Advances in technology and a renewed focus on implementation are bringing about a brave new world in building security
Sept. 11 may not have "changed everything," as was often said in its immediate aftermath, but it did give a big boost to the security industry. Implementation of tighter practices - heightened police presence, more-comprehensive parcel searches - coupled with advances in surveillance, access and communications technology is bringing about something of a Renaissance (or whatever one might call its 21st-century equivalent) in public building security. Virtually every facet of security is undergoing intense scrutiny and, in many locales, receiving needed upgrades. Risk-management firms, software developers, security consultants, access-control companies - as distasteful as it may seem to designate "winners" as a result of national tragedy, these are them.
Security experts - who as a rule speak with a fervor that places them somewhere on the continuum between whistleblower and paranoiac - say the real winners are the public, who will have less to fear as building owners finally get serious about security. Unfortunately, they add, there are still so many holes in the public safety net that a catastrophic incident is not only possible, but likely.
"We're all surprised that an athletic venue has not been a target yet," says Neil Livingstone, CEO of GlobalOptions, a Washington, D.C.-based security firm. "From NASCAR tracks to basketball arenas, we see so many vulnerabilities. We're surprised we haven't seen anything like in Israel, where somebody straps on a bomb belt and walks into the stands and detonates it. At most stadiums, you don't have to walk through a magnetometer. I can show you a half-dozen ways to beat security at a Redskins game, and this is the nation's capital."
"There has not been, yet, any kind of a really bad incident at an entertainment venue," agrees Caroline Hamilton, president of RiskWatch Inc., an Annapolis, Md.-based company specializing in security risk-assessment software. "Like every other industry, it's going to take something bad happening, somebody causing serious damage and loss of life. And it probably won't be a terrorist, it'll end up being a disgruntled employee."
On this score at least, Hamilton isn't just being paranoid - she knows two people who have been shot by disgruntled employees. It is this type of occurrence that can color a person's world view, turn each entering patron into a potential menace. Call it paranoia if you will, but security experts prefer to think of it as extreme care.
Are owners of public facilities operating under a false sense of security. Even in the post-9/11 world, the answer too often is yes. Or, as Livingstone puts it, they realize the problem but continue to see it as something that will happen to someone else. "The dominant view at universities and elsewhere is, 'I'm scared to death that something bad will happen, but I hope it doesn't happen on my watch because I don't want to take money out of my athletic budget to pay for it,' " says Livingstone. "We're an invitation for disaster right now."
Firms such as GlobalOptions typically perform security audits for governmental agencies (although GlobalOptions did partner with RiskWatch on an audit of a number of Washington public facilities, including the MCI Center). Still, the red flags they raise are relevant to operators of anything from densely crowded sports venues to sprawling, less-crowded recreation centers and schools, and demonstrate the efficacy of a simple facility walk-through.
The first facility-oriented issue is, of course, access control. In a multipurpose facility or school, that starts with locks on doors to prevent unauthorized entry to areas large and small. Tom Kommer, senior vice president of Tri-Signal Integration, a security company in Burbank, Calif., says the biggest threat to schools isn't the Trenchcoat Mafia, it's vandals - and the favored target might surprise you.
"The electrical room is the most important room from a security standpoint in a school, a stadium or even a recreational facility," Kommer says. "The electrical room, the press box, sometimes the gym - these are all areas that could house controls for lighting and sound systems, the sound-system rack with all the amplifiers, processors, mixers and microphone inputs, the switch gears for lights, lighting controllers, energy management systems. All they have to do is access one room and they can do hundreds of thousands of dollars' worth of damage."
Control of buildings as a whole has in recent years moved away from keys and toward magnetic-striped cards or keypads. Control of specific spaces, such as the electrical room, press box and gym, increasingly involves vandalism deterrents: security cameras installed in hallways leading to these spaces. In some cases, the cameras are fakes, made to look like the real thing but installed simply as a deterrent. But with the advent of DVRs (digital video recorders), most are working cameras recording around the clock or tripped by motion detectors - and storing hours and hours of video in the facility's computer system. Some clients prefer to contract with an offsite security firm to monitor its live feeds around the clock. Either way, the new technology has made a real difference in the protection of facilities and facility users. "The new equipment is fantastic," says Hamilton. "Color digital cameras is an area where there's been a huge amount of change."
Cameras and DVRs also are used in conjunction with alarmed doors to guard against unauthorized entry through emergency exits in recreation centers, with turnstiles the first line of defense at the front entry. Mechanical-armed turnstiles, a mainstay in stadiums and arenas for many years, have themselves become more technologically advanced, with an increasing number of models outfitted with optical software that automatically reads barcodes on tickets or membership cards.
