federal act outlining minimum security management expectations, translates to security of another sort: internal peace of mind. Explains Cooper, "The NFL has Safety Act approval for its security management system, which means if there is a major incident in an NFL stadium, the league and the team are going to be in a lot better place in terms of litigation that might take place."

"In the U.S., pro sports leagues have best practices for their members, and the NFL does a good job of evaluating its teams and grading their facilities," Hall says, adding that the NCAA has a planning options document for colleges. "However, most parties are hesitant to use the word 'standards' for folks to adhere to and be held accountable for. This is the direction in which we need to head."

Accountability is at the heart of the NCS4 approach. When dispatching teams to deliver the risk-management workshops, Cooper typically partnered someone in event management with someone in law enforcement. He found that athletic departments, despite their unique position of hosting the largest single-day gatherings of human beings on campus, were not necessarily up to speed or even in the loop in terms of disaster preparedness. "The university might be NIMS-compliant for its overall university response plan, but that doesn't necessarily mean that the athletic department and game-day operations staffs have in place those things that need to be in place," he says. "They view themselves as running a ballgame or an event, not necessarily responding to an incident."

The NCS4's SESA system suggests conducting at least one annual tabletop exercise in which all stakeholders are asked to react to hypothetical situations. "You present your command group with a number of 'what if' scenarios - maybe you have an explosion in some part of the stadium, or maybe a fire breaks out in a trash bin, or maybe at the same time a fan experiences a heart attack," Cooper says. "The whole idea of the incident command system is when you have an event occur, the incident commander becomes whoever has the expertise in that area. If you have an active shooter, someone out of law enforcement is going to become your incident commander. If you were to have a fire, then the fire/hazmat rep in your command center is going to be the lead incident commander, because he's been trained in that regard."

As for the athletics administrators at the table? "The hardest group to get together has been the athletic department reps, because invariably they say, 'I turn that over to the police chief,' " according to Cooper. "But then you come back and say, 'But whose event is this?' 'Oh, it's our event.' It's their ownership."

Here's where potential chinks in the college's security armor can come into play. "In most instances, including here at USM, the police chief on campus recruits off-duty law enforcement officers for a football game, and yet the athletic department is paying for it," Cooper says. "So he will submit how many officers he needs for a particular ballgame, and he may get a budget back that will only cover half the amount he says he needs. So then he's got to decide where the priorities are in terms of where he places those pieces."

While a full-time campus police force of, say, 30 sworn officers is trained to handle all manner of security situations, the part-time personnel available on game day can represent a different level of response expertise entirely. "When you get to sports events, you're depending on a part-time workforce. You've got a lot of people coming into that event who are not normally on your campus, and they have not been trained in anything," says Cooper, adding, "Most universities hire some sort of outsourced security group as hourly workers to handle their ticket-taking, the gate, bag checks, etc. These are $8-an-hour-people, whereas an off-duty law-enforcement officer is $40 an hour plus. And there's a lot of turnover from event to event in that workforce. So, how you orient them and train them becomes a major obstacle. If something happens, what's their role, and how are they going to be a part of the response team?"

Colby Jubenville, a Middle Tennessee State University professor and co-author, with Goss, of an article titled "The Post-Bin Laden Era: Where Do We Go From Here?" (published last August by the International Association of Venue Managers), has no evidence to prove security corners are being cut over cost, but he fears it can easily happen. "If there's a general feeling that this isn't as important as it used to be, it's because first of all it has disappeared from the front page, and secondly people are saying, 'Hey, this is going to impact our bottom line,'" Jubenville says. "I think it's the formula that everybody uses - risk and reward. They say to themselves, 'Is this worth the investment?'"

Three weeks prior to the Super Bowl, fans visiting San Francisco from New Orleans complained of being threatened by 49ers fans during the NFL's divisional playoffs. For the NFC Championship Game the following week, San Francisco police working Candlestick Park security donned New York Giants jerseys hoping to draw out the most obnoxious patrons in the crowd. Ejections for unruly behavior nearly doubled from the previous week's game. Among the 29 fans arrested was a man charged with threatening an officer - a felony. That he was accompanied by his two-year-old son led to an additional charge of child endangerment.

