Homeland Security Hits Home
It’s a beautiful summer day. In the city, noontime streets are jammed with people out to shop or eat. Crowds pack a free music festival. Blocks away, college students struggle to concentrate on the second day of summer classes. The front doors of the central library have just closed behind a group of nursing home residents making their weekly visit when a powerful bomb goes off down the street.
In the confusion, many people on the streets surge toward the site of the blast. Office workers rush to windows or cluster around television sets or radios. In some buildings, lights and computer screens go dark. There is a moment of eerie silence as a familiar background sound — air whooshing through ducts and diffusers — vanishes. Within 15 minutes there are unconfirmed reports the explosion released Sarin, a deadly nerve gas.
How likely is this doomsday scenario? No one knows. But that risk weighed on the minds of many facility executives as the invasion of Iraq loomed and the nation moved to Code Orange alert. In large parts of the country, already tight building security was stepped up to guard against a possible terrorist attack and to assuage the sense of vulnerability among building occupants. At the same time, the lessons of the World Trade Center — where well-prepared evacuation plans saved thousands, perhaps tens of thousands, of lives — led facility executives to immerse themselves in the details of emergency-response plans.
The end of combat doesn’t mean that facility executives are ready to let down their guard. Most agree that, with the ongoing presence of U.S. forces occupying Iraq, facilities face an elevated risk for the foreseeable future.
Tighter security began weeks or months before the first cruise missile was launched. The actions taken weren’t dramatic; facility executives didn’t stock up on gas masks or affix plastic sheets with duct tape to windows. Rather, facilities took a host of small, sometimes temporary steps intended to make it a bit harder to get into facilities, to improve lines of communication and to assure that plans work as expected. Consider these examples:
- The Empire State Building decided to add turnstiles to its access system controlled by proximity cards. The cards are manufactured specifically for the landmark building and can’t be copied. The upgraded system is part of an ongoing re-evaluation of security needs. “We have to look at the whole building as being a safe zone with 10,000 to 15,000 tourists a day coming through in addition to tenants,” says Hani Salama, director of operations.
- In buildings where sensitive research is conducted, Georgia Institute of Technology in Atlanta closed the loading docks, blocked off parking, required all packages to be checked and locked down all but a single entrance to buildings. “When the war started, I didn’t want to take a chance on domestic terrorism,” says Robert Lang, director of research security.
- Seattle’s Fisher Plaza — home to television and radio stations as well as a server farm — added security guards, including armed, off-duty state patrol officers. At the same time, it restricted parking in the underground lot and began inspecting ID badges of all tenants coming into the lot and using mirrors to screen vehicles. “We’re a high-profile media center and we wanted to be sure we took appropriate measures to protect our customers’ interests,” says Chris Holden, director of facilities.
- On its 6,700-acre Beltsville, Md., campus, the U.S. Department of Agriculture went to 24-hour lockdown of security gates installed after Sept. 11 on driveways and private roads; outside vehicles can’t get in unless someone inside the facility opens the gate. Visitors wear passes programmed to expire after a set period of time; in many buildings, no unescorted visitors are allowed. “All that creates a drain on our resources,” says John Van de Vaarst, director of facilities.
- For the Washington, D.C.-area properties it manages, Trammell Crow Co. has updated tenant manuals to include a section on responses to biological, chemical and radiological attacks. And the real estate firm advised tenants about responding to various levels of threat. But the company isn’t mandating actions. “Everything is a recommendation,” says Karen Krackov, senior vice president, property management. Decisions about which actions to take vary by owner and tenant.
Not all facility executives believed that the outbreak of war raised security risks for buildings. Those responsible for facilities in metropolitan areas, especially on the East and West coasts, perceived far greater risk. But even when the war build-up itself didn’t lead to additional security measures, facility executives sometimes boosted security during that period for other reasons — for example, when the nation moved to Code Orange.
