OPINION: Isn't It About Time Security Gets Its Own Crowd Mitigation Laws?

If I were the seriously academic type, I'm quite certain there would be a white paper I could write on how many lives the fire service saves by having cities empowering the fire marshal to enforce fire codes. Seriously, when you sit back and examine the impact fire codes have had in either showing how dangerous crowds can be and how mitigating their growth in dense packs reduces casualties in fire events, it's truly amazing at how well they work in both regards. If people die in a crowded nightclub because of a fire, no one writes a think-piece on what drove the fire or the firestarter. No one even contemplates if we need stricter anti-fire laws. Nope. Within a few seconds of reading there was a fire at a crowded nightclub, we automatically deduce a large amount of the carnage was because the club was too densely packed. What if after every active shooter incident we did the same?

Imagine a set of laws structured around mitigating mass casualties during active shooter events in target-rich environments. At the heart of how we effectively deal with these incidents is how we deal with the crowds. You've heard me say this before but I believe the largest contributor to target selection and engagement is the crowd. With security, there's a misguided public perception businesses will act in the best interests of life safety and business owners and operators will take threat mitigation seriously. For those of us in security, we know this is a daily battle - one in which we suffer countless deaths for. In a world where businesses are rewarded by showcasing demand and not minimizing their risk caused by demand, motivation to encourage, grow, and develop further crowds often outweighs those associated risks. What we require is a set of codes which the authorities can enforce to make those risks unacceptable without effective mitigation.

What would my proposed "codes" look like? As is said in the military, it's all METT-TC or "situation-dependent". That said, here's a very rough idea of what I envision:

• Utilize the same formula and science, the fire service uses in determining acceptable crowd sizes in densely packed areas. This encompasses looking at egress points, potential points of origin, probable incident path, time to egress, and potential secondary hazards.
• Make it mandatory businesses have a minimum number of egress points solely for active shooters. The egress points should be fully expansive and allow for fluidity in crowd movement. There should be more than one way out of an area.
• Ensure employees have a means of ensuring those egress points remain available and unencumbered.
• Fire exits can be utilized for egress but should not be the sole means. Fire and security/LE will likely have different concerns about crowds and their movements.
• Egress should be marked and illuminated. Egress from fire emergency exits should also be alarmed and enunciate at a fire and police dispatch center.
• Every venue where crowds are a consideration and are likely targets of active shooters should have "blue boxes" which would contain a button like fire call boxes. These boxes would sound an immediate alarm with a "tactical response required" notification to the local police.
• Schools and daycare centers should rehearse mandatory crowd mitigation drills. School event planners should attend a mandatory crowd mitigation course which addresses basic event security guidelines to be implemented. Failure to follow the guidelines should be considered violations of the law. Exceptions can be addressed by through an SRO and approved by a department chief.
• All on-duty security personnel should attend a mandatory course on behavior detection and tactical response. Failure to pass the initial and follow-up training should result in a mandatory suspension of their security license. Posting unlicensed and untrained personnel should be considered a violation of law.
• Stadiums and large scale event security should be required to do annual mass casualty event drills. Active shooters should be addressed in those scenarios.
• Businesses must have a crowd mitigation plan filed with their local police department.
• No-notice inspections by the police should be done semi-annually. Inspection failures should be considered for a mandatory 30-day operations suspension, depending on the nature of violation. Serious violations should constitute permanent operations termination.

I know. I know. Too harsh? Perhaps, but I think this is the shot in the butt we all need as practitioners and business owners. These events happen in places we're supposed to be protecting. Yet, everyone pretends like they won't see these incidents, despite evidence which says we don't have a clue as to when, where, or even how they could occur. What I'm asking for takes minimal effort and is ever-evolving as the threat also changes. That's what makes it such a great idea, to be quite honest.