Other turnstile enhancements, most of which haven't shown up in sports and recreation applications yet, sound like something out of science fiction. Newer models eschew mechanical arms in favor of laser sensors, and emit audible and visual alarms when an unauthorized person attempts to gain entry. Extremely high security turnstiles, called "portals," feature revolving or interlocking doors and can be used in conjunction with a metal detector or outfitted with bulletproof glass. Certain types of turnstiles employ detection software that can tell the difference between one person entering and a situation in which someone attempts to gain entry by "tailgating" on a paying customer. The highest-tech turnstile detection software, used in immigration applications, employs 3-D scanning that provides regular counts of people within a certain radius of the turnstile.
Security specialists say there's a danger in leaning too heavily on technological fixes - many security breaches, they say, are the result of human error, not a dearth or malfunction of equipment. "Often, they have some kind of control in place, but people aren't using it in the way they're supposed to, so it's ineffective," says Hamilton. "The classic example of that is James Davis, the city councilman who was killed last summer in New York City. They had a guard service right there in the city council chambers, they had metal detectors to screen for guns, and what happened. Davis put his arm around his friend's shoulder, escorted him around the metal detector, and the guy - he'd actually hated Davis for years - walked around the corner and shot him. So instead of having him go through the procedure everybody else did, he was able to walk right past the guards. That's a perfect example of controls being in place and not working, because of people."
Davis, as it happens, was a former police officer who was known as a crusader against urban violence. That not only makes the incident doubly ironic, it points out the need for everyone in a public facility to be made aware of proper protocol.
"Security starts with having the staff be security conscious," says Hamilton. "You don't just tell them to be, you have to give them specific training every year. If you hire a security firm, you have to make sure the service you use trains their guards to know what to do and who to call, instead of just having them be there without you knowing if they're good or not."
Ticketing is one segment of the sports industry that has long appreciated the importance of security - if not for altruistic reasons then for financial ones. As color copiers became more advanced, putting counterfeit tickets within easy reach of petty criminals, ticketing firms responded by adding holograms, bar codes and the like to the faces of tickets. The subsequent proliferation of ticket and card readers in sports and recreation facility applications has taken some of the guesswork away from ticket takers and front desk staff, but game-day and building personnel clearly still need to be given detailed instructions on how to deal with possibly invalid forms of entry.
A complicating factor is the expanding need for searches of bags and purses (and people). To keep fans flowing toward their seats, persons setting off automatic alarms or carrying bags requiring a search need to be quickly shunted aside, and an area needs to be designated - and large and well-staffed enough - to deal with them. (Many event managers post-9/11 minimize the hassle simply by prohibiting carry-ins of any kind.)
A related and delicate issue, especially at major sporting events, is whether certain patrons will be given particular attention by security personnel. Or, for that matter, whether building personnel themselves should be above suspicion.
"Maybe if your workers are high school and college kids, you can let it go, but you should be performing minimum background checks on your employees," Hamilton says. "You need to know who's in the facility, and limit access to people you don't know."
Livingstone is willing to go even further. "What kind of background checks are we doing on the hot-dog guy and other people who service us." he asks. "These are not highly paid jobs, often staffed by immigrants, and the fact is that if you hire someone who arrived two years ago from Guatemala or the Middle East, all you know about is those two years."
Livingstone extends the same philosophy to the surveillance of fans. "I know a lot of people don't like it, think it's un-American, but I am a great believer in profiling," he concedes. "Certainly not racial profiling, which doesn't work, but the kind of profiling that targets someone who's behaving in an odd kind of way. Let's say five guys come into a stadium together, and they have tickets for seats in different sections. Now, maybe it's five guys who wanted to sit together but couldn't get tickets together, but it should still be something the staff should be looking for. Profiling has to be administered in an appropriate way, with the utmost respect for the people you are going to be taking a look at, but it's the backbone of the Israeli system, and it does work."
Both Livingstone and Hamilton say their audits often find that even if security personnel are vigilant in ferreting out suspicious behavior, they aren't as clear on what they should do about it. "What happens is, the security guy walks through the venue before the event and looks around to see if he sees any bombs or suspicious people," Hamilton says. "They've got guards posted, they're looking for suspicious people, and that's pretty much it. That's obviously not enough."
What's needed is a response plan in place to foil an attack in the making. "You don't want a lot of fumbling around, 'Who should we call.' kind of reactions," Hamilton says. "You have to appoint specific people who are authorized to call the police, for example. Everybody can't call the police."
You also need to train people to deal with an emergency after the fact. Crisis management in large part currently consists of calling 911 and waiting for help to arrive, but clearly more is necessary. A plan needs to be worked out beforehand, in the manner of fire drills - how to manage the crowd in the aftermath, certainly, but before that, performing a risk assessment on the facility itself. As the world learned soon after the World Trade Center towers fell, some time spent ensuring that first responders' communications systems were compatible might have saved many lives.