"I think fan violence has become the front-burner issue, by far," Goss says. "We see a continued decline in civility at all levels of society, which permeates the atmosphere at entertainment and sporting events. People come to these events to let their emotions go, and with that also comes a lack of restraint regarding fellow patrons. The Bryan Stow incident in Los Angeles is a clear example of this, but only one of many."

L.A. police chief Charlie Beck called the Stow incident - in which a 42-year-old San Francisco Giants fan was beaten nearly to death on Opening Day last spring - a "game-changer" in terms of Dodger Stadium security. Measures in the immediate aftermath included employment of a data-based security system, installation of security cameras at stadium entrances, a ban on tailgating, post-game debriefings between Dodgers officials and police, and a beefed-up police presence. "You're going to see a sea of blue," Beck said at the time, "but it's not going to be Dodgers blue. It's going to be LAPD blue."

A lack of security force was widely blamed for the February post-game soccer riot that killed 74 people in Port Said, Egypt. If that weren't horrific enough, next-day protests over the security breakdown left another half-dozen dead and more than 1,700 wounded.

While the United States has yet to experience anything like that, recent incidents of fans gaining field access during games - or even during stadium down times - continue to remind security professionals here of their potential exposure to more heinous crimes. "I believe stadium managers will soon be forced to take on a European model of fan containment that involves a dedicated, separated and heavily guarded section for visiting fans, as well as police escorts to and from vehicles, into and out of stadiums," Goss says. "I saw this in the 2011 MLS playoffs as visiting Houston Dynamo fans were escorted into Livestrong Sporting Park in Kansas City as a group and seated in a specific section of the stadium. I don't believe the Dynamo fans were ever in any real danger, but kudos to MLS and Sporting KC - they didn't leave it to chance to find out."

Despite the dearth of more consequential events, there is little evidence of security complacency in the U.S. or abroad. Some 13,500 British military personnel will help secure the London Olympic Games, which open in late July, with security rehearsals having begun in earnest in January along a potential terrorism conduit: the River Thames. The NFL armed front-line security personnel with handheld metal detectors and implemented a policy of full pat-downs for each of the estimated 17 million fans attending its games this past season, and individual teams, including the Miami Dolphins, are investing in the latest camera surveillance and text messaging technologies. Operators at MetLife Stadium in East Rutherford, N.J., are already contemplating the security risks posed by the mass-transit railroad that will carry thousands of passengers to and from Super Bowl XLVIII in 2014. In addition to tabletop and field exercises, MetLife Stadium officials have used the NCS4's latest innovation, a stadium computer modeling program designed to assist in facility evacuation preparation. ("Until you model what people might do when a hurricane comes through," Mark Lamping, president of MetLife Stadium Company LLC, told Government Security News in December, "you just don't know what they'll do.") Severe weather forced the suspension of five games during the opening weekend of the college football season last September. Preplanning at the University of Notre Dame allowed the first evacuation of Notre Dame Stadium in its 81-year history to be carried out with nary a hitch, with 30,000 fans who couldn't be accommodated by stadium concourses sheltered in the nearby basketball arena.

Fact is, more Americans died from lightning strikes in an average year between 2001 and 2011 than the total number who died at the hands of Muslim American terrorist plots in the 10-year period following 9/11. Stadium security professionals nationwide would like to control what they can to keep it that way - whether it takes ever-more diligence, or even a little luck. "It's probably somewhere in between diligence and luck," Goss says of the relative quiet on the terrorism front. "Some attacks have been thwarted. Fortunately, many organized terror groups don't have enough resources to spread too thinly, and entertainment venues have obviously put a big foot forward in this regard, which probably deterred a great deal of consideration of them as terror targets."

Cooper agrees that the intelligence gathering goes both ways. "If it's clear that they have little or no chance of getting in, then they're not going to try to hit that event," he says. "And I think we've done a really good job becoming much more aware of threats and putting processes and systems in place to address them. I feel good about where we are in terms of not having had actual incidents."

Still, adds Jubenville, venue operators must remain wary of the risks inherent in letting their guard down. "The status of these venues is what defines a major part of our society, and I think that you're dealing with an enemy that understands that and knows that this is about modern cultural warfare," he says. "The successful facility managers are going to be those who continue to ask the question, 'What if?'"

Paul Steinbach is Senior Editor of Athletic Business.