Best Practices to Secure Venues in a Dangerous World

Global Security Experts Weigh In

 

It seems like tragic news is hitting us in wave after wave these days, with barely time to process one horrific event before the next one happens. The recent May Buffalo store shooting was followed too closely by the Robb Elementary massacre.  Our world is getting more dangerous and bad people intent on doing harm are more prolific than ever.  

Security experts around the world acknowledge that when these tragedies are dissected (after the fact), there is a complicated series of events and a trail of crumbs that lead up to these individuals doing the unthinkable. These same global experts will also tell you that actionable protocols and security best practices exist for organizations of any size, from schools, to malls, to concert halls, to the local pub. These senseless tragedies can be stopped.

How to Create Venue Security in an Unsecure World  

Protecting the people in your venue is far more complex than it used to be. Today, a venue’s security is at the mercy of any number of dynamic variables such as an active shooter, smash and grab theft, an employee recently fired who returns with a gun, or a riot happening on the street outside, to name a few.

Evolv consulted with two global security experts to get their best practice recommendations for organizations to help them better anticipate, prevent, even de-escalate threats in progress.

Our global experts include:   

Mark Sullivan 

Mark Sullivan, founder of Mark Sullivan Consulting in St. Petersburg, Florida, and Washington D.C., has a long and distinguished career in global security and security solutions, consulting with some of the most innovative private sector security companies in the world. His experience includes a role as principal at Global Security & Innovative Strategies, and 35 years of service as a Special Agent with the U.S. Secret Service, including a presidential appointment as Director of the Secret Service from 2006 to 2013 leading high impact initiatives in protective operations, protective intelligence, and criminal investigations. He currently sits on eight Boards of Director and Security Advisory Boards, and is a sought-after global security expert and advisor.  

David Cohen 

David Cohen is one of the world’s leading authorities on intelligence analysis and operations, with expertise developed over a 35-year career with the Central Intelligence Agency (CIA), including as Director of CIA’s Clandestine Service and before that managing all CIA analysis for the US National Security community. He then served 12 years as NYPD Deputy Commissioner for Intelligence; a position established in the wake of the 9/11 attacks. He revolutionized how the NYPD collected, analyzed, and leveraged intelligence and established a global NYPD presence to protect New York City from another terrorist attack. Now President of Columbia Consultants, a risk assessment firm, he is on the Business Executives for National Security Advisory Board.

A Proportionate, Effective Threat Mitigation Approach Requires a Four-Step Plan

“The environment we’re living in today demands anticipation and preparation.”  – David Cohen

Those responsible for their venue security simply want to know they stand ready to effectively mitigate and deal with both external and internal threats—of every kind. Our experts agree: Organizations that use an enterprise-wide, four-step approach are in a better position to protect people and their physical venue.   

Here is a snapshot of those steps and what it means to take an enterprise-wide approach. We also offer step-specific insights from our experts. 

  • Assess  
  • Plan
  • Communicate
  • Train

 Step 1: Assess

This foundational first step requires you to build a threat-level matrix that includes probability and impact for both external and internal threats. Once complete, it becomes your customized threat mitigation guide. Use it to more confidently plan for and secure funding for any additional security resources you might need.      

“As a venue owner, I would want a security expert advising my staff as to what they think the greatest threats are and how they recommend we mitigate the risks from those threats. Do they advise I hire more security guards, update security plans, invest in additional forward-leaning technology, or improve training? Regardless of the recommendations, they will more than likely come at a cost. For many venues, there will always be the balance between justifying the operational costs with the value added. A way to justify that cost is by having an enterprise-wide solutions approach that increases our capabilities to protect us against our biggest threats. And finally, it’s important that every investment is made not because it is deemed a nice-to-have, but because it’s a need-to-have.” – Mark Sullivan 

  • Insight 1. Building a threat-level matrix helps you assess your threats, vulnerabilities, resulting risks, and how to best mitigate them.  If the end goal is prevention, all possible threats must be factored into a threat matrix.
  • Insight 2. Just the process of assessing threats, and ranking them from highest to lowest, is valuable because it forces venue owners and security experts to think through the range of issues they may have to deal with, including both internal and external threats. Your insurance company may require some form of physical threat, vulnerability, and risk assessment—but this is not enough. Because the world is more dangerous, small to very large venues are wise to build a matrix that addresses everything from a customer fall down your escalator to an active shooter in your lobby.  
  • Insight 3. Because threats are variable and dynamic, any matrix you build will be unique to your venue, —and its location—on any given day. As a result, consider it a living, 360-degree plan, a daily assessment of your current state of threats. A day with protests nearby presents a different threat level than a quiet day during the middle of the week.

Below are key elements to form the top of your threat level matrix. For each threat you identify, both internal and external, create enough detail and context for each to help you prioritize solution urgency and needed resources.

  • Threat type
  • Threat probability (high/medium/low)
  • People and property impact
  • Mitigation approach
  • Needed resources

Step 2: Plan 

This step is all about creating updated plans, policies, and procedures around your newly prioritized matrix of probable threats. Key to the success of any plan you implement is how well you cultivate and sustain solid relationships with security, law enforcement, and area businesses—and how you tap available intelligence to stay on top of dynamic threat variables.   

“Just like humans instinctively use situational awareness when they are out and about to keep themselves and their families safe from harm, organizations must learn how to proactively use situation awareness to help mitigate threats to their employees, students, customers, and property.” – David Cohen 

  • Insight 1. Once you garner approval for an enterprise threat mitigation plan, it’s critical to establish or re-establish a broad and deep relationship with local law enforcement and private security personnel. Make sure they know who you are and where you are located. Cultivate relationships and share vital safety information. Spend time with these contacts to develop trusted relationships and build a strong communications network for those times you need each other most.   
  • Insight 2. Sizeable venues should have some security anchor point, a location inside that can serve as an operation center housing resources like video, phones connected to local law enforcement, and a place for any hired security personnel to go in case of emergency or for shift breaks. 
  • Insight 3. Depending on your venue location and size, your level of situational awareness increases to the degree you create a plan for monitoring social media, the dark web, local news alerts, and other available communications intelligence that might tip you off to an impending threat. Once you create access to the best intelligence, make sure this marries up with your threat mitigation emergency plan. This helps you create a 24/7 plan that keeps you current and responsive whether you are closed or open.

