OPINION: Isn't It About Time Security Gets Its Own Crowd Mitigation Laws?

If I were the seriously academic type, I'm quite certain there would be a white paper I could write on how many lives the fire service saves by having cities empowering the fire marshal to enforce fire codes. Seriously, when you sit back and examine the impact fire codes have had in either showing how dangerous crowds can be and how mitigating their growth in dense packs reduces casualties in fire events, it's truly amazing at how well they work in both regards. If people die in a crowded nightclub because of a fire, no one writes a think-piece on what drove the fire or the firestarter. No one even contemplates if we need stricter anti-fire laws. Nope. Within a few seconds of reading there was a fire at a crowded nightclub, we automatically deduce a large amount of the carnage was because the club was too densely packed. What if after every active shooter incident we did the same?

Imagine a set of laws structured around mitigating mass casualties during active shooter events in target-rich environments. At the heart of how we effectively deal with these incidents is how we deal with the crowds. You've heard me say this before but I believe the largest contributor to target selection and engagement is the crowd. With security, there's a misguided public perception businesses will act in the best interests of life safety and business owners and operators will take threat mitigation seriously. For those of us in security, we know this is a daily battle - one in which we suffer countless deaths for. In a world where businesses are rewarded by showcasing demand and not minimizing their risk caused by demand, motivation to encourage, grow, and develop further crowds often outweighs those associated risks. What we require is a set of codes which the authorities can enforce to make those risks unacceptable without effective mitigation.

What would my proposed "codes" look like? As is said in the military, it's all METT-TC or "situation-dependent". That said, here's a very rough idea of what I envision:

• Utilize the same formula and science, the fire service uses in determining acceptable crowd sizes in densely packed areas. This encompasses looking at egress points, potential points of origin, probable incident path, time to egress, and potential secondary hazards.
• Make it mandatory businesses have a minimum number of egress points solely for active shooters. The egress points should be fully expansive and allow for fluidity in crowd movement. There should be more than one way out of an area.
• Ensure employees have a means of ensuring those egress points remain available and unencumbered.
• Fire exits can be utilized for egress but should not be the sole means. Fire and security/LE will likely have different concerns about crowds and their movements.
• Egress should be marked and illuminated. Egress from fire emergency exits should also be alarmed and enunciate at a fire and police dispatch center.
• Every venue where crowds are a consideration and are likely targets of active shooters should have "blue boxes" which would contain a button like fire call boxes. These boxes would sound an immediate alarm with a "tactical response required" notification to the local police.
• Schools and daycare centers should rehearse mandatory crowd mitigation drills. School event planners should attend a mandatory crowd mitigation course which addresses basic event security guidelines to be implemented. Failure to follow the guidelines should be considered violations of the law. Exceptions can be addressed by through an SRO and approved by a department chief.
• All on-duty security personnel should attend a mandatory course on behavior detection and tactical response. Failure to pass the initial and follow-up training should result in a mandatory suspension of their security license. Posting unlicensed and untrained personnel should be considered a violation of law.
• Stadiums and large scale event security should be required to do annual mass casualty event drills. Active shooters should be addressed in those scenarios.
• Businesses must have a crowd mitigation plan filed with their local police department.
• No-notice inspections by the police should be done semi-annually. Inspection failures should be considered for a mandatory 30-day operations suspension, depending on the nature of violation. Serious violations should constitute permanent operations termination.

I know. I know. Too harsh? Perhaps, but I think this is the shot in the butt we all need as practitioners and business owners. These events happen in places we're supposed to be protecting. Yet, everyone pretends like they won't see these incidents, despite evidence which says we don't have a clue as to when, where, or even how they could occur. What I'm asking for takes minimal effort and is ever-evolving as the threat also changes. That's what makes it such a great idea, to be quite honest.

Kenya Mall Shooting - Why It Went All Wrong & What We Can Do To Be Better

Yesterday, the New York City Police Department released a report from its SHIELD initiative about the Kenya mall shooting/terrorist attack. It was a pretty damning report to say the least. Before we talk about the report, let's talk about SHIELD is and why that's important to understand in the context of this report. SHIELD is the NYPD's homegrown information-sharing component with private sector security. It provides analysis on current and future threats. I've previously read some of SHIELD's reports. Some were good and some were typical of fusion center reports - some meat and some potatoes but not a full meal. This report was driven, in part, to go over what NYPD and private security could learn about what happened in Nairobi. There was plenty.

