The need to provide transparency without helping potential attackers is a fundamental paradox of the security industry. In their long and distinguished careers, former TSA Administrator John Pistole and Evolv founder Mike Ellenbogen have spent decades thinking about these issues and successfully finding the right balance.  That’s why we consulted with John, Mike, and other advisors to develop the Evolv Transparency Statement. The following Q&A is excerpted from recent conversations with John and Mike to provide additional insight into how we approach transparency. 

How has transparency featured in your career? 

John Pistole 

In 31 years in the government, mainly in the FBI and as the TSA Administrator, I found that transparency is one of those key issues that help define the trust and reputation of agencies, of the U.S. government overall, and of companies that provide security technologies. Each company or agency must be as transparent as possible while maintaining the core mission of keeping the public safe. 

 Mike Ellenbogen 

I grew up in aviation security technology where there is a very well-recognized and understood policy around transparency. In essence, at least regarding public release of technical details, there is no transparency. The specifications are classified by the TSA in the US and the ECAC in the EU. That specific information is called sensitive security information, and it’s very closely-held for what I believe are all the right reasons. 

The systems are tested by security professionals who have a legitimate need to know and hold the appropriate security clearances. These are independent professionals with a great deal of experience and resources to test in ways that most people cannot. These professionals have great credibility in the industry, so certification from a group like TSA is universally recognized as an indicator that the technology is fit for purpose.  

In aviation the people who know all the details don’t share them publicly. In fact, it’s illegal for them to do that, and that is well understood within that community. Outside of the aviation community, there are more questions because the standards aren’t as clearly defined. But it doesn’t change the basic requirement to keep detailed sensitive security information away from anybody who might use the information to exploit or attempt to penetrate a physical security system. That’s the goal at the end of the day. 

What kinds of information about weapons screening systems is most sensitive? 

Mike Ellenbogen 

I think it’s about granular specificity. The specific type and configuration of threats that are tested, the performance against those threats, and the specific weaknesses associated with those tests are the most sensitive. That information should be closely held. For example, it doesn’t make people safer if you publicly share that an attacker can defeat weapons screening by disassembling a particular handgun and placing one piece in their shoe and another piece under their hat. Sharing that kind of information only helps the bad guys. 

I do think that we can talk broadly about different categories of capabilities in a way that doesn’t disclose specific weaknesses that could be exploited by a bad actor. However, giving untrusted people a specific report that identifies known weaknesses just makes it more attractive for the bad guys to attempt to penetrate the facility and makes it easier for them to succeed. 

Are bad actors actively looking for sensitive information? 

John Pistole 

We saw this in the real world on Christmas day 2009, when Al-Qaeda in the Arabian Peninsula sent Umar Farouk Abdulmutallab from Brussels to Detroit with a non-metallic IED hidden in his underwear. They knew in advance that there was no detection for non-metallic bombs in most airport security protocols and regimens in use at the time. We know that they discovered this vulnerability through extensive online research. We also know that they conducted multiple scouting missions to probe and test for vulnerabilities at specific facilities using specific screening methods. It was a sophisticated intelligence gathering operation.  

Mike Ellenbogen 

I think bad actors are always looking for ways to circumvent the security processes in place. We see it in loss prevention all the time: people know that if you have a foil-lined bag, you can walk out with stolen goods without being detected by loss prevention technology. So that information has gotten out and it is being exploited on a regular basis. It’s a constant game of cat and mouse. 

What are the tradeoffs between transparency and security? 

John Pistole 

There’s a dynamic tension between how much information can be disclosed to the public and information that provides a roadmap to the bad guys. When I was at TSA, some original equipment manufacturers were disclosing information about their detection capabilities that, given my FBI background, I did not want to have out there. We had some good discussions with the manufacturers, and they agreed that on future iterations of their products they would not publish as much information publicly. Of course, they also agreed that they would provide that detailed information to us in a closed setting, which is necessary to know that their equipment can detect capably. 

How do government Inspector General Offices provide appropriate transparency without undermining security? 