Step 3. Communicate

“The best plan is meaningless if no one knows what is in it. It needs to be communicated often, and in detail, including building it into performance plans if necessary. There can be no room for doubt about the order of operations or chain of command when lives hang in the balance.” Mark Sullivan

  • Insight l. A plan is ultimately only as good as how well you engage the entire team that is responsible for implementing the plan. Critical is that they all understand their role in the plan and appreciate its importance for the safety and security of employees, students, customers, clients and visitors. For large venues and small, the repetition and reinforcement of this message starts at the top.
  • Insight 2. Even in large event venues, effective communication can be a challenge as a hefty security construct can often involve numerous moving parts that may or may not see themselves as an integrated whole. It falls heavily to leadership—via good communications skills—to ensure that the left and right hands not only know their own role in assuring venue security, but how they connect to each other. In brief, on security, the whole is greater than the sum of the parts.

Step 4. Train

“The ability to deescalate an internal threat situation is valuable training for every single one of your employees.” – David Cohen

  • Insight 1. It is important for management to take the initiative to train all employees at onboarding and on an annual basis—on the plans, policies, and procedures around threat identification and mitigation including threat de-escalation training. Teach them how to watch for dramatic or unusual behavior and act on it. Help them confidently own their role to speak up and make sure they have immediate access to the tools and technology they need to reach management and law enforcement in the face of an escalated threat. Depending on the size of your organization, training can be a ½ day seminar, or a series of workshops that spans weeks or months.
  • Insight 2. After hours, train all employees on the evacuation plan specific to your venue and their roles in moving people to and through locations in the venue, depending on the threat. Plan where you will all meet and the communication protocols for interacting with customers, security, and law enforcement in an active threat situation. 
  • Insight 3. Within legal bounds, it’s become increasingly important for organizations to know who is working for them. Use legal and available employee vetting and law enforcement services to do thorough background checks. One bad apple that somehow fell through the cracks can inflict far too much physical, property, and even reputational damage to your business. Be sure, if you let someone go, that you always conduct an exit interview to gauge potential rage or threat-based reactions. Teach your personnel how to manage and report any individuals they feel may try to cause harm.   

Conclusion

My most recent blog covered how the tragic bombing of the Manchester Arena in 2017 took 22 innocent lives, and how 650,000 venues throughout the U.K. may now be required to adopt security mitigation protocols as a result. This U.K legislation was driven by many, including Figan Murray, the mom of 22-year-old Martyn Hett who died in that bombing.

Mark Sullivan and David Cohen have identified a series of four steps that organizations can take to thoughtfully and proactively increase protection for the innocent lives within their walls. The spike of gun violence is a multifactorial issue; everyone agrees on this. What’s required now is a stake in the ground commitment of people coming together to make real change happen to protect their people and places.    

Commemorating National Gun Violence Awareness Day and Remembering our Mission

Today, as we commemorate National Gun Violence Awareness Day, our communities are reeling from a series of tragic events – Buffalo, Uvalde, and now, Tulsa, among the many others. These tragedies serve as a reminder of how imperative it is to find solutions that will prevent future lives lost to gun violence.  Please join us in supporting and representing National Gun Violence Awareness.  

Ten years ago, teenager Hadiya Pendleton was shot and killed on a playground in Chicago.  Soon after this tragedy, Hadiya’s childhood friends decided to commemorate her life by wearing orange, the color hunters wear in the woods to protect themselves and others.  Since Hadiya’s 18th birthday, June 2, 2015, “Wear Orange” has expanded to period of three days, starting the first Friday of every June, known as National Gun Violence Awareness Day and weekend. 

This year’s events include silent survivor walks, marches, blood drives, community building projects and mural painting, highway cleanups, art exhibitions, and charity runs. At Evolv, many of us will participate in these types of events and we wear orange today to support this important awareness day.  We believe that safety should be a basic human right.  We come to work each day with a deep sense of purpose to make the places where we work, learn, and play safer – with a focus this month on schools.  

When our children are at risk in an environment where they should only focus on learning and fun, it is unthinkable. The threat of violence in schools is personal for all of us here at Evolv.  My daughter is a second-grade teacher and has been now for over eight years. Each tragic headline about an attack on a school sends my mind racing with “what if” scenarios that never fully fade. This issue haunts me as a dad, as a human, and as the CEO of a company focused on keeping weapons out of all the places where they do not belong. 

Every school has policies prohibiting weapons on campus, but the ability to enforce those policies can be incredibly limited. Schools that can afford to install conventional walk-through metal detectors risk creating a prison-like environment that makes students feel like criminals and induces fear and anxiety and creates long lines and chaos each morning.   

And, worse yet, we’ve heard stories that when the morning bell is about to ring and the security line is backed up out the door, some will just turn the metal detectors off and wave all the students in without any screening at all.  Sadly, this is not uncommon. 

Vulnerable students, teachers, and staff deserve more. 

This is why we formed GiveEvolv, our charitable organization that helps keep schools safe through need-based donations of weapons detection systems. The available resources to address the threat to schools are heartbreakingly scarce. Weapons detection will not solve the problem of school shootings, but as part of a layered strategy that involves people, process and technology, it can help keep schools safer, reduce threats and increase peace of mind so our teachers and students can focus on education.  

Please visit our GiveEvolv website today and nominate a school you feel should receive a grant from us. Our mission is to make the places where we work, learn, and play safe, and keeping students safe in schools is paramount.

How A Mom’s Campaign for Better Venue Security May Impact 650,000 UK Businesses This Year 

Martyn’s Law Defined

Two years ago, at a national security conference in the UK, I sought out a presentation by Figen Murray. Figen is the mom of Martyn Hett, one of 22 victims killed in the horrific 2017 Manchester Arena bombing. Her loss is unimaginable. She remains a mom to four kids and has not stopped fighting for the kind of change that creates good out of the evil that happened that day.

I knew a little about Figen’s story and Martyn’s Law, the legislation in her son’s name. She and Nick Aldworth, a former UK counter terrorism government official, stepped us through how the breakdown in arena security and emergency response that day inspired them to pursue new venue security legislation called Protect Duty, or Martyn’s Law.