There were some startling revelations:

1. Kenyan police were VASTLY outgunned. The report states, "The typical Uniformed Kenyan Police Officer is not as well equipped as their western counterparts, typically only carrying a long gun, most commonly an AK-47 style rifle with a folding stock, loaded with a single 30 round magazine. They do not carry handguns, wear body armor, gun belts or have portable radios to communicate." Each of the terrorist were carrying 250 rounds of 7.62 mm ammunition. Lack of body armor and radios to communicate resulted in fratricide. More on that later.
2. Responding plainclothes officers were also outgunned and had no visible identification. Remember what I said about fratricide? From the report: "Very few of any of the plainclothes law enforcement first responders displayed any visible law enforcement identification such as a badge, arm band, ID card or  a raid jacket, making identification as “friend or foe” extremely difficult for other armed first responders."
3. Realizing the police were outgunned, Kenya made the incident response a military matter. That's as bad as it sounds. The report says, "Kenyan government officials decide to transfer the handling of this incident from the police to the military. A squad of Kenya Defense Forces KDF soldiers enters the mall and shortly afterwards, in a case of mistaken identity, the troops fired on the GSU-RC Tactical Team.They kill one police officer and wounding the tactical team commander. In the ensuing confusion both the police and military personnel pull out of the mall to tend to the casualties and re-group."
4. Responding military forces used an RPG-7 as a room clearing tool. I kid you not. And the destruction was insane. "It is reported that at some point during the day the Kenya Defense Forces decided to fire a high explosive anti-tank rocket (possibly a RPG-7 or an 84mm Recoilless Rifle) as part of their operation to neutralize the terrorists in the Nakumatt Super Market.The end result of this operation was a large fire and the partial collapse of the rear rooftop parking lot and two floors within the Nakumatt Super Market into the basement parking."
5. It is possible the terrorists escaped in part because the Kenyan security forces failed to secure a perimeter. It is rather elementary for the very first thing Western police do in these scenarios is to lock down the perimeter. No one comes in or out unless they can be positively identified as a "friendly". This credentialing occurs by checking IDs and only first admitting law enforcement and first responders to exit upon verification.
6. The mall employed unarmed officers who performed unsatisfactory "wand searches". This is irritating to say the least. Why? Unarmed officers are appropriate for certain environments and are the way to go in most environments. However, in high value targets, such as mass gathering locations in places like Kenya, I would have used an armed component. Armed officers are not only armed but can be equipped with radios and are usually uniformed. This makes identifying them for law enforcement somewhat easier. Also, armed officers can do things unarmed officers can't due to safety concerns such as locking down perimeters and evacuating victims.
7. Wand searches are weak. I dislike them with a passion. Why? Officers get tricked into believing a search was "good" because the wand didn't annunciate. This is all kinds of bad. A search should be thorough in high value targets. If you're going to employ officers and have them search, have them be thorough and do it without a wand. I would use the wand only in environments where I had other search mitigators in place such as backscatters or X-ray search devices.

So what does this attack teach us in the West?

1. The desire of terrorist groups to attack mass gathering locations is still very alive.
2. Places like malls should consider Kenya to be a warning. If you're in mall security, I highly suggest going over your active shooter plan and rehearsing it on a fairly regular basis with local police departments and simulated shooters. In these exercise, test not just your ability to minimize casualties but to also test your security apparatus under stress. This is best accomplished by "killing" responders, taking hostages, attempting escape, and causing confusion among responders. Get your people used to chaos in these scenarios.
3. Never do wand searches at high value targets and test your people regularly. I've gone over why I think wand searches are bad. So let's examine why you should test and train your searchers regularly. Searching is one of the most important yet often neglected security components. We usually pick rookies and the "lowest common denominator" to do this function because it's "easy". Doing good and thorough searches that you can go to sleep easy with at night are not easy. Searchers should be trained on subject "tells", physical characteristics of forbidden items by touch, sound, smell, and sight, the tools they can use to do searches better, etc. They should also be regularly "red-teamed" which is to say you should have a non-attributable person walk through security and see what they can get through. When they're done, they should report to management their findings.
   