John Pistole 

It’s usually a conversation between the Office of the Inspector General and the agency. Of course, the attorneys get involved to make sure that they are doing their job. There’s usually the unclassified document and then a classified annex that is not available to the public. But members of Congress and others can view the classified annex to have a better assurance of what the findings were and then what steps the agency is taking to address any issues. This helps provide appropriate accountability and oversight without compromising the safety of the public. 

Who needs access to sensitive security information about the capabilities and limitations of weapons detection technology? 

John Pistole 

The people who need to know are those who have been determined to be trustworthy to have that information. The more people who know, the greater likelihood that something will be shared inappropriately and/or inadvertently. In the US government the people with a need to know are people who have a security clearance at the secret or top-secret level, and then compartment segments after that, depending on how sensitive the information is. In the private sector, there may not be such a formal classification system in place, but it’s still compartmented information. Not everybody in the company needs to know everything about the businesses.  

Mike Ellenbogen 

In the private sector, the people with the most significant need to know are usually the security professionals who are responsible for protecting the organization from threats. They need to understand what the capabilities of the technologies that they’re deploying are, and where the potential limitations might be so that they can mitigate them. These professionals usually think in terms of layered defense, so they need to know what every individual component or layer is capable of. Those individuals need to know what specific technologies can and cannot do. 

It’s also important to realize that bad actors are looking at the people and processes just as much as they are looking at the technology. We talk about security systems as a combination of people, processes, and technology. Security professionals are rightfully concerned about the actions of any individual that creates an opening for a threat. It could be giving up passwords. It could be employees allowing unauthorized people to piggyback through turnstiles or secured doors. Bad actors know that well-intentioned people will hold a door open. They’re taking advantage of known weaknesses that originate with people and processes. 

Some people say that the most secure approach is full public disclosure for everybody. What’s your view? 

John Pistole 

I disagree with that view strongly. People who say that absolute transparency is best simply don’t understand the security business. They apparently don’t have an informed perspective or insight into just how determined the terrorists, spies, competitors, and other bad actors are in their efforts to harm individuals, countries, and companies. I get that “give full disclosure for everybody and let everybody make informed decisions” sounds great, but when you provide that carte blanche to everybody, that necessarily includes people with bad motives who are out to cause you harm. If there was no TSA security in the past 21 years, I can’t imagine we would have been able to avoid having more 9/11-type attacks. It just begs the imagination to think full transparency is the best outcome. 

Conclusion 

As John and Mike noted, providing appropriate transparency without assisting adversaries is an ongoing challenge faced by security vendors and practitioners alike. The Evolv Transparency Statement is our attempt to describe the principles that guide our approach to transparency. We will continue to consult with our customers, partners, advisors, and industry professionals to update our approach over time. As always, our mission to keep people safe will be our primary guide. 

About John Pistole 

John Pistole is the former administrator of the United States Transportation Security Administration (TSA) and a former deputy director of the Federal Bureau of Investigation. He is currently the president of Anderson University. In his role as Administrator of the TSA starting in 2010, Pistole led a 60,000-strong workforce, the security operations of more than 450 airports throughout the United States, the Federal Air Marshal Service, and shared security for highways, railroads, ports, mass transit systems and pipelines. Under his leadership, the TSA worked to transform as a risk-based, intelligence-driven counterterrorism agency dedicated to protecting the nation’s transportation systems. Prior to his leadership with the TSA, Pistole served as a 26-year veteran of the FBI with extensive national security and counterterrorism experience. After the attacks of September 11, 2001, John was placed in charge of the FBI’s counterterrorism program, eventually becoming the FBI’s Executive Assistant Director for national security. In 2004, Pistole was named Deputy Director for the FBI and contributed to the formation of terrorism policies during both the Bush and Obama administrations. John earned his bachelor’s degree from Anderson University in 1978. He went on to earn a juris doctorate from Indiana University Robert H. McKinney School of Law. 