Figen’s tenacity to turn her grief into action remains a powerful witness and unparalleled display of human spirit. She inspired me that day and still does. In fact, just five years since losing her 29-year-old son, Figen received her master’s degree in terrorism and counterterrorism (CT) from the University of Central Lancashire last year.

In 2013, as many of you know, my wife narrowly escaped the bombing at the finish line of the Boston marathon, and I lost good friends in the Towers on 9/11. For me, those two pivotal events inspired the launch of Evolv. Figen and I share a similar heartfelt and focused mission to do the work we do.

What is Martyn’s Law and when does it go into effect?

In the simplest terms, Martyn’s Law is legislation that aims to create a coherent and proportionate approach to protective security. The proportionate part is very important because not all sites and venues are the same, so a blanket approach would be counterproductive. In 2017, at the time of the attack, there was no legislative requirement for UK organizations or venues to consider security measures at the vast majority of public places.

On January 11, 2022, on the heels of an 18-week consultation, Home Secretary Priti Patel officially agreed to bring forward legislation to the UK parliament requiring venues to put in place security measures to protect the public from terror attacks. Full details are expected to be laid out in a written ministerial statement, at the earliest possibility. The Home Office is also helping to develop a new interactive online platform, which is due to launch this year, aimed at providing advice for organizations on counterterrorism.

Who does Martyn’s Law apply to?

The proposed legislation is designed to apply to any place or space the public has access to—an estimated 650,000 diverse sites and venues across the UK, from small cafes and pubs to large arenas.

What is covered in Martyn’s Law and what does this mean for businesses in 2022?

The Law includes five key requirements for any publicly accessible location:

  • A requirement that spaces and places to which the public have access engage with freely available counterterrorism (CT) advice and training.
  • A requirement for those places to conduct vulnerability assessments of their operating places and spaces.
  • A requirement for those places to have a mitigation plan for the risks created by the vulnerabilities.
  • A requirement for those places to have a counter-terrorism plan.
  • A requirement for local authorities to plan for the threat of terrorism.

Advice from a UK counter-terrorism expert

It is understandable that businesses in the UK are wondering what the next best steps are and how to prepare for this legislation to go into effect. I asked Nick Aldworth to share his insights at this stage. Nick’s 36-year career included positions in policing and the military. He then became Detective Chief Superintendent in Counter Terrorism Policing where he held the role of National Coordinator (Protect and Prepare). Nick led the operational protective security responses to the London 2017 terrorist attacks and, prior to that, was the Chief Inspector of policing and security operations at the UK Parliament.

There are 650,000 businesses in the UK that may need to take some kind of action this year to map to Martyn’s Law. If the security measures they take are meant to be “proportionate”, what are these businesses expected to do and how quickly are they expected to do it?

Answer: Usually when novel-issue legislation is passed in the UK, the government will provide public awareness campaigns for some considerable time before they start to enforce the law. I expect that will happen in this case as businesses will understandably have to adapt to a new normal. Importantly, the idea of legal proportionality will only be defined over time, as cases are heard in court and precedents are set. However, as your readers will know, there are a range of options in any security solution. At the top end, there are solutions like the Evolv system, that provide effective screening in high-footfall situations. In less intense environments, the proportionate approach might include manual searching, or simply observant staff looking for suspicious behavior.

Where can businesses go to get relevant and current information about how they can implement Martyn’s law?

Answer: The UK is blessed with a government that provides authoritative information about how to reduce risk. The Centre for Protection of National Infrastructure, a government body, maintains a catalogue of tested and approved technical systems for businesses that want to follow the technical path. The police’s National CT Security Office provides advice on a range of issues from how to protect crowded places to how citizens can apply emergency first aid in terrorist situations. In the next few weeks, all this information will be brought into a single place, under the banner of Protect UK. This will be a digital platform that not only provides all the guidance in one place, but it also allows for the creation of credible communities that can exchange information.

If businesses want to start proactively responding in a phased approach to Martyn’s Law, how would a small pub, medium sized museum, and large event venue (for example) do this? What might be the priority measures for each?

Answer: For me, it’s always about getting your people engaged with counter terrorism first. When people are observant and engaged, they can disrupt a possible hostile incident or reduce the impact of an attack. In the UK, we run a program called See, Check and Notify (SCaN) that aims to help people understand how every employee can contribute to keeping their environments safe, while enhancing customer service. After people, it’s all about understanding your vulnerabilities and having a plan to deal with problems when they arise.

In your conversations with venue operators, how do you talk about the value to them? How does implementing better venue security and being in compliance with Martyn’s Law benefit them and their business?

Answer: This is a great question. Notwithstanding the imminent legal imperative (that already exists within public-liability laws), we talk about the moral imperative. We especially talk about the changing nature of terrorism that has led to anything being used as a weapon, against anybody, and anywhere. We discuss how the only way to combat such a potential proliferation of terrorism is by a whole-of-society approach. The last thing I always remind businesses is that good security is good CT security and both are good for business. At times of anxiety, customers want to feel safe and secure. They will stay in your venues longer and spend more money if they feel comfortable.

Why is Martyn’s Law, and the eventual compliance measures adopted by businesses, a good thing for the general public?

Answer: None of us want to live behind gates and walls; and we all want to enjoy our lives to the full. Proportionate security actually helps keep our societies free.

Conclusion

It is powerful how loss and tragedy can drive such remarkable and inspiring change for good. Figen is a hero for choosing the road less traveled. She has taken her grief and channeled it into action that will save lives in the UK.

Nick Aldworth has it right; none of us want to live behind walls and gates. We want to live freely and move freely. When the UK more formally adopts Martyn’s Law, these new security measures will make this possible, honoring Martyn Hett and the 21 others lost that day.

Improving Gameday Experience from Street to Seat

I recently had the pleasure of participating in a webinar that Evolv co-hosted with the Sports Business Journal.  These “lunch-and-learn” webinars have proven quite popular because they provide useful industry information in just an hour while attendees eat a sandwich (or perhaps a bagel, depending on time zone) at their desk.