   Here's a video I did on how I would search bags:
   
   
4. CCTV and analytics are EXTREMELY important to an active shooter scenario. There are several takeaways from what we learned about CCTV and the lack of analytics in Nairobi. First, CCTV coverage was spotty in some areas. Also, the CCTV coverage was easily identified and avoided by the terrorists. We also know while they had remote viewing capability, it was five miles away and more than likely not cross-fed into the police. While a CCTV monitor can't identify every threat, video analytics can alert them to suspicious activity. At the very least, consider it an option.
5. Garages and parking lots should be regularly patrolled. While there was a guard posted at the entrance of the garage, had a response element been closer by, they could have locked the exterior doors to the mall.
6. Train your employees on how to sound the alarm and IMMEDIATELY lock down their storefronts and secure customers. I would consider including them as a part of your active shooter training as well. Make that mandatory training for all storefront management and their trusted employees. I would include it in a leasing agreement if I had to.
7. Have a HIGHLY accessible public address system to sound the alarm.
8. Train local non-law enforcement responders on the need to "shoot, move, and communicate". Seriously, I can't stress this enough. There is a huge debate in the US surrounding concealed carry permit holders as responders. I'm okay with them responding, though I prefer they receive some training on  the need to identify themselves to law enforcement prior to responding via a phone call if time and circumstance permit.
9. Equip every security person and law enforcement officer with a radio.  If you want to avoid wasting your time clearing rooms that have already been cleared or fratricide, then you HAVE TO equip your responders with radios and share your frequencies with them.
10. Train your personnel on reporting formats like SALUTE. We've covered this before so I won't bore you with the details.
11. Train your security management personnel on casualty collection points, IED mitigation, cordons, perimeter searches, and periodic vulnerability assessments. These things can't be overstated in training. Trust me. You'll thank me for this later.

Visualizing Mass Shootings in America (1982 - 2012)

Click on the map to enlarge

Here's what I like about this infographic. It not only let's you see data by location but also by mental illness, weapons legally acquired, venue, weapon type, race, gender, and year. Be sure to click on the map to enlarge it so you can see the graph.

Take a look at the actual data:

https://docs.google.com/spreadsheet/pub?key=0AtIWtgxch7DtdERIVnowSkx4NGRjN3E4UjdWMHNRY3c&output=html

INSTRUCTIONAL VIDEO: How to Conduct Effective Bag Searches

I've decided to finally post the video I made on how to properly conduct a bag search.  I wanted to do a video to highlight some areas I feel are commonly neglected during these kinds of searches.  Most seasoned professionals won't neccessarily need to watch this video but I do believe it provides a great overview of some of the basics.  This all came about from a search I was subjected to during a recent visit to an amusement park.

Here are some of the pics I promised during the presentation on which illustrate how much insight a proper light and probe can provide.

View of the "concealed carry" partition...The bag comes with a
"universal" holster.

View of a small exterior zipper.  Using the probe to push down
on the anterior nylon aids in revealing more.

View of what I affectionately called "a big gaping hole".  This
is the largest interior portion of the bag.  I have packed
cameras, wallets, books, diapers, etc. ALL in here before.

Here's another link  to the article that started it all:

http://blog.thesecuritydialogue.org/2011/09/nominee-for-worst-bag-check-is.html

Good, but no cigar....

Today, I went to my favorite amusement park and was given a slightly better search this time around.  However, I'm sad to report it was still very cursory in nature and the searcher again missed the biggest pocket.  The most disheartening experience was after the search was completed.  During his initial search, he opened the large pocket in the middle, frisked the rear (smart move because it is slightly padded), and actually reached inside the bag.  Besides missing the pocket in the rear, I had no issues with this search.  Then, it happened.  As I was walking away, he asked to search the bag again.  Could it be because he could sense my displeasure with him missing the large rear pocket or was it the message I sent the park via Twitter regarding the previous search with a photo of the bag?  Who knows.  I was very delighted to see him search again.  I figured this was going to be their chance at redemption.  Nope.  Missed the pocket completely.  Have no fear, Lone Bag Searcher Dude.  I will be posting a how-to video on how to properly conduct a bag search while being extremely thorough and expedient.  I know it sounds improbable but trust me.....

The nominee for worst bag check is....

