On Oct. 1, 2017, at 9:15 PM, country singer Jason Aldean took the stage as the closing act at the three-day Route 91 Harvest Music Festival at the Las Vegas Village. Across the street approximately 490 yards away, a gunman on the 32nd floor of the Mandalay Bay Hotel was preparing to open fire on the 22,000 people attending the concert. Jesus Campos, a Mandalay Bay security officer who was responding to a door-held-open alarm, heard drilling from the attacker’s room and investigated. The gunman fired over 200 rounds through the hotel room door and wall and struck Campos in the leg. Campos and a co-worker were able to radio the Mandalay dispatchers who immediately alerted the police.
At 10:05 PM, the attacker used a hammer to smash out two windows in his hotel room; he then proceeded to fire over 1,100 rounds into the crowd. Ten minutes later, the police arrived on the 32nd floor, and the attacker committed suicide. More than 450 people were injured and 58 were killed.
Risk is defined as a factor of probability, vulnerability, consequence, and velocity. Although the probability or likelihood of a deliberate attack may be perceived as low, it can happen anywhere. Soft targets are called “soft” because they are extremely vulnerable. And obviously the consequences of a deliberate attack are extreme, with the intent being to cause multiple injuries and fatalities. The velocity of a deliberate attack is also extreme. In the Las Vegas shooting, more than 500 people were killed or injured in just 10 minutes.
Soft targets at high risk
Given the high to extreme risk of deliberate attack, it is prudent for organizations that present as soft targets to plan for deliberate attacks that are intended to kill as many people as possible. Some organizations at particularly high risk are event venues, mass transit systems, malls, hotels, and organizers of events where large crowds will gather. These soft targets are vulnerable because they are open to the public, do not screen visitors or employees, and attract large crowds of people.
There is some good news: Deliberate attacks are relatively easy to plan for and there are some very effective and low-cost countermeasures that can be put in place to prevent and respond to these types of attacks. Here are 10 things that organizations can do to prepare for the unthinkable:
1. Conduct an all-hazards risk assessment. All organizations should evaluate the risk that they face. Beyond deliberate attack, other natural and human-borne risks should be assessed. Free information regarding risk assessments can be found at www.ready.gov/risk-assessment.
2. Prepare an all-hazards emergency response plan. Every organization should also have an all-hazards emergency response plan. The plan should include general instructions on how the organization will respond to emergencies. Appendices should contain detailed instructions on response to high-risk incidents, including deliberate attack. These plans would include instructions for immediately alerting authorities, evacuating facilities, sheltering in place, providing keys and access cards to responders, and communicating with employees and customers during the emergency. Free information regarding emergency response plans can be found at www.ready.gov/business/implementation/emergency. Emergency response plans should be tested and updated regularly. Tabletop exercises, drills, training, and full-scale exercises are excellent methods for improving an organization’s response to specific incidents.
3. Engage with local emergency responders. It is always a good idea to include local police, fire, and EMS in the planning process. Most agencies are willing to come to your facilities and participate in meetings, site tours, tabletop exercises, and drills. Establishing good relationships and having first responders familiar with your personnel, facilities, and plans prior to an incident is critical to effective response. You don’t want your security and emergency response personnel exchanging business cards for the first time at the scene of an incident.
4. Have law enforcement personnel present at large gatherings. Law enforcement officers are well-trained at responding to active shooter and deliberate attack incidents. They immediately form up into small teams and move to the shooter with the intent of neutralizing the threat. All departments are trained alike so members from different agencies can quickly coordinate to effectively engage attackers.
5. Provide training on recognition of suspicious activity. In many cases, those contemplating a deliberate attack will conduct surveillance of a site prior to an attack. Conducting effective surveillance is difficult, and an untrained individual can be easily detected by alert and well-trained employees and staff members. Suspicious behavior could include studying security elements such as video camera locations and security staff processes, attempting to gain access to private areas, taking videos or pictures of large crowds, and displaying signs of nervousness when observed. Employees can also be trained to recognize signs of an impending attack.
In the case of the Las Vegas shooting, the attacker visited other hotels in Chicago and in Boston near Fenway Park. He also stayed at the Mandalay Bay hotel for several nights prior to the attack and had 23 weapons in his room, including several assault rifles. Trained staff, including the housekeeping staff, may have been capable of detecting signs of a possible attack. This training is simple, intuitive, and inexpensive to conduct.
For example, front desk staff can be trained to look for suspicious packages being brought to the hotel or guests asking for specific rooms or any behavior that might seem odd or troubling. Housekeepers typically know the profile of the person staying in a room by the contents of the room. Families, couples, business travelers, tourists, and others have unique and identifiable items in their rooms. Deliberate attackers may have items in their rooms that could cause concern for housekeepers, including weapons, plans, drawings, clothes, and equipment that could be used to plan or conduct an attack.
6. Train employees on how to respond to deliberate attacks. Active shooter response training for employees and staff is very effective and readily available. The national standard for response is to run, hide, or fight. The safest course of action is to run away from the attacker. If running is not an option because the shooter is in the vicinity, the second-best course of action is to hide or take shelter in a safe area. The last course of action is to fight. Fighting should be considered as a “last stand” tactic and individuals should fight for their lives. When attacking a shooter, it is best to attack in a group using blunt objects to strike the shooter with the intent of getting him or her to the ground and then immobilizing the attacker.
Additional resources regarding active shooter response, including a training video, can be found at Department of Homeland Security's website.
7. Screen attendees at events. Screening at events can seem intrusive and disruptive, but it is the new reality for eventgoers. Screening personnel can be hired, and equipment — which might include portable metal detectors and hand-held screening wands for secondary searches and bag searches — can be rented. Proper screening procedures should be developed and screening personnel should be trained and properly supervised. Public venues can conduct random screening or screen during peak times.
8. Strategically place vehicle barriers at vehicle access points. Recent vehicle attacks have occurred in France and in New York. The attack in France on Bastille Day in 2016 left 86 people dead and more than 450 injured. Event planners should definitely consider working with local law enforcement and traffic departments to strategically place barriers at intersections and access points leading to large crowds of people. Barriers could include portable jersey barriers, large vehicles, or more advanced vehicle-stopping devices that may already be owned by large cities.
9. Prepare evacuation and shelter-in-place plans for large events. Event-specific evacuation and shelter-in-place plans should be prepared for large events. Emergency exits should be identified and cleared of any obstruction. Staff should be trained to assist those evacuating, including those who may need assistance, such as individuals in wheelchairs. Shelter-in-place plans should include identification of safe havens and some guidance on how to lock or barricade doors. Practicing and rehearsing the plans should be included in the preparedness process.
10. Have communications plans in place to provide instructions during incidents. Deliberate attacks happen without notice and are typically over within minutes. Having a well-thought-out communications plan in place prior to an incident occurring is essential and can save lives. The plan should include pre-scripted messages, rehearsed language used by staff members during evacuations, and methods for delivering response instructions rapidly to those in danger. Communications methods could include digital signage, text messaging, public address systems, loud speakers and/or bull horns.
10 Steps To Fortify Against Attacks on Soft Targets