In this case, the content was indeed valuable.  Two of Evolv’s pro sports clients, Mercedes-Benz Stadium (Atlanta Falcons and Atlanta United) and Nissan Stadium (Tennessee Titans), shared perspectives on how our Evolv Express®‘ guest screening system has improved the gameday experience for fans and stadium employees alike.

I also wanted to go beyond the recording and share two additional insights from the session.

Guest Experience Is Key

The webinar was attended by people from all the major sports and many other fan-driven organizations.  We asked them whether, in their personal experience, team performance or guest experience was a bigger driver of repeat attendance.  Fully 75% of respondents answered guest experience.  This is certainly consistent with my own nearly two decades in pro basketball and hockey. 

I also view this strong consensus as very empowering for the people behind the scenes who make our industry work.  We may never put on a uniform, but we can still move the needle in terms of making fans have fun and want to come back.  Because the converse is true – a poor guest experience is a major driver of fans choosing not to return – we’re also under pressure to deliver.  Just like athletes, we need to always bring our A-game.  Thankfully, technology is increasingly giving us an assist.  That’s literally true with Evolv Express, where Artificial Intelligence instantly and invisibly performs many of the functions that make traditional ingress screening so slow and uncomfortable.  And, by getting fans into our venues faster and more smoothly, it also gives them more time to enjoy all the other amenities our venues offer.

Guest Entry Is a Multi-Part Process

Several webinar participants asked questions about the impact of Evolv’s exponentially faster screening speed – up to ten times quicker than legacy systems – on ticket scanning.  They wanted to know whether Evolv Express simply moved the location of, rather than eliminated, ingress queues.  This is a great question from experienced operators.  The short answer is that if no other operations change, it is indeed likely that there will be increased queueing at ticket scanners, which operate at lower throughput.  But, it’s also quite easy to make operational adjustments to avoid this outcome.  One simple approach is to add more ticket scanners.  With all the physical space and personnel freed up by Express, there will certainly be the resources to do so, and handheld ticket scanners are inexpensive.  Another approach is to move the location of entry screening, to create more space between screening and ticket scanning.  This is easy to do with Express, which is portable and weather resistant.  Longer-term, we are actively working on partnerships between our system and ticketing systems so that the current multi-part process can be further streamlined and consolidated.

One of the very few positives for our industry to come out of the COVID-19 pandemic has been the rise of webinars.  In-person conferences are still the best way to connect and learn, but webinars add a lot to the mix.  Thanks to all who participated in ours.  We’ll continue to use this format to share information and show how Evolv clients are transforming the guest experience at their venues.

Feel free to watch the full webinar recording below.

 

Why it’s time for a new standard in security screening

In the security world, what has become common is not what is best for every situation. So many of the measures in place at venues right now exist in response to what happened years ago in different settings. 

Threats have changed, and technology has improved. There’s no reason to keep a solution in place just because it was the only option decades ago.  

The Old Standards are Outdated 

In 1972 – in response to a series of plane hijackings – the government put rules in place that all plane passengers should be screened. For those screenings, technology was used that had been developed for maximum security prisons and certain sensitive military facilities: walk-through metal detectors and x-ray machines. 

These tools, which worked well for places like prisons, have stayed the same even though situations have changed, and technologies have advanced in ways that better reflect the times we live in. Metal detectors, for example, are very good at detecting metal. But now, so many of us carry non-threatening personal items that contain metal, like cell phones, eyeglasses and umbrellas, that we’re forced to completely empty our pockets before we pass through traditional metal detectors. 

We Need to Protect Targets of Least Resistance 

Over time, the threats have shifted as well. Instead of hard targets like government buildings or forward-operating bases, terrorists have focused on soft targets like nightclubs and stadiums. In the United States, there has been a steady stream of active shooter events at these types of settings. 

The response has usually been to add more metal detectors, which, because of the bottleneck created by the slow process of emptying pockets or false alarms, tend to create other soft targets (people waiting in line) outside of a venue. 

These venues tend to be places that are not protected by government mandates in the way that airports are – places like schools, emergency rooms, performing arts centers and office buildings. For attackers, these are targets of least resistance. When plotting the kind of high probability, high consequence event that we all fear, attackers will seek out a place where they can do the most damage with the least resistance (such as having to pass through a metal detector). 

Setting the New Standard 

Current mainstream security standards don’t do enough to protect soft targets. Evolv recognizes the desperate need for standards to reflect today’s threats and exists to address the question: How do we create a seamless experience that enables security professionals to create a safe environment? To answer that question, we should consider the following: 

What are the real threats of concern? 

Security personnel are not looking for tiny pieces of metal in your pocket. They’re looking for weapons. We have technology that can identify exactly what items we should be concerned about in a security screening so that every item doesn’t trigger an alarm – only items of concern. 

What personal items do people carry most often? 

There are items that people carry in their pockets or purses every day that pose no threat, but still set off metal detectors. Evolv’s ability to identify those – phones, keys, ear buds – cuts down on false alarms and allows people to get where they need to be more quickly. 

Who’s going to be running the system? 

You need to make sure the technology is right for the security team running the system. For someone who might be monitoring the system for an eight-hour shift, it needs to be simple. Nuisance alarms – the kind of alarms that are set off by the everyday metal objects mentioned above – can become exhausting for an individual who has to screen someone for something that isn’t a real threat. That can affect the detection of actual threats. The system should be easy to use and quickly identify actual threats. 

How well does the system work with existing security measures? 

We want a seamless entry where there’s no bottleneck…but we also know that our customers need to be able to integrate our systems with existing security measures, such as surveillance cameras. This allows for quick and comprehensive threat detection and notification, enabling security personnel to take immediate action.  

We need to constantly challenge our assumptions of what real threats are, and think differently about the world we’re living in when it comes to threat assessment. We need to employ the appropriate technology to prevent the kind of high probability, high consequence events that can result at a target of least resistance. Evolv exists to help you avoid being one of those targets, and we are setting a new standard when it comes to keeping people safe. 

Achieving SAFETY Act Designation and Setting a New Standard

It is a significant milestone that the Evolv Express® product has received DHS SAFETY Act Designation®. We have been working with the Department of Homeland Security for quite some time on this. Independent validations like SAFETY Act designation and our strong showing in the recent NCS4 Operational Exercise are important milestones for Evolv Express as a truly disruptive technology to transform the ingress. 