About Mike Ellenbogen 

Mike is Founder and Head of Advanced Technology at Evolv Technology. Mike has spent more than 20 years shaping the explosives detection industry including as co-founder and CEO/President of Reveal Imaging Technologies, Inc., as Vice President of Product and Business Development of PerkinElmer Detection Systems where he was responsible for Research and Development, Engineering and Marketing, and as Director of Marketing of Vivid Technologies, where he was instrumental in the transition following Vivid’s acquisition by PerkinElmer. At both Vivid and PerkinElmer, Mike was responsible for market research, definition and development of new products and product enhancements. He has been issued 16 patents in the field of X-ray inspection and automated detection technology and has been broadly published within the security industry. Mike holds a Physics degree from Colgate University. 

Senior security leaders across multiple industries, surveyed in a joint study by Microsoft and Accenture, cited “reactive threat management” and “intuition-led decision-making based on subjectivity” as top challenges in physical security. The technologies predicted in the study to transform these challenges? “Artificial intelligence and signals processing” at the venue’s threshold; the power of analytics to “sift through overwhelming amounts of data”, and Internet of Things-connected sensors and devices to “collect intelligence in real-time.”

These once sounded like the stuff of science fiction: so-called “smart cities” with “smart venues” that screen visitors unobtrusively, only stop potential threats while letting everyone else pass through, and stream business intelligence back to security teams to improve decision-making and enable a more proactive security posture.

Hello world! With Evolv Express AI-powered security screening and its companion analytics application, Evolv Insights, this future is here. In the latest software release launching this month, new capabilities for connectivity and analytics improve five important dimensions of physical security:

1 – Balance Physical Safety with Visitor Experience

Security screening with Evolv Express is powered by advanced sensors, cameras, and artificial intelligence to distinguish weapons threats from everyday items. It moves guests through a venue’s entryways up to 10 times faster than metal detectors: up to 3,600 visitors per hour at normal walking speed. No stopping to empty pockets or hand over bags means screening is less obtrusive, improving the visitor experience. And no stopping or queuing up means Evolv Express is safer than traditional methods, virtually eliminating the threat of “soft target” scenarios for mass casualty events.

As a connected device, dare I even say an IoT device, Evolv Express captures critical information such as visitor flow rates, alarm rates, and threat types detected at every venue entrance, making this data available for consumption and interrogation across multiple business dimensions—date, time, location, entrance, and event type—in its Evolv Insights analytics platform.

To maintain the highest degree of guest experience and physical safety, Evolv Express offers a range of settings, and the new What-If Sensitivity Setting Analysis in the latest release of Evolv Insights lets security professionals use historical data to see how the system would have performed on an alternate setting. This helps security teams refine their concept of operations (ConOps) strategies and further reduce nuisance alarms, improve guard performance, and improve the guest experience without compromising visitor safety.

2 – Know Your Vulnerabilities

New features for Alert Categorization and Analysis in the latest software release advance the system’s ability to report on what threat types are found at a venue. Security teams resolving issues at the Evolv

Express system simply “tag” alerts with a single, one touch icon set to indicate threat items or nuisance items.

Using this information, new dashboards in Evolv Insights let users drill down into where and when each type of alert appeared, across entryways, times, and events. Armed with this knowledge, security leaders can better focus staff training, deploy more experienced staff when and where they will be needed, and improve overall staff preparedness.

3 – Improve Venue Operations

Better data can help teams beyond security improve visitors’ experience—with ticketing, concessions, retail, ushers, guest services, guides, and more—because the better informed these teams are, the more seamlessly they will operate. Information gathered at every Evolv Express system and available in Evolv Insights analytics will help venue operations improve decisions about staff to guest ratios, staff deployment at different locations and times, along with other resource decisions to boost efficiencies and reduce waste.

To better understand how security and operational needs differ across types of events, the latest release of Evolv Insights introduces Event Type Analysis. Different types of events—think rock concerts, sporting events, corporate events, speaker series, and family productions—will likely exhibit very different characteristics across dimensions like threat types and frequency, alarm rates, visitor flow rates at different venue entrances.

Evolv Insights makes it easy to compare event types side-by-side to find commonalities and differences or to compare events of the same type to find and address anomalies, improving planning across many teams throughout venue operations—including security.