In the months following Sept. 11, a rush to review security measures sometimes led to immediate upgrades in the security infrastructure: new cameras or access control systems, for example, or better protection for air intakes. Far more often, the changes involved emergency preparedness plans or security policies. Little things mattered, things like checking badges or being aware of strangers.
Stepped up Efforts
As time passed, however, the sense of urgency about security sometimes declined, facility executives say. The war changed that for many organizations. In some cases, it’s been a matter of doing things that were supposed to have been done all along. But the war led some companies to go beyond steps taken following Sept. 11.
The parking structure underneath Fisher Plaza is a good example. The parking facility was originally designed to be open to the public. After Sept. 11, it was limited to building tenants and registered guests. Now, only tenants are allowed. “It was driven by some of the media companies in the building,” says Holden. “They’re quite willing to give up convenience for security.”
That sentiment is being felt around the country. Dan Moceri, chief executive officer of Convergint Technologies, which designs and installs security systems, walked into a Chicago high-rise shortly after the start of the war. A woman entering the building with Moceri asked the security guard to inspect the contents of her purse because it was the stated policy of that building. The guard waved her on, saying everything was OK. Far from it, at least from the woman’s perspective. She called the guard’s supervisor to the scene and demanded that her purse be checked.
“As consumers of security, we’re much more aware of what to expect when we go places,” Moceri says.
It’s not just corporate properties that are taking a closer look at their vulnerabilities. “People are starting to talk a lot more now about soft targets,” says Robert Cizmadia, director of corporate security services for Gage and Babcock, an engineering firm. Mall and even condo owners are among those taking additional steps.
At many facilities, efforts started after Sept. 11 to improve security and emergency preparedness gained impetus as war approached, and will continue into the future. At Crozer Keystone Health System, which has facilities in suburban Philadelphia, a comprehensive review of air intakes led to the installation of fences and cameras in some locations. And the organization increased the number of portable decontamination units in emergency rooms, then met with local fire departments to talk about using fire hoses to douse people if an incident overwhelms the capacity of the hospital’s decontamination units. With the onset of war, Crozer Keystone identified spaces that can be vacated and put under negative pressure to allow them to be isolated from the rest of the facility.
Crozer Keystone is now looking at how quickly it can lock down a facility. Beyond questions of technology, the health care provider must consider the people who will be affected. “What procedures do you have for letting employees in?” asks Brian Crimmins, vice president, facilities planning and development. “How do you let the press in? How do you let families in? And how do you keep families away from the press?”
The James R. Thompson Center, which serves as the Chicago headquarters for the Illinois state government, recently decided to limit access to government offices. “There’s a large atrium, a food court and many other public spaces at the ground level of the building,” says Bert Cohn of Schirmer Engineering, a fire, code and security consulting firm. “When it was designed, access to government offices was not really restricted; the building provided for a good mix of public and government functions.” But part of the problem, says Cohn, is that there’s little more than countertops separating government offices from public space. One way to improve the center’s security, Cohn says, would be to install aluminum and glass barriers with card readers to provide one level of protection between government and public space. To improve security in the interim, the center has installed newer CCTV systems and placed security officers on every floor.
Steps to improve security can be costly and time-consuming — and sometimes virtually impossible. Suppose the goal is to provide 100 percent outside exhaust for an emergency room. In an existing building, that may require adding a separate exhaust system, says Fred Kolar of Syska Hennessy Group, a consulting engineering firm. Apart from cost, there’s the question of whether space is available for ductwork.
Even before the conflict in Iraq, the University of Miami had the building automation infrastructure in place to cut off the air handling units in its buildings one at time. Preparations for war prompted the school to link all buildings into four zones and create four panic buttons on a central computer. “If we thought it critical to shut down the air systems in the area or all over the campus, we could do it at the push of the button,” says Victor Atherton, vice president of facility administration.
Amid all the emphasis on anticipating and countering threats, facility executives have had to be careful not to play into terrorists’ hands by fanning the fears of employees or visitors.
One side of the equation involves letting employees know that security steps are being taken. Becton Dickinson, for example, has been X-raying large packages for some time. Recently, the company went one step further: It started stamping mail to let employees know it has been X-rayed.
