Home > Articles By Issue > Safety and Security > March 2005

Is It Safe?

From swiping a card to scanning an iris, building security continues to change.

By Amy Milshtein

On January 31, 2005, Boyd A. Owens burst into Oregon's state assembly building brandishing a 10" long butcher's knife. For over an hour, he kept police at bay, threatening suicide and demanding to see the governor. While the incident was resolved peacefully, it brought the state capital's lack of security to the forefront.

"I have been concerned about security in this building for some time," said House Speaker Karen Minnis in a statement. "This incident demonstrates a critical need to review our security procedures."

Yet Oregon may not join the 18 other states with metal detectors stationed at their capital buildings' doors just yet. "I hope we don't overreact," said Representative Mark Hass in an interview with The Oregonian, "because this is a place with a wonderful openness about it."

Such is the facility manager's dilemma. How does a hospital, school, or other public place of business create a secure workplace without feeling like a prison in lockdown? Can management balance the sensitivity of private information with the greater well-being of the corporation? And as technology progresses, will employees consider a fingerprint or iris scan as part of just another day at the office?

Maybe methods like these are overkill. Surely Oregon's January incident (or times when a disgruntled worker or spurned partner "goes postal") is considered rare, albeit sensational, events. Not necessarily.

In 2001, the Bureau of Labor Statistics (BLS) recorded 639 homicides in U.S. workplaces. Although this represents a significant decline from a 1994 high of 1,080 instances, homicide remains a leading cause of fatal occupational injuries.

Workers in the health care industry suffer an even greater risk. In 1999, the BLS estimated 2,637 non-fatal assaults took place on hospital workers, or 8.3 assaults per 10,000 workers. This tracks much higher than the rate of non-fatal assaults for all private sector industries, which are two per 10,000 workers.

Of course, every industry is vulnerable. Higher education claims its own set of challenges. The Jeanne Clery Act of 1990 forced colleges and universities to disclose certain timely and annual information about campus crime and security policies. Criminal offenses reported to and cataloged by the U.S. Department of Education include murder, forcible and non-forcible sex offenses, and robbery. The total number of aggravated assaults for 2002 came in at 7,846.

Even in the face of these statistics, many organizations don't consider security a high priority. "The whole notion of industrial security is a fairly new, post-WWII idea," reports Gene Ferraro, CEO of Business Controls, a Littleton, CO-based corporate investigation and mitigation firm which handles theft, white collar crime, and violence.

He describes an industry slowly driven by former military and law enforcement professionals and even more slowly embraced by corporations and their facility managers alike. "Security is not something people consider until they experience an event or are sued because they didn't foresee an event," Ferraro says.

In some cases, however, the threat is too clear and too evident to ignore. For 18 years, Martha McGee has been the director of facilities and services for Planned Parenthood Federation's national offices, which include sites in New York, NY, Washington, DC, and San Francisco, CA. "When I started, security was a minor issue," she reports. "Since then, the groups that have opposed us have organized and grown more virulent. We have had to respond to protect our employees and guests."

The Technical Revolution

For a long time, security technology was limited to visitor log books. "Guests walk in, sign a book, and put a sticker on their lapels," explains George Kennedy, national sales manager for photo ID at Avery Dennison in Brea, CA. "Sometimes they were met by an escort and sometimes not."

Not only is that system pretty low tech, frankly it's not very secure. "What's to stop someone from writing a different name on that sticker?" Kennedy asks. "Yet, according to our research, 80% of companies still rely on the old log book."

Crude as this method may be, it illustrates the importance of access control, one of the three basic tenets of security according to Bret Bader, vice president, general manager of Edgewood, MD-based Smiths Detection, North America Civil Sector. "You need to know what you are trying to protect, be it people, information, or infrastructure, identify the threats, and finally know what the access points are," he says.

While doorways present the obvious access point into a firm, Planned Parenthood realized, after a mailed in anthrax scare, that people could use other ways to get into the company. As a result, they treat the mail room as an important point of access. "We scan every piece of mail that comes into the office," McGee reveals.

"We also have a separate air handler in the mail room to contain any incident," adds McGee. The handler is an HVAC device designed to keep the air in a contaminated area confined to that area. If such an event occurs, the threatening substance does not travel through the other parts of the air circulation system.

Access control for doorways, however, can be handled simply and effectively. Such is the case of Harborview Medical Center in Seattle, WA. "After 8:00 pm, we operate only one entrance," reports Emmet Stormo, director of the hospital's department of public safety. "We station a metal detector and x-ray machine there and, on average, we uncover three to four firearms a month. Most of the people carrying them have concealed weapons permits, but we ask them to check their guns at the door anyway."