4 – Transform Security from Cost Center to Value Driver

Keeping venues secure not only protects people; it safeguards the brand—for venue leadership, their corporate sponsors, and the talent they attract. But security is too often seen as a necessary evil: a cost center rather than a value driver. I found this callout in the aforementioned Microsoft and Accenture study spot on and worth noting… No matter which metric the organization prioritizes, a data strategy will be required to optimize the outcome. An effective strategy will enable physical security to become the core intelligence platform of the organization, transforming from a cost center into a value hub. I could not have said this better myself.

With Evolv, the power of data and analytics at every visitor entrance means security teams can provide a high degree of value to executive leadership by providing transparency and visibility with accelerated, streamlined, reporting capabilities.

Evolv Insights offers both pre-defined and flexible dashboard views that users can save and return to, share with colleagues, print to file, and export to work with adjacent analytics packages. And in the latest release, subscribed users automatically get “pushed” Post-Event Summary Reports, without a separate need to access the Insights application.

5 – Adopt a Proactive Security Posture

When venue teams need critical data about their venue in the moment, wherever they’re located, the latest software release from Evolv offers the MyEvolv Portal mobile application. Teams can now access analytics, scanner monitoring, and management, and proactive communications from any device, including Android- and iOS-equipped smartphones and tablets, to facilitate faster, better decision-making and respond in the moment to security needs across their venue before they become an issue.

Evolv prioritizes connections between venue staff and its security systems both through analytics and through communications technologies like Request Assistance—a discreet, one-touch alert from the operator tablet to additional venue security to help resolve an incident at the system.

The latest software release extends this connectivity and communication with new Remote System Management in the MyEvolv Portal. Available in both the mobile and web-based application, system administrators can now remotely log into Evolv Express systems and interact as if they were co-located with the system for monitoring, troubleshooting, and configuration changes. And whenever critical changes to the system occur, subscribed users receive new Proactive Notifications via text, email, or in the application.

Conclusion: The Digital Transformation of Physical Security is Here

While much has been imagined about the benefits of a future world—with “smart venues” powered by connected products and better data to improve visitors’ experience while making everywhere safer—Evolv brings that future to life today. It enables venue security and operations leaders to access better data for evidence-based decision-making, ensure connectivity between people and security technologies throughout a venue, and improve the guest experience while maintaining the highest standards in physical safety both today—and tomorrow.

Our mission at Evolv is to make the world a safer place to work, learn, and play and has been since we began. Having been with the company since near the beginning, I am thrilled to share the news that we have surpassed the 100 million mark in the number of people that have safely and seamlessly walked through our Evolv Express® systems.  

To safely screen 100 million individuals has taken a lot of hard work on the part of our teams as well as our customers. It is not easy to set a new standard in any industry, and particularly one that is so fundamental to our lives as our physical safety. Evolv has been able to do it with our advanced weapons detection solutions, as this latest milestone proves.  

Only the U.S. Department of Homeland Security’s Transportation Security Administration (TSA) has screened more people than Evolv in the United States. That’s a pretty impressive feat when you consider the company was only founded in 2013.  

We can’t take full credit for reaching the 100 million mark so rapidly and for setting a new standard for security in the 21st century. We have to share the honors and accolades with all of our customers—and particularly our early partners, who had the faith and courage to believe in the boldness of our vision and our ability to achieve our mission. 

When I think of 100 million people, the number is too staggering to comprehend. Instead, I think about many of the individuals that I’ve watched as they casually walked through our digital thresholds, smiling and chatting with friends and family, typically unaware they are passing through an advanced, modern weapons detection system that is keeping them safer.  

I’ve talked to many of these patrons who told me they thought the venue didn’t have any security because they didn’t experience metal detectors stopping them in their tracks and forcing them to get in a slow-moving line, pull out their cell phones, empty their pockets, etc. When I tell them they actually passed through a new type of threshold that uses advanced sensors, cameras, artificial intelligence and other digital technologies to detect weapons, they are typically amazed that such a solution exists—and grateful that the venue’s owners were committed to modernizing security in consideration of the experience and safety of visitors. 

Here’s another thing about the 100 million milestone.  It’s taken a lot of hard work to get here, but it’s only a brief stop along the way. I fully expect to be seeing more of these announcements in the future, new milestones and new achievements, and I won’t be surprised to see the pace accelerate. That’s because the Evolv Express is setting the standard in physical security for a wide range of venues where large groups of people gather—concert halls, sports arenas, theaters, other performing arts locations, casinos, schools, hospitals, tourist sites, places of worship, shopping malls and more. 