Having Safety Act designation can provide vendors like Evolv, and our customers, with important legal liability protections that encourage investment to prevent terrorist attacks. While these protections are important, accomplishing the mission of keeping people safe while also protecting the visitor experience requires more.  Achieving SAFETY Act Designation is viewed by many as a de facto standard for physical security technology.   

Visitors have never been more aware of their ability to choose virtual alternatives to in-person experiences. To fill their facilities and venues, enlightened operators will need to reach for a higher standard of security and visitor experience. There are some specific principles that are important in a new standard. 

Zero-Wait Should Be Standard

Although no one likes being stuck in a line, few people realize just how vulnerable they are standing in a line outside the security perimeter. That crowd is a soft target that is vulnerable. Eliminating the line outside the security perimeter is ideal.  However, many of today’s technologies (designed decades ago), require people to wait and go through one at a time.  Zero wait time means people need to walk through at the pace of life without stopping, removing items or breaking their stride.  Achieving zero-wait requires fast, accurate weapons detection and rapid alarm resolution. Zero-wait should be standard

Data-Driven Decision-Making Should Be Standard

Most modern organizations are accustomed to using analytics to drive decisions in key areas of their business, but this revolution has been slow to reach physical security. There is a tremendous amount of data associated with the ingress of people, their arrival curves at different entrances, and the speed of ingress.  Analytics should provide better data for pre-event planning, and improved post event analysis.  This includes how many staff members to assign at different locations, the impact of changing threat sensitivities for different operational scenarios, and other factors that affect the visitor’s experience.  This is only possible on a digital native platform, but current standards are silent on the topic of data analytics. Data-driven decision-making should be standard.

Machine Learning Should Be Standard

Modern machine learning is pervasive in cybersecurity but curiously absent in traditional security screening technology and standards. The ability to train multivariate statistical models with real-world data allows for more accurate, nuanced weapons-detection decisions to be made in real-time. These algorithms require sensors that provide a rich data set from which important characteristics can be gleaned.  And the more data is gathered, the better the models get over time. Old school metal detector signal processing will never be able to keep up with modern machine learning. Machine learning should be standard.

Image-Aided Alarm Resolution Should Be Standard

As the number of visitors passing through a system increases, and the amount of training and tenure of security guards gets lower, there is an increased chance of human error.  Technology can be a key enabler to reduce human error by having the technology do the monotonous tasks and have people focus on the critical judgments to assess a threat / no threat scenario.  Adding an image of an individual to help ensure they are assessing the right individual and a directive interface to show where to focus provides significantly more guidance for a security professional.  Image-aided alarms can help avoid invasive full-body pat down searches and dramatically shrink the alarm resolution window. That’s an obvious win for everyone, but it isn’t addressed in any existing security screening standard. Image-aided alarm resolution should be standard.  

Digital Integration Into the Security Infrastructure Should Be Standard

Keeping people safe requires a thoughtful combination of advanced technology solutions produced by many different vendors. Unfortunately, most security screening solutions function as isolated analog silos that don’t share or receive data from other systems. It shouldn’t be that way. The screening system should function as an intelligent node in a fully networked nervous system that supports the right response at the right time. That requires a digital-native platform with robust integration APIs and a network of partnerships between vendors. Sadly, this kind of integration currently falls outside most existing security screening technologies. Digital integration should be standard

Conclusion

 I’d like to reiterate that we are very happy that Express has received SAFETY ACT designation. We value what the DHS is offering through the SAFETY Act process and look forward to ongoing collaboration. However, in the present environment we believe that SAFETY Act designation is table stakes. Our mission demands that we aim to not only keep people safe, but also deliver an outstanding visitor experience. This standard requires digital-native technology that makes the most of modern analytics, machine learning, image-aided alarm resolution, and digital integration. We believe that Express embodies this new standard today, and we’re hard at work to raise the bar even higher in the future.

Transparency in Physical Security: Q&A with John Pistole and Mike Ellenbogen

The need to provide transparency without helping potential attackers is a fundamental paradox of the security industry. In their long and distinguished careers, former TSA Administrator John Pistole and Evolv founder Mike Ellenbogen have spent decades thinking about these issues and successfully finding the right balance.  That’s why we consulted with John, Mike, and other advisors to develop the Evolv Transparency Statement. The following Q&A is excerpted from recent conversations with John and Mike to provide additional insight into how we approach transparency. 

How has transparency featured in your career? 

John Pistole 

In 31 years in the government, mainly in the FBI and as the TSA Administrator, I found that transparency is one of those key issues that help define the trust and reputation of agencies, of the U.S. government overall, and of companies that provide security technologies. Each company or agency must be as transparent as possible while maintaining the core mission of keeping the public safe. 

 Mike Ellenbogen 

I grew up in aviation security technology where there is a very well-recognized and understood policy around transparency. In essence, at least regarding public release of technical details, there is no transparency. The specifications are classified by the TSA in the US and the ECAC in the EU. That specific information is called sensitive security information, and it’s very closely-held for what I believe are all the right reasons. 

The systems are tested by security professionals who have a legitimate need to know and hold the appropriate security clearances. These are independent professionals with a great deal of experience and resources to test in ways that most people cannot. These professionals have great credibility in the industry, so certification from a group like TSA is universally recognized as an indicator that the technology is fit for purpose.  

In aviation the people who know all the details don’t share them publicly. In fact, it’s illegal for them to do that, and that is well understood within that community. Outside of the aviation community, there are more questions because the standards aren’t as clearly defined. But it doesn’t change the basic requirement to keep detailed sensitive security information away from anybody who might use the information to exploit or attempt to penetrate a physical security system. That’s the goal at the end of the day. 

What kinds of information about weapons screening systems is most sensitive? 

Mike Ellenbogen 

I think it’s about granular specificity. The specific type and configuration of threats that are tested, the performance against those threats, and the specific weaknesses associated with those tests are the most sensitive. That information should be closely held. For example, it doesn’t make people safer if you publicly share that an attacker can defeat weapons screening by disassembling a particular handgun and placing one piece in their shoe and another piece under their hat. Sharing that kind of information only helps the bad guys. 