A corporate security manager for a Fortune 100 company in Atlanta says his company hired an armed off-duty police officer to patrol the building’s entrance. Although he makes no pretense that a guard "could halt a terrorist intent on driving a bomb into the building, the officer’s presence made building occupants feel better. “ For us, it was more of an issue of visibility,” he says.
By contrast, some security measures have the potential to raise anxiety among employees, things like tightening access to rooftop air intakes, requiring food-service and other vendors to run background checks on their staff, and stocking up on bottled water. Companies don’t always announce steps like those to employees. “It’s much more up close and personal when it comes to food, air and water,” says one facility executive.
This fine line becomes particularly important in government offices, hospitals, or any other public facilities that have large numbers of visitors.
“We don’t want to appear an armed camp,” says Wade Belcher, an architect for the General Services Administration (GSA). The approximately 8,000 buildings that GSA owns or leases must achieve the balance between being open to the public and maintaining an alert security posture.
“Vigilance is of the utmost importance,” he says. “That can mean everything from improving operational vigilance, such as double-checking even trusted employees, to installing devices like fire-safety systems and anti-ramming barricades to protect a building.”
If the U.S. homeland again becomes a target for terrorists, the men and women who work in buildings could well find themselves on the front lines of the conflict. The way they respond could determine the magnitude of casualties from a terrorist attack.
“Cool heads prevail,” says William Caddick, executive director of the department of physical plant for The Art Institute of Chicago. “You need to make sure employees stay calm and collected. That’s probably my most difficult task.” The crowd at a large public venue like a museum often ranges from school children to senior citizens. For employees who will be expected to help direct people in an emergency, learning exit routes is only the start. Employees must also be well schooled in psychology.
“With senior citizens, you have to be patient and keep them calm,” says Caddick. “With school children, you have to be more forceful but still keep them calm. These are important things.”
Lines of Communication
CarrAmerica Realty Corp. has eight buildings within one block of the White House. “If that place has a hiccup, we feel it,” says Joseph Donovan, senior vice president, facilities management for the real estate investment trust.
On Sept. 11, 2001, Secret Service agents rushed into buildings around the White House and gave occupants five minutes to clear out. “They moved the White House perimeter out one block,” says Donovan. It was up to 48 hours before tenants could get back into the buildings — even to retrieve their cars.
A major reason for the delay was that no one on either side knew much about the other. “Before Sept. 11, there was virtually no communication between us as a private landlord and the authorities in charge of the White House and surrounding federal buildings,” says Rich Greninger, managing director for CarrAmerica. “Opening up communications between the public and private sectors has been a big change.”
One tangible result of that communication: The CarrAmerica tenant database for buildings close to the White House has been tied into the Secret Service database. In an emergency, agents could scan a tenant’s ID card and the tenant would show up on the Secret Service database.
Contacts with federal and local officials have also enabled CarrAmerica to get accurate information quickly to answer tenant questions and dispel rumors.
One of the most important emergency preparedness actions ChevronTexaco in San Ramon, Calif., takes is to host mutual aid events at its facilities. “It’s part of being a good corporate citizen, but it also familiarizes the local emergency personnel with the facility,” says Walt Flannery, who is responsible for real estate operations. The company opens its facilities to local police, fire and emergency medical technicians to participate in mock emergencies.
“Keeping these kinds of lines of communication open with not only local police and fire officials but with your neighbor as well can be critical in any kind of emergency,” says Robert Hascall, senior associate vice president, facilities management for Emory University. The campus is located right next to the Centers for Disease Control in Atlanta. Following the terrorist attacks of Sept. 11, the single traffic corridor from the two facilities became jammed with occupants leaving. To prevent that problem from happening again, Emory worked with CDC to devise an evacuation plan that directs traffic to specific exits.