As more customers and potential customers recognize that there is a new standard for weapons detection—and it really works—they will realize that they cannot and should not be left behind using 20th-century analog solutions in the 21st-century digital world. I look forward to more milestones as we continue on our journey to make Evolv an unobtrusive yet ubiquitous part of our everyday lives.  

In recent years, “Digital Transformation” initiatives have taken priority across industries. But an article last month in Industry Week cited the “deskless workforce” as the last holdout of digital transformation: and it’s not small. The article estimates that about 80% of the world’s workforce, or 2.7 billion workers, have been “left behind” by digital transformation: that is, the introduction of new technologies intended to enhance “safety, quality, and productivity” for companies.

So how can physical security, arguably one of the most important “deskless” roles throughout our society, be positively impacted by a digital transformation of its own?  

The Reasons to Transform: What’s Missing? 

Thru the years we have certainly witnessed developments in technologies for physical security. The introduction of video management systems, communications devices, and physical access systems (ticketing, badging, biometrics) have all added advancements to the industry.  

But when it comes to detecting weapons, perhaps one of the most critical roles in ensuring physical security, many venues still rely on analog metal detectors. And we are all familiar with how that works: stop while you wait in a slow-moving line. Stop to empty your pockets. Stop to hand over your bag. Then, either get waved through or sent back because you’ve forgotten to put down some metal object you were carrying. Stop to get wanded; or, worse yet, submit to a pat-down.  

This process is more than an annoyance. It may amount to a threat itself. Crowds have proven to increasingly become “soft targets” for mass casualty events—as in tragic events at Mandalay Bay in Las Vegas, and the Boston Marathon bombing. What’s more, the health threats of close-contact crowds have been brought into sharp focus by Covid 19.  

Beyond crowded conditions, metal detectors can also overwhelm the guard resource, causing them to miss real threats in all the clutter they see on a daily basis. The reason lines are so slow-moving, of course, is that we all carry metal items with us every day.   

Metal detectors pass the work of distinguishing metal items from true threats off to guards. They simply alarm on everything, not just weapons, so guards are very used to so-called “nuisance alarms” and therefore, rightly so, don’t trust the system. That means they are left doing the brunt of the work—visually checking each person and bag that alarms. Most of the time, all they find is everyday items: laptops, tablets, smart phones, keys, etc. But this creates fatigue, because it’s easy to overlook what you don’t expect to see, and can result in security teams inadvertently letting weapons through.  

To combat fatigue or to move lines through more quickly, venues may turn off security systems when crowds get overwhelming; they may randomly sample visitors; or, they may opt for no security systems at all—each of which further raises the risk of weapons simply walking through undetected.  

The Way to Transform: What Can Technology Help Do? 

Prioritize the customer experience: The digital transformation of physical security must prioritize guest experience. If the high alarm rate is not indicative of the true number of threats entering a venue –– then a lower alarm rate reflecting the reality that most people are, in fact, not a threat will simultaneously elevate the guest experience and help security teams better pinpoint the true risks at a venue’s entryways. Allowing guests to enter at walking pace, with no interference whatsoever in the experience of visitors who don’t pose a potential threat, provides the best possible user experience both for guests and for guards.  

Let technology do what it does best… and, by extension, let people do what they do best. Technology that can detect weapons – not just metal –to by using AI and advanced sensors to distinguish true threats from everyday items relieves the burden on guards to check people that likely aren’t carrying weapons. And, it can pinpoint for guards where on a person the weapon is expected to be found. This expedites alarm resolution and improves guard efficiency by targeting only visitors who need to be checked and focusing guards only on the locations on their person or baggage to check.  

Ensure data drives decisions. Technology at the threshold of every visitor and/or employee entrance surpasses the ability of metal detectors by counting visitors, recording alarm rates and types, understanding the dates and times when rates are highest or lowest, and even allowing for the comparison of different security outcomes based on different event types. All this data provides venue security and operations teams with real-world evidence for better decision making, to meet the security and experience needs of their guests, better than guesses, gut feel, or manual counting can. Security planning and venue operations can all be data-driven to ensure the right staffing decisions are made at the right locations throughout the venue to both secure guests and elevate the guest – and guard – experience.  