I do think that we can talk broadly about different categories of capabilities in a way that doesn’t disclose specific weaknesses that could be exploited by a bad actor. However, giving untrusted people a specific report that identifies known weaknesses just makes it more attractive for the bad guys to attempt to penetrate the facility and makes it easier for them to succeed. 

Are bad actors actively looking for sensitive information? 

John Pistole 

We saw this in the real world on Christmas day 2009, when Al-Qaeda in the Arabian Peninsula sent Umar Farouk Abdulmutallab from Brussels to Detroit with a non-metallic IED hidden in his underwear. They knew in advance that there was no detection for non-metallic bombs in most airport security protocols and regimens in use at the time. We know that they discovered this vulnerability through extensive online research. We also know that they conducted multiple scouting missions to probe and test for vulnerabilities at specific facilities using specific screening methods. It was a sophisticated intelligence gathering operation.  

Mike Ellenbogen 

I think bad actors are always looking for ways to circumvent the security processes in place. We see it in loss prevention all the time: people know that if you have a foil-lined bag, you can walk out with stolen goods without being detected by loss prevention technology. So that information has gotten out and it is being exploited on a regular basis. It’s a constant game of cat and mouse. 

What are the tradeoffs between transparency and security? 

John Pistole 

There’s a dynamic tension between how much information can be disclosed to the public and information that provides a roadmap to the bad guys. When I was at TSA, some original equipment manufacturers were disclosing information about their detection capabilities that, given my FBI background, I did not want to have out there. We had some good discussions with the manufacturers, and they agreed that on future iterations of their products they would not publish as much information publicly. Of course, they also agreed that they would provide that detailed information to us in a closed setting, which is necessary to know that their equipment can detect capably. 

How do government Inspector General Offices provide appropriate transparency without undermining security? 

John Pistole 

It’s usually a conversation between the Office of the Inspector General and the agency. Of course, the attorneys get involved to make sure that they are doing their job. There’s usually the unclassified document and then a classified annex that is not available to the public. But members of Congress and others can view the classified annex to have a better assurance of what the findings were and then what steps the agency is taking to address any issues. This helps provide appropriate accountability and oversight without compromising the safety of the public. 

Who needs access to sensitive security information about the capabilities and limitations of weapons detection technology? 

John Pistole 

The people who need to know are those who have been determined to be trustworthy to have that information. The more people who know, the greater likelihood that something will be shared inappropriately and/or inadvertently. In the US government the people with a need to know are people who have a security clearance at the secret or top-secret level, and then compartment segments after that, depending on how sensitive the information is. In the private sector, there may not be such a formal classification system in place, but it’s still compartmented information. Not everybody in the company needs to know everything about the businesses.  

Mike Ellenbogen 

In the private sector, the people with the most significant need to know are usually the security professionals who are responsible for protecting the organization from threats. They need to understand what the capabilities of the technologies that they’re deploying are, and where the potential limitations might be so that they can mitigate them. These professionals usually think in terms of layered defense, so they need to know what every individual component or layer is capable of. Those individuals need to know what specific technologies can and cannot do. 

It’s also important to realize that bad actors are looking at the people and processes just as much as they are looking at the technology. We talk about security systems as a combination of people, processes, and technology. Security professionals are rightfully concerned about the actions of any individual that creates an opening for a threat. It could be giving up passwords. It could be employees allowing unauthorized people to piggyback through turnstiles or secured doors. Bad actors know that well-intentioned people will hold a door open. They’re taking advantage of known weaknesses that originate with people and processes. 

Some people say that the most secure approach is full public disclosure for everybody. What’s your view? 

John Pistole 

I disagree with that view strongly. People who say that absolute transparency is best simply don’t understand the security business. They apparently don’t have an informed perspective or insight into just how determined the terrorists, spies, competitors, and other bad actors are in their efforts to harm individuals, countries, and companies. I get that “give full disclosure for everybody and let everybody make informed decisions” sounds great, but when you provide that carte blanche to everybody, that necessarily includes people with bad motives who are out to cause you harm. If there was no TSA security in the past 21 years, I can’t imagine we would have been able to avoid having more 9/11-type attacks. It just begs the imagination to think full transparency is the best outcome. 

Conclusion 

As John and Mike noted, providing appropriate transparency without assisting adversaries is an ongoing challenge faced by security vendors and practitioners alike. The Evolv Transparency Statement is our attempt to describe the principles that guide our approach to transparency. We will continue to consult with our customers, partners, advisors, and industry professionals to update our approach over time. As always, our mission to keep people safe will be our primary guide. 

About John Pistole 

John Pistole is the former administrator of the United States Transportation Security Administration (TSA) and a former deputy director of the Federal Bureau of Investigation. He is currently the president of Anderson University. In his role as Administrator of the TSA starting in 2010, Pistole led a 60,000-strong workforce, the security operations of more than 450 airports throughout the United States, the Federal Air Marshal Service, and shared security for highways, railroads, ports, mass transit systems and pipelines. Under his leadership, the TSA worked to transform as a risk-based, intelligence-driven counterterrorism agency dedicated to protecting the nation’s transportation systems. Prior to his leadership with the TSA, Pistole served as a 26-year veteran of the FBI with extensive national security and counterterrorism experience. After the attacks of September 11, 2001, John was placed in charge of the FBI’s counterterrorism program, eventually becoming the FBI’s Executive Assistant Director for national security. In 2004, Pistole was named Deputy Director for the FBI and contributed to the formation of terrorism policies during both the Bush and Obama administrations. John earned his bachelor’s degree from Anderson University in 1978. He went on to earn a juris doctorate from Indiana University Robert H. McKinney School of Law. 

About Mike Ellenbogen 

Mike is Founder and Head of Advanced Technology at Evolv Technology. Mike has spent more than 20 years shaping the explosives detection industry including as co-founder and CEO/President of Reveal Imaging Technologies, Inc., as Vice President of Product and Business Development of PerkinElmer Detection Systems where he was responsible for Research and Development, Engineering and Marketing, and as Director of Marketing of Vivid Technologies, where he was instrumental in the transition following Vivid’s acquisition by PerkinElmer. At both Vivid and PerkinElmer, Mike was responsible for market research, definition and development of new products and product enhancements. He has been issued 16 patents in the field of X-ray inspection and automated detection technology and has been broadly published within the security industry. Mike holds a Physics degree from Colgate University. 