"What you're aiming for in trying to manage your security is prevention wherever possible, early detection of problems and rapid response," says Hamilton. "We can't prevent terrorist attacks, really. But we can find out about them earlier, or if something happens, we can respond to them better."
One possible result of heightened security awareness just might be a turning back of the clock in facility design. Newer facilities, with their vaunted openness and transparency, not only make security strategies more difficult to implement, they also have the potential to boost the number of deaths or injuries in the case of a catastrophic attack. Many older public recreation centers, arenas and convention centers resembled concrete bunkers, making them less hazardous in the event of an explosion. As Livingstone notes, 90 percent of the victims of the bombings of American embassies in East Africa were killed or injured by flying glass.
Despite their wariness of technological crutches, security experts also envision wider use of surveillance, and surveillance equipment, in public entertainment venues. However, some of these developments - gun-toting police officers, x-ray machines, radiation detectors, security cameras and facial recognition software that helps pick suspected or convicted felons out of a crowd - trouble civil libertarians, as well as those who simply view sports and recreation as a haven from anxiety.
Even Birgit Spears, director of communications at Cernium Inc. (a developer of behavior-recognition software for the security industry), says she can relate.
"There's a 'Big Brother' aspect to all of this that is not always the best thing to think about, honestly," she says. "At rec centers and movie theaters, you don't want to feel threatened by a lot of security personnel standing around. I grew up in Europe in the 1970s, and in a way you felt safer because you felt like somebody was watching, but in another way you were always on edge because somebody was standing there in front of you with a submachine gun."
Electronic surveillance has eased the need for Uzis, perhaps, but public facility owners are discovering that the philosophical issue isn't the only troubling aspect of its use. Because electronic surveillance requires the active attention of personnel, its effectiveness is not guaranteed. Hamilton recalls a facility audit that found that the person who was supposed to be watching the closed-circuit television (CCTV) monitor "was responsible for doing 20 other things," as she puts it. Adds Spears, "Under normal circumstances, you have to have a certain number of pairs of eyes actually watching television screens to see what's going on. The likelihood of them picking up everything that's going on at every moment is extraordinarily slim. Plus, the likelihood of somebody dozing off while doing it is high." Another drawback is that no one, not even the most paranoid - that is, careful - of security experts, is in favor of installing cameras in privacy-sensitive areas such as locker rooms, which in recreation facilities are magnets for vandalism and theft.
Outside the locker room, motion detectors hooked up to the CCTV system are the typical fix. The device detects a person entering a secure area and trips an audible alarm, presumably spurring the person watching the monitor to take action. Behavior-recognition software takes this a step further. The first application of Cernium's technology was in detecting wrong-way motion in airport exit lanes, the areas where deplaning passengers leave secure zones on their way to the baggage claim. The company's most recent product, though, does much more. Perceptrak ™ is programmable software, meant to be integrated into existing CCTV systems, that detects (and records) up to 14 "erratic" behaviors: a person lurking or loitering, or starting to run; a car speeding up suddenly, or screeching to a halt and backing up. In a lobby or parking garage, the software will detect an object (a box, backpack or suitcase) that has been left behind by someone. (A competitor, ObjectVideo, makes a broader, vehicle-specific product used to track moving objects such as ships entering a harbor.) In the case of locker rooms, the system can be programmed to send text warnings of certain behaviors to monitors rather than live video, allaying (or not) most people's privacy fears.
Proponents of tighter security (like supporters of the USA Patriot Act) say that civil liberties have to be trimmed if public spaces are to be made safer. Will a society that tracks its members in public gathering spaces cause more people to stay home and get their entertainment singly?
Livingstone says that's a concern of many facility operators. "We're going to have to inflict some level of inconvenience on people getting in and out of stadiums," he says. "Stadium owners don't want to do that because they think it'll make people paranoid and keep them home. But one major attack carried out in an NFL stadium or NBA arena, and the next week there won't be anybody at the games. Certainly, people won't take their kids to the games."
Nor will parents sleep soundly when their children go off to school, or to college. Cernium is beginning to make inroads on campuses, placing its behavior-recognition systems in dormitory staircases, hallways, parking garages - and sports and recreation facilities can't be far behind. "Although they hate to admit it, universities have always been kind of traditional and somewhat lax," Spears says. "But security standards have increased so tremendously that these public institutions have no choice but to provide a certain level of protection. Think about the potential liability involved - it is unfathomable the amount of money these institutions are going to have to spend to take care of their security problems."