Bob Barry, facility manager for the western division of Chicago, IL-based La Petite Academy, manages 167 pre-schools. With 22,000 kids under his watch, he feels that door security is his first line of defense. "All of our schools have one front door with a coded mechanical lock," he says. "Parents come in with their hands full and need simple access. The coded lock makes entry easy and safe."

Proximity cards provide hands-free entry, and today's chip embedded smart cards allow managers to grant different levels of access as different situations demand. As a result, these cards are showing up across the board, from colleges and hospitals to businesses and government buildings.

"We upgraded to electronic key fobs, and they are working well for us," says Jeff Vrabel, facility manager for the city of Tumwater, WA. Vrabel especially appreciates the card's inherent flexibility. "If a group wants to have a meeting in a city hall venue, we can issue cards for only that room that expire after 24 hours. It's a great balance of security and accessibility."

Cards also help health care institutions comply with HIPAA laws. The Health Insurance Portability & Accountability Act of 1996, HIPAA, protects the confidentiality and security of health data. "Any part of the hospital that holds medical records or billing information is locked down with card readers," says Stormo. "We also use them in the pharmacies where security is tighter."

While security is paramount, smart cards can be used for other applications. Perhaps colleges have taken the cards to the highest level of use. "These cards were originally revenue generators for campuses," explains Mark Peterson, director of itechnology, a design resource group at HID in Irvine, CA. "Telecommunication or credit companies installed the infrastructure for free and issued cards that open doors, take out library books, and buy cafeteria meals along with working as a long distance phone card or credit card."

Corporations may eventually take their cue from colleges and demand more from their cards. "Facility managers can see who is using what services at what time and charge for power accordingly," says Rob Zivney, vice president of marketing for Hirsch Electronics in Santa Ana, CA. "They can also track if a facility is being underused or if the cleaning crew is consuming too much energy."

To read more about integrating individual security measures, see the accompanying story A United Front.

With smart cards' ability to gather and track data, and with computer systems now able to network at unprecedented speed, corporations have a greater responsibility to protect their employees' privacy. "Companies should have methods and procedures in place when it comes to protecting employee privacy," suggests Mike Adragna, physical security manager, Qwest Communications based in Denver, CO. "Limiting people who can see this information is one way to comply. For instance, if a manager is having a problem with an employee and suspects theft, he should have to go through proper channels to investigate, not just look into the files on his own."

How long should companies store all of this digital information? Adragna suggests card transactions, which take up little memory space, should be held for year.

Say Cheese

Surveillance cameras are an expected part of the security picture, and sometimes their mere presence is enough to deter crime. "A few years ago, we had some serious theft problems on the loading docks. Once someone walked off with a whole pallet full of computer monitors," admits Stormo. "Crimes like that have stopped since we've installed cameras."

Technology has upped the ante on video, making today's cameras anything but passive. "People just can't effectively monitor 10 or more video screens," explains Zivney. "Now cameras alert security [personnel] of suspicious behavior, like a propped open door, an unattended briefcase in a lobby, or a vehicle stopped in front of a building for too long."

Along with alerting the security team, cameras can also send the information to an offsite server. This feature is helpful if the breach is an inside job, and people know where video files are logged and how long they are kept. "I recommend keeping all video files locally for 30 to 45 days," says Adragna. "Files of an event, however, should be kept offsite indefinitely."

No matter how advanced, cameras may never be counted as part of the security package for some facility managers. "For every one parent who wants a camera installed, we have 1,000 who don't," explains Barry. "If someone insists, I tell him or her that our schools aren't right for them."

Biometrics--The Next Generation?

If cameras, cards, and codes represent the security of today, are fingerprints, faces, and irises the identifiers of tomorrow? Biometrics, the technology devoted to identifying individuals using biological traits, has moved out of the realm of sci-fi and into reality.

The prospect has some people excited. "I can't wait for biometrics," reports a control manager at a major West Coast-based semiconductor company. "Passwords are lame. You forget them or you give them out to too many people. Biometrics will be really cool."

Fingerprint readers are the most obvious biometric tools. Retinal scans, where a laser beams to the back of the eyeball, have given way to less invasive iris readers. Here, a photograph of the iris, which has an even more distinct pattern than fingerprints, according to Zivney, is used. "Iris scans work if the user has glasses or contacts or is even blind," he says.