NCS⁴ and Evolv Express®

I’ve really enjoyed working with the National Center for Spectator Sports Safety and Security (NCS⁴) on the recently released Operational Exercise for Evolv Express®. In this post I’d like to summarize the results and offer some additional perspective that should help put the results in the proper context.

Key Findings:

The operational exercise incorporated forty-one functional areas, with Express earning an overall composite score of 2.84. This score reflects that, on average, Express met the criteria established for this exercise. In fact, overall, Express performed very well. Scores in the categories evaluated during the exercise are presented below. It’s important to note that, as a practice, Evolv does not publicly share any details that could compromise our customer’s security process. Therefore, specific details such as actual weapon makes and models, images, etc. are not included here, but we do share this sensitive information with our customers privately in a responsible manner.

Real-World Environment:

One of the great things about the NCS⁴ Operational Exercise process is that they strive to evaluate products in real world environments. In the case of Express, the evaluation happened during entrance screening for a Columbus Crew match at Lower.com Field in Columbus, Ohio. It was a cold night. The systems were outside. Express was the only system in place, covering weapons screening at all entrances. The security staff were the same people who would staff any other event. There was no special briefing, training or system tweaks in effect.

The fact is, technology, environmental conditions, architectural structures, conops, and staff training are all important factors that affect screening effectiveness. It’s possible to eliminate many or all of the problematic factors in a controlled environment. It’s not possible to do that in a real-world environment, and that’s why I’m so proud of these Express results from NCS⁴.

Authentic Evaluators:

Although NCS⁴ is part of the University of Southern Mississippi, their approach is anything but academic. NCS⁴ recruits third party evaluators who are seasoned security professionals and have been personally accountable for security screening. NCS⁴ selects new evaluators for each operational exercise, so they have a fresh perspective and are looking at each solution in the context of the venue where it is being tested.

In the case of the Express exercise, the evaluators were a retired U.S. Secret Service Special Agent in Charge, a Security Representative for an organization that produces live events, and a Security Representative for professional baseball, soccer, and hockey. Evolv didn’t get to pick these evaluators.

I truly believe that the Express evaluators are solid proxies for the typical Express buyer. They had the same questions and “show me” attitude that we love to see in our customers. I learned a lot from them and appreciated their suggestions for ways we can both improve our product and better train our customers to get the best possible results. We’re always learning and working to improve.

Beyond Sports:

While it’s true that NCS⁴ is focused on the security needs of the sports industry, I believe that security professionals in other industries can also gain important insights from these results. While it is true that the conops are different at every facility, the fact that Express performed so well in the high-volume, high-pressure sports environment should be a good sign. I’m not saying that Express is a perfect fit for every facility. But if it can work at a major stadium, it is definitely worth having the conversation about smaller facilities.

Summary:

We at Evolv Technology feel confident that these NCS⁴ results provide third party validation of what hundreds of customers and over 200 million visitors already know from their personal experience: that Express offers an unmatched combination of high-performance weapons detection, low false alarm rates, high throughput, unique operational insight, and an awesome visitor experience.

I am really looking forward to working with our customers to sort through what the NCS⁴ evaluation findings could mean for their facilities. I also can’t wait to see how our future products perform in the NCS⁴ process. Having a trusted, fully independent third party available to stress test our product in real-world environment is an incredibly valuable asset. It will push us to always be doing more to make people safe, and that’s something I can always get excited about.

To access the NCS⁴ Executive Summary click here, and please request the full report, here.

Q&A: Security Expert Jin Kim

We sat down with advisory board member Jin Kim to discuss the role technology will play in security and how workplaces should plan for the new risk environment in 2022 and beyond. What we learned: we should anticipate – and plan for – a continuation of (or even a rise in) the high levels of violence we’ve been seeing across the country.

For a bit of background, Jin is widely recognized as a subject matter expert in active shooter and targeted violence attacks. He retired from the Federal Bureau of Investigation (FBI) in 2018 and is a twenty-three-year veteran of the FBI’S New York Division. He served as the Active Shooter Coordinator on the Crisis Management Unit and was the leading authority directing active shooter & workplace violence preparedness, resiliency, and training, for the FBI and its corporate and private sector partnerships.

Today, he provides consultation, substantive training, and expert witness services to leading corporations and businesses, financial and banking institutions, K-12 schools and higher education universities, hospitals/healthcare facilities, professional sports teams & sporting venues, hotels, non-profit organizations, and public safety departments.

Jin is the Founder & Principal of the PerSec Academy, LLC, specializing in Active Shooter and Workplace Violence Resiliency Training and Management.

Q. What can we expect the next 12 months to bring?

A.  Based on the unprecedented risk landscape we’re all facing today, sadly the up-tempo and increase public violence will continue. The underlying factors and ramifications of COVID has brought a whole new realm and spectrum of risk in our society, which has been driven by a shift in how people have been affected and ultimately what pushes some people past their breaking point, and towards violence. What’s behind that shift? I think all the uncertainty and challenges brought on by the past two years – the economy and loss of jobs/income, isolation and mental health/social wellness, increased anxiety are common stressors that are manifesting towards alarming violence.

As a result of our modern complexities in which we find ourselves, the threats and risks themselves will become more complex.

Q. How are organizations shifting how they think about risk?

A. Let’s first look at this through the lens of the education industry. We are seeing a dramatic rise in people exhibiting inappropriate and threatening behavior in and around schools. From remote learning and mask mandates to critical race theory, schools have become battle grounds for the tensions that have boiled over within the country. Now, schools and school districts have to continuously think about that individual(s) – who probably didn’t care about the school board two years ago – who might now pose as a safety risk to school personnel.

Not only are we witnessing a sharp rise in the number of threats, but they are coming from people and places where previously they would not, such as social media disruption campaigns. How do you plan and manage for threats that are indirect and vague? That’s the challenge education is facing right now. They are forced to think about and plan for the risks they might not even be able to identify, which is extremely challenging and complex.