Connect and communicate. With such a critical mission and so many possible security technologies also operating in the space, security technologies should never exist in a vacuum. Rather, they should integrate seamlessly together with other technologies that make up the extended security ecosystem. Options for integrated camera technologies and integrated communications provide an extension of existing security systems and staff to one of the most vital parts of the venue—its entryways. Neither should security technology require expertise that is outside the scope of existing venue resources. Technology should inherently scale—through built-in connectivity that doesn’t require an IT team to install, connect, or service—and through simple, app-like user experiences that guard staff and security leadership alike can quickly learn to operate, reducing the learning curve and training new staff members ASAP.  

Make life better. Why digitally transform if the technology doesn’t make life better for guests, guard staff, and venue leadership? When guests don’t notice security technology, they are less aggravated, with fewer frustrations to take out on guard staff, and they find the venue even more delightful. If guard staff are made more effective and efficient, they can experience higher job satisfaction and lower turnover rates. For venues, offering better customer experience plus enhanced security while reducing employee turnover are just a few of the potential benefits. Better resource use through data-driven decisions, better use of entryway space with fewer security lines and less equipment overall, and the chance to redeploy guard staff to different roles throughout the venue are all further benefits that venues can realize.  

The Imperative to Transform 

Of course, not least of all is the benefit of increased safety to the visitors of venues around the world that choose to embrace the digital transformation of their physical security. Simply put, shorter security lines through more reliable screening technology adds up to safer visitors—and lower false alarm rates mean guards can more easily pinpoint and stop bad actors—making more venues where people and their families love to gather with one another in our community safer.  

Each year, Security Today presents awards for the best new products across a variety of categories. The winners are chosen by an independent group of experts. For 2021, I am proud to say, Evolv has been named as the 2021 New Product of the Year in the Pedestrian Security Entrances category. 

This is yet another important industry-wide recognition of our mission to create a safer world and set a new standard for physical security in the 21st century. Evolv Express® is the first and only weapons detection security screening system powered by advanced sensors and artificial intelligence to deliver a safer, fast, and friction-free experience for patrons. 

When you think about the category in which we were selected, Pedestrian Security Entrances, the first images that probably come to mind are metal detectors—and the long lines and laborious processes of patrons pulling out their phones, emptying their pockets, and walking one at a time through a threshold that is obtrusive and not at all welcoming. As we still grapple with a global pandemic, these images seem not only incongruous and out of touch; they’re frankly a security threat. 

Unfortunately, this outdated 20th-century metal detection technology has been the standard for Pedestrian Security Entrances for a long time—not because it is particularly effective, but because developing a better, modern replacement based on advanced software and digital technology has not been an easy task.  And being able to meet the standards of the professionals we work with using artificial intelligence and advanced sensors to detect weapons, took herculean efforts. The product works. That’s easy to say but difficult to back. We can. 

And now, more than ever, we need it. There were 452 mass shootings in the U.S. to date in 2021, according to the gun violence archive, surpassing 417 in all of 2019.  More venues and employers that never considered security screening technology are looking for solutions.  Airport and prison security is not the answer for the performing arts, casinos, schools, tourist sites, and places of worship.   

We’ve done the work, put in the time, collaborated with the best security professionals in the business (our customers) and we have built and delivered a new standard for weapons detection in the digital age. Not only can visitors walk right through at the pace of life, but they are better protected, and security professionals can redeploy their efforts to more pressing security concerns vs invasive bag checks.  

It is an honor to see our work and our vision capture the attention of industry leaders such as Security Today and its readers. As Security Today noted, their New Product of the Year Award “honors the outstanding product development achievements of the security equipment manufacturers whose products are considered to be particularly noteworthy in their ability to improve security.” 

Congratulations are in order to our dedicated team of engineers, who live their mission daily by transforming security to enhance everyone’s life. One more notable step on our journey to make the world a safer place to live, work, and play.