If you're like me, you can't help but to check out the security wherever you go.  Perhaps, another person wouldn't have noticed or cared about a recent encounter I had during a visit to an amusement park.  I won't name any names but let's just say I was "less-than-impressed" by what I saw as an egregious breach in standard security searching protocol.

While entering the park, every visitor is subjected to a bag search.  The searcher in this instance was very consumed by a conversation he was having with another patron.  As a matter of fact, he never took his eyes off that patron while he frisked my bag.  He placed a small wooden rod commonly used to probe bags for contents behind my bag while he frisked it.  In my professional career, I have never seen such a cursory search of a bag.

The bag in question...Notice the large pocket towards the rear...

Here are the problems I noted with the search:

1. He never looked at the bag he was searching.  Hopefully, had he seen the bag, he would have "clued on" the bag has multiple pockets with a large one in the rear.  This particular bag is a Maxpedition Versapack Fatboy.  It was designed to carry a small amount gear during the day and to look as "civilian" as possible.  The most important pocket for any searcher of this bag is the rear pocket because it holds an internal holster for a small handgun for concealed carry (I wasn't packing this day).  The searcher completely missed this pocket.
2. He never looked inside the bag.  The major interior pocket has enough room for a digital camera, an iPod, a camcorder, two or three grenades...You get the picture.  Had he looked in the bag, he would have noted his stick wouldn't have told him much.
3. He was so engrossed in conversation he never noticed any visual cues such as the look on my face when began frisking my bag.  As you can imagine, it was not a happy look.  Most professional security searchers will tell you the search and the level of searching you conduct on an individual item often depends on visual cues you get from a subject.  Nervous glances, jittery hands, profuse sweating, shifty eye movement, etc. are all what we in law enforcement call a "clue".
4. There was a failure to acknowledge me and start a small but necessary conversation.  These "conversations" provide a searcher his first clues what your intentions are.  This is customary to an entry control situation and you almost expect it whether it be at Customs or with TSA.  The gate guard at the ballpark even does it.

I understand and can appreciate why parks conduct such cursory searches.  It frees up the lines, gives the perception they're being aggressive about security, and it gives them an opportunity to detect potential profit-stealing items such as "outside" commercial beverages and alcohol.   I get it and support it wholeheartedly - when it's done correctly.

I have several issues with this, though.  It lulls security and park personnel (management) into believing there is an additional layer of security which in effect never existed because the search isn't geared towards a security threat.  It also fails to address the likelihood of an attack on park property and guests.  A slightly more thorough search could detect such threats.  Finally, cursory searches for contraband only allows your searchers to focus on one thing only - line congestion.  What happens if you a miss gun and there is an attack?  You gave an impression you had security and yet you failed to detect a gun and admitted the attacker in the park.  Two words depict the place you find yourself in: LITIGATION HELL!!!

So what are my recommendations?

1. Post the items you consider contraband (please include guns, knives, grenades, etc.) and showcase "found" items in a display case.  This puts potential disruptive guests on notice that you will be looking for those items and escorting them off the park should you find them.  There maybe some resistance and you may detect your fair share of "bad" stuff so have a local deputy there just in case.  This is also a great psychological deterrent.
2. Get rid of the probe.  You're not finding anything using this method.  Just because you jab a rod in my bag once or twice doesn't mean the bag is "good-to-go".  Open the bag and see what you're probing.  
3. Conduct random full searches of bags.  This puts the "bad guys" on notice you're taking security seriously.  This works great against terrorists as they can never tell if they're going to the random number.  It also allows you to clear up lines and avoids charges of profiling.  The military has phenomenal success with this method.
4. Address training and quality control AS SOON AS POSSIBLE!!!  Training has to be conducted semi-annually on searching techniques and behavioral cues.  A great source to reach out to for this is Homeland Security.  Often times, they can provide the training without significant costs. Plus, it looks impressive to management and your investors (the real bosses).

I didn't want to name the park because I know this is a systemic problem with other mass gathering locations throughout America.  We often engage in "security theater" and assume our methods are keeping "bad" people away.  It isn't until our guys miss one bag and allow someone in who shouldn't have gotten through that we realize our methodologies are flawed.  If you're in the business of protecting these parks, please ensure your park never wins the award for "Worst Preventable Tragedy In The History of Amusement Parks".  Your guests, the public, security personnel, management, and investors are counting on you to never miss anything.