Q. Why are we seeing so much violence now?

A. I think people forget how significant it’s been in the US over the past 55 years; some of our most tragic incidents were well before Columbine in 1999. One significant change since Columbine is that we have a news cycle that never stops. No matter what time of day or night it is, you can turn on the radio, TV or go online and you will be able to find daily reporting about the latest shooting or gun violence attack.

One thing this post-Columbine period has ushered in is an era where at-risk or potential actors are inspired and validated by each other. There is an unfortunate volume of past incidents from which they can learn and study. I think collectively we vastly underestimate offenders and the segment of our population that are at-risk and become prone to the pathway to violence. Until we can understand and accept that they are among us in our everyday routine and intervene prior to the violent act, this problem will never go away.

Q: Do you think we’ll see adoption of security protocols and procedures where there previously was hesitance?

A. Absolutely. There is a sense of urgency based on this new spectrum of risk. Organizations and businesses across industries are, in a sense, prioritizing measures that mitigate the risk of an active shooter incident. This awareness and acceptance that no institution or industry is exempt from this modern-day threat has accelerated a contemporary view of safety and security measures, from entrance screening to active shooter training.

Q: Is there an industry that stands out as needing to rethink its security posture?

A: I think retail is poised to make some drastic changes and upgrades to how they address the safety and security within their stores. For them, I think it will start from a place of understanding what modern-day threat is – leveraging data and technology to establish and maintain a macro landscape of where and how threats enter their space. Understand the volume and frequency of firearms being introduced into retail space can certainly help design and implement modern-day safety strategies that addresses their unique environment.

Q: What do businesses need to be thinking about? 

A: There are two types of threats: insider and outsider. Many organizations try to prevent outsiders from coming in, when the reality is, most of the incidents are conducted by insiders, such as a current or former employee or student. In many of these cases, the offender has no exit strategy after the attack. They are consumed and propelled to the attack and not concerned with the consequences of their actions, and go in with the goal of leaving as much damage and destruction in their wake as possible.

Being aware of the outsider vs. insider threat and the factors that may lead to violence, management and human resources (HR) has a critical role in de-escalating conflict and intervening in the workplace. The risks workplaces face today are becoming more complex for and require enterprise-wide synergy and collaboration. Having only traditional access control security measures without proactively managing internal conflict between employees, for example, creates a risk vulnerability which a disgruntled individual can leverage.

I anticipate – and am already seeing in my consulting work and active shooter expert witness services – executives of businesses of all sizes and industries very concerned with the safety of their offices, employees, vendors and customers, as they plan to return to the office and physical environment. And employees are driving this concern. Where it used to be (if at all) a line item in the budget, it is now becoming a regular operational priority amongst executives to make every effort to proactively manage the evolving and modern-day risk landscape.

 

To read more about Jin, visit his LinkedIn or follow him on Twitter.

Columbus Crew’s State-of-the-Art Stadium Relies on Evolv Technology

One of the most rewarding aspects of my role with Evolv is partnering with sports teams and venues to understand their priorities and offer specific solutions that not only exceed expectations, but also transform their guest experience. As a sports fan myself, helping to make sports games and the venues where they are played an even better experience for fans is, quite simply, a dream job.   

Just this past weekend, the MLS’ Columbus Crew kicked off their 2022 season with a 4-0 shutout victory in front of nearly 20,000 fans cheering them on. All of these fans benefitted from an easy ingress experience thanks to Evolv Express and an innovative frictionless ticketing technology.  We appreciate the work we did with them to ensure the safety component – our systems – of their new facility met the goals of the state-of-the-art stadium before the Crew’s 2021 season.  

The result was an unparalleled fan ingress experience that Brandon Covert, the vice president of IT at the Haslam Sports Group, which manages various operational and administrative functions for Lower.com Field, called “The best ingress experience in professional sports.” 

Integration with future technologies 

Because of its open API system, Evolv can integrate with other technology, whether that is something that can be applied immediately, or a technology that has yet to be implemented. 

At Lower.com Field, this means facial recognition technology. To go from having to stop and be wanded by a security personnel’s handheld device and then wait to have a ticket barcode read, to an entirely frictionless experience, is a huge leap forward for fans attending a game. Fans don’t have to slow down for security, they can just walk right through, and they don’t even need to take out their phone to show a ticket because of the facial recognition. 

Breakthrough technology 

That integration is, of course, in addition to the cutting-edge technology that Evolv offers by itself. 

Setting up Evolv’s systems was as seamless a process as the entry of fans into the facility: 

  • Four dual-lane systems, along with one single-lane system at the ADA entrance ramp, were set up at the southeast gate where most fans enter the stadium. 
  • Evolv allowed as many as 16,000 fans, or 80% of capacity, to enter through that gate in a 20-minute window before the game started.  
  • A total of six dual-lane and two single-lane systems are used at the stadium. 

Evolv’s innovative security screening is not just faster, but safer. It uses advanced sensors and artificial intelligence to recognize even the weapons that are hardest to detect, like ‘ghost’ weapons made with 3D printers. 

The accuracy of the Express systems allowed the staff at Crew games to reverse ticketing and security, so that security checks came after attendees had already entered, further improving the fan experience. 

Using data to make improvements 

That’s the kind of information organizations like the Crew can take advantage of with Evolv Insights analytics. Once they inverted security and ticketing, security staff looked at Evolv data to figure out how to spread out the systems to make sure fans were using all of the Evolv lanes at that particular gate. 

An Evolv Solutions Engineer also worked with the security team to decide where to locate a secondary check-in table, so that fans flagged for double security screenings didn’t create a bottleneck going through Evolv’s systems. 

And Evolv’s Cortex AI capabilities access data insights from all of Evolv’s customers to learn and get better at detecting all kinds of weapons – and what’s not a weapon. At Lower.com Field, that means more accurate recognition of what could possibly be a threatening weapon versus a suspicious but permitted item, like an umbrella. The fewer nuisance alerts, the more seamless the ingress experience.  

As much as the data is able to help maximize the Crew’s Evolv deployment, there’s really only one metric that matters to fans, and that’s how much they enjoy their experience at a game. Crew fans can’t believe how easy the entry process is at Lower.com Field, and that’s going to keep them coming back. 

It starts with an organization’s specific solution, in this case, the Crew ownership’s desire for an unparalleled fan experience. Working with Evolv will deliver those results every time.