Open for Business
Heightened security awareness has led top management in some companies to rethink corporate real estate strategies. “Business interruption is a key issue for a lot of companies,” says Art Elman, vice president of corporate real estate and facilities for Automatic Data Processing. “They’re concerned about having too many people in one place.”
The Sept. 11 attacks drove home the point that a disaster might mean a business doesn’t have access to its workforce. That reality prompted some organizations to set up work-from-home options for employees, with dial-up network access and more robust communications systems. “This is the first time I’ve seen a real focus on the personnel side,” says Bruce Ficke, chief executive officer of account management for Jones Lang LaSalle, a national real estate services firm.
Food and Water
The possibility that tenants and employees might be stranded at their facilities for a period of time or hurt as a result of an event has prompted some organizations to provide emergency supplies. All Toyota facilities, for instance, have well-stocked caches of water, food and medical supplies. This is a lesson that Joe Baxter, corporate manager for safety, environment and material distribution for the corporation, learned from Toyota facilities located in earthquake-prone California.
“Thirteen hundred employees nationally received special training in emergency situations and each of them is equipped with a backpack with $400 to $500 of medical supplies to help in an emergency,” he says.
The war in Iraq tested facility executives’ ability to analyze changing circumstances, then plan for what was once unthinkable. Those responses demonstrated that the tightening of security following Sept. 11 was not a one-time effort. Rather, a key element of security planning today is a constant scrutiny of security and emergency preparedness measures. That eyes-open attitude, not the installation of cameras or the updating of policies, may be the most significant change since the attacks on the World Trade Center and the Pentagon. Neither the end of the war in Iraq nor a change in threat code status altered that fundamental reality.
Homeland Security Codes Color Facility Plans
Following the attacks on the World Trade Center, the Sears Tower undertook a sweeping security upgrade. All visitors now enter through metal detectors; purses, briefcases and packages are run through X-ray machines. Optical turnstiles screen everyone going to the elevators. Visitors must sign in at the front desk. Outside, cab stands and street parking have been eliminated; bollards and planters have been installed to increase standoff distance. Before a delivery vehicle enters the loading dock, it is screened by trained dogs and its manifest is checked. Once inside, drivers pass through metal detectors. Boxes go through X-ray machines.
Even with these precautions in place, security was increased in the weeks before the war. But the war itself wasn’t the reason. Like many organizations, the firm that manages the landmark building, Trizec Properties, incorporates the Department of Homeland Security’s threat- code levels — the five green-through-red indicators of the risk of terrorist actions — in security plans. The move to Code Orange was one reason to step up security patrols.
But the Homeland Security codes are only one factor Trizec weighs in evaluating threat levels. “It’s not the deciding factor,” says Carlos Villarreal, director of security. “Our view is that what Homeland Security does is more for law enforcement across the country.”
Since the Homeland Security Department unveiled the color-coded warning system, facility executives have struggled to attach meaning to the various warnings. For example, Code Orange, which is only one step away from the government’s highest warning, means that there is credible intelligence indicating a high risk of a local terrorist attack. But it’s not clear what “local” means.
To help clarify these threat-level warnings, Norm Healy, California Regions security director for Kaiser Permanente, says that he pays attention to federal threat levels in combination with locally available intelligence.
As a member of the Bay Area Terrorism Working Group, Healy relies upon information gathered from that organization to shape his security plan, as well as intelligence from Kaiser’s security vendor and retired law-enforcement officers who now serve as investigators for the hospitals.
“If we go to a Code Red security threat but intelligence says the intended targets are financial institutions, we won’t respond in the same way as if we get intelligence that warns health care targets,” he says. “We’ll respond even differently if our intelligence warns healthcare targets in the Bay Area.”
Warning levels are issued for the entire country and often don’t contain information that would narrow the threat to any particular region. Still, once building occupants hear that the threat level has been elevated, they expect facility and security personnel to respond. That expectation prompted many buildings to have specific measures assigned to different government-warning levels, says Geoff Craighead, vice president of high-rise and real estate services for Pinkerton, a security firm, and president of the professional certification board of ASIS International, the association for security professionals.