Why Murder-By-Semi-Truck Could Be A Thing You Need To Mitigate

I'm not an alarmist. Or at least, I try not to be. Personally, I prefer a rather "Vulcan" approach to many things in security. As the youngsters say, "Logic rules everything around me." Actually, that may not be the "exact" wording but you get the drift. That said, I do have a fair amount of "Holy sh*t!" moments. While reading Rumiyah #3 (An English-language e-magazine for ISIL) and coming up on their murder-by-semi-truck tutorial, I tried to suppress having such a moment. I succeeded, mostly because I realize the tutorial was somewhat incomplete from a tactical perspective. That's not to say the message isn't effective or wouldn't possibly motivate ISIL members to strike. I see its inclusion as both for propaganda and potential triggering for an upcoming attack.

Oh, you read that whole "murder-by-semi-truck" bit correctly. Here's what they actually said - "Though being an essential part of modern life, very few actually comprehend the deadly and destructive capability of the motor vehicle and its capacity of reaping large numbers of casualties if used in a premeditated manner. This was superbly demonstrated in the attack launched by the brother Mohamed Lahouaiej-Bouhlel who, while traveling at the speed of approximately 90 kilometers per hour, plowed his 19-ton load-bearing truck into crowds celebrating Bastille Day in Nice, France, harvesting through his attack the slaughter of 86 Crusader citizens and injuring 434 more."

There's a lot we, as security professionals, can glean from this. Have no worries, I won't be divulging "state secrets" or imparting tactical clues. There are merely my observations. Take them for what they're worth, as your mileage could very well vary.

1. Large vehicles are vogue for jihadis still. In fact, one of the key criteria they attribute for an "ideal vehicle is a "load-bearing truck". Even though, speed and "controllability" are also highly desirable, they suggest operators steer clear of SUV's and small cars. Obviously, they're looking for something that can handle a lot of weight.
2. The Nice attack is seen as successful. Notice the vehicle should have "double-wheels" because it gives "victims less of a chance to escape being crushed by the vehicle's tires". Also, I noticed the inclusion of having a secondary weapon as a means of ensuring additional casualties and "increasing terror". Pretty telling.
3. Crowd mitigation is really freaking important, stupid. Look, folks. I know I harp on this a lot. I get it. I do. But they pretty much say it - "In general, one should consider any outdoor attraction that draws large crowds." Notice the bit about crowds.
   

   

   Image include in Rumiyah #3. Notice the large crowd. Just saying.

4. Attribution is really freaking important, stupid. The last few ISIL-related attacks (either by the group or attributed by them) have included language using the phrase "soldier of the Islamic State". Almost every attack committed by a Western-based attacker who hasn't gone to Syria, ISIL has claimed responsibility using this phrase. So no surprise here when you see it in Rumiyah #3 - "I am a soldier of the Islamic Sate!" Why do they do this? To sum it up - they're a holy anointed apocalyptic cult whose proximity to Allah can only determined by their ability to seemingly kill at will. If that's not clear enough, they do it for street cred. You gotta have bodies to make it in the terror game, folks.
5. Large crowd size does not always equate to certain specific targets. Located in the fine print was this gem - "All so-called “civilian” (and low-security) parades and gatherings are fair game and more devastating to Crusader nations." If you're a security professional who has to mitigate threats to a parade route but you're not in New York, you may assume you're in the clear. Yeah, you're dead wrong about that. It's about the casualty count. If your parade route could have a large number of people along it with limited egress points and insecure access control to the street, you could be in the same boat, if not worse than New York. As I always say - it's not a matter of IF but WHEN. Mark my words. Be vigilant.
6. It's not just about parades, stupid. What other "targets" are they looking at? Glad you asked. ISIL says "Outdoor markets, festivals, parades, political rallies (We got any of these coming up soon? Asking for a friend.), large outdoor conventions and celebrations (Got any tree-lighting ceremonies?), and pedestrian-congested streets (High/Main streets)" are all legit targets. Yep. Here comes your "Oh sh*t" moment. Stop it. Relax. Now, go mitigate.
7. Fail to take this kind of attack seriously, at your peril. Let me put it bluntly. Nope, let me just leave what they said here - "The method of such an attack is that a vehicle is plunged at a high speed into a large congregation of kuffar, smashing their bodies with the vehicle’s strong outer frame, while advancing forward – crushing their heads, torsos, and limbs under the vehicle’s wheels and chassis – and leaving behind a trail of carnage."

Vehicle Assaults in Terrorist Attacks
Create bar charts