While the "gee whiz" factor is undeniable, it may be some time before biometrics are widely used. "I've tested a lot of biometric devices, and I don't think the technology is there yet," says Adragna of systems that are slow and frustrate the user. "A four or five second delay at a door doesn't sound like much, but it will cause a bottleneck. Also, the initial enrollment into the system will be time consuming."

Price also remains an issue. "I'm intrigued by biometrics. People are always loaning out or losing cards, and that would be a great solution," says Vrabel. "But I don't know if a small town like ours will ever be able to afford the technology."
McGee agrees. "I would rather the company spend the money on programming than security technology like this," she says. "But I'm not ruling it out."

As the technology develops, biometrics promise an additional layer of security. "I think an ideal security solution would include a proximity smart card, a PIN code, and biometrics coupled with video cameras stationed at access points," says Adragna.

Old School

Along with all the high-tech gizmos, some common sense, old school components continue to play into the security picture. Screening employees before hiring makes sense to Adragna. "I recommend a criminal background check and drug test as a basic requirement for employees and regular contractors," he says. "I also recommend that visitors who are not in the security system be escorted into and out of the building."

La Petite's Barry also puts importance on screening workers. "I've fired one third of my vendors because they left beer cans and cigarette butts on the school sites," he says.

If petty theft of personal items is a big security concern, as is the case with Stormo, good, old fashioned locks and keys may provide relief. "There will always be a place for mechanical locks," says Bill Walsh, national sales manager, CCL Security Products of Wheeling, IL. "The more expensive technology is usually used around the perimeter of the spaces, but locking desks and file cabinets is part of the security equation as well." Walsh also points to historic buildings with original doors where electronic locks would not fit into the design.
Guards put a human face on security and often represent the first line of defense. "Our New York office occupies the building's top floors and has its own elevator bank," explains McGee. "It is our lobby based security guards who do our initial screening. They need to be capable, qualified, and cordial."

"The guarding piece is as important as any other," agrees Adragna. "I think we should move to a more Continental model concerning guards. In Europe, companies hold security guards in higher regard, train them to troubleshoot, and even pay them well."

Word From The Top

Even the best security system remains only as good as the employees who use it-or the corporate policies that enforce it. For instance, everyone would agree that keeping a photo ID badge visible at all times puts safety to the front of everyone's mind, but "I've heard reports from managers that they just can't get some employees to wear their badges," says Peterson.

Mike Gunderson, manager of corporate communication, and Steve Morgan, office facility manager, both for The Schwann Food Company based in Marshall, MN, agree. "We've tried in the past to encourage people to wear their access badges, either around their neck or on their belts," they say. "Most people just keep them in their wallets."

Even at Planned Parenthood, where visitors are issued a photo ID badge, this is a challenge. "Our hardest battle was getting senior management to wear their badges all the time," says McGee. "It has to be part of the culture, and it has to come from the top down."

Companies must also have a clear protocol for reporting lost or stolen badges. "Many times employees wait to report a missing card," says Zivney. "Perhaps that's because their company policy punishes workers by charging for new cards."

While Zivney feels that the cost of a new card is negligible, not everyone agrees. "We were seeing a lot of chronic card losers, and we wanted people to protect them like they would their car keys," reports McGee. "Now we offer one grace card. After that, employees have to pay out of pocket for replacements."

Predicting The Unpredictable

Despite the best intentions, history demonstrates that a determined person can breach security, often with fatal results. "Taking away a terminated employee's access card may only anger him or her further," says Ferraro. "The best access control won't protect your receptionist from gunfire."

Of course, not every disgruntled employee is a risk; however, Ferraro feels that most aggressors share common characteristics and behaviors. "There is a progression that leads to violence," he says. "Declining performance coupled with increasing inappropriate behavior is a classic symptom."

Custody battles represent another potentially volatile situation. "Individual directors and district managers have to be aware of custody cases going on in their schools and make sure the children are leaving with the right parent," says Barry. "Often, a parent will show up with a police escort to take the child home."
Ferraro recommends management recognize the dangers and put protocol in place to deal with an employee who might be spinning out of control. "I think there is quite a bit of institutional denial out there," he says. "Some sophisticated employers are starting to get it though."

Both cases illustrate the importance of the entire corporation's investment into the culture of security. "We want our employees to take personal responsibility," says McGee. "We remind them everyday that security is everybody's business."

As facility managers work to create a secure environment, incorporating tools that address the specific vulnerabilities of their organization brings them one step closer to success.

Milshtein is a freelance writer based in Portland, OR.

Have you implemented new security measures to address your facility's specific needs? Share your experience by sending an e-mail to avazquez@groupc.com.