When the threat level moves from yellow to orange, for example, some buildings will have engineers review emergency action plans on how to control and shut down a building’s HVAC system. Others will increase the frequency of security patrol around a building’s perimeter areas and in parking structures.
Joe Hegger lets occupants sort out what each level means to them given their geographic location. Hegger, senior vice president and director of operations for the real estate services division of Colliers Turley Martin Tucker, says there are different ways to respond depending upon the local threat a building might face.
“There’s no standard approach,” he says.
The levels don’t mean too much to Hani Salama at the Empire State Building, however. “We’re at high alert and have been since 9-11,” he says. “We stay in constant communication with New York Police Department and the FBI. We have been X-raying packages. We use bomb dogs on delivery trucks and check underneath with mirrors. We use a device that checks and verifies the driver’s license for all delivery trucks. Security has just become a huge part of my job.” Emergency Plans focus on real-world flexibility A quick test for an ineffective emergency-response plan can be summed up in two words: shelf and dust. Those two words capture everything an emergency response plan shouldn’t be, say those examining emergency-response plans in the wake of the war in Iraq.
“We have been forced to examine our own disaster planning and recovery plans, and typically we don’t like what we find,” says David Casavant, a consultant and author of Emergency Preparedness for Facilities.
The stereotypical plan is a 4-inch-thick binder sitting unread on a bookshelf. The new model stresses flexibility and real-world responsiveness to an emergency when the scope and nature of the event can’t be foreseen. The ready-for-anything attitude is a lot like corporate Y2K efforts, says James Eckert, director of corporate real estate and facilities for Owens-Corning. “How do you plan for something that is indeterminate? You put in place a communication plan that enables you to maximize the speed and effectiveness of your response to any emergency.”
Key elements of the Owens-Corning plan reflect the new priorities: top management involvement, close links to local officials, and facility-based teams focused on issues like safety and continuance of business operations.
One sign of the interest in fresh thinking about emergency response is the number of phone calls Robert Lang, director of research security for Georgia Institute of Technology, has fielded since the school developed a flexible emergency plan. One person in each building is responsible for all aspects of emergency readiness in that building. In an emergency, those individuals report to one of five campus zone coordinators whose job is to make sure the plan is working on a building-by-building level. Zone coordinators report to the emergency command center, staffed by a small group of operational personnel from core functions that include the campus police and fire marshal, facilities, research security, and environmental health and safety. At the same time, three key departments — police, facilities and research security — form their own operational centers, ready to act on orders from the emergency command center.
As a crisis unfolds, the command center becomes the brains of the school’s response, issuing directions that are implemented in specific buildings, making sure current, accurate, complete information is reaching zone coordinators, and deploying operating staff as needed.
Being prepared for an emergency means more than knowing how to protect people; it requires an organization to think about how it will continue to do business. CarrAmerica Realty Corp. has gone through three separate exercises in which the staff has vacated its premises, shutting off phones and computers, then bringing them back up off-site. “Some tough conversations have taken place during those exercises,” says Joseph Donovan, senior vice president, facilities management. “But they are necessary to be sure we can keep CarrAmerica running.”
One word is conspicuous by its absence from many discussions about emergency preparedness. “Manual” connotes a dry tome that never gets opened. But a manual has many purposes. One is to serve as a repository of institutional memory.
“Each time something happens, we update our plan,” says John Van de Vaarst, facility director for the U.S. Department of Agriculture’s Beltsville, Md., campus. And over the years, many things have happened in one or another of the 50 major buildings and hundreds of minor structures on the sprawling site, including fire, a tornado and a back-up generator that could not be used when it was needed. “We try to document all of our plans to take some of the stress out of an emergency situation,” Van de Vaarst says.
But updates aren’t the only reason people open the U.S.D.A. manual. It’s used for desktop planning exercises and to train occupant emergency coordinators. “The emergency book doesn’t get dusty,” Van de Vaarst says. “It gets off the shelf quite often.”