Calling Mall Security

The Department of Justice recently released the results of a study on mall security. The findings were not that surprising to me: Overall, state homeland security officials and mall security directors say yes, things are fine, they're prepared. But when you look closely at the actual preparations and training that's going on at malls, gaps emerge. And it's especially revealing to compare the security at American malls to the security at malls in Israel.

First, the good news:

In several cities, police and security firms have formed formal cooperative associations to meet and discuss topics such as bomb threats, executive protection, and burglary investigation.

Overall, [state homeland security directors] were fairly optimistic about the ability of large retail malls in their state to respond to terrorist attack. … Most respondents who reported a positive assessment (very good, good, or fair) believed either that malls cooperated well with local law enforcement or that they had developed emergency plans.

One state advisor noted:

We have three malls in the state that are currently participating in the DHS Buffer Zone Protection Plan initiative. By actually sitting down at the table and working with the other key stakeholders from the local law enforcement, fire, EMS, and EMA communities, these malls are much further down the road in identifying, understanding, and acquiring the physical security resources and training that better prepare them to interdict and/or respond to a terrorist event.

Fifteen, or slightly less than half, of the state homeland security advisors affirmed that they were aware of joint exercises between security staff in some malls and local police. Thirteen affirmed joint exercises with fire and/or EMT staff.

Cooperation with public officials proved to be an important stimulus for the development of emergency preparedness plans.

Three out of four (73%) [mall] security directors reported that they had developed written protocols for security staff to follow in the event of a disaster. The same proportion reported that these plans included coordination and communication with local law enforcement, fire, and medical first responders. A much smaller number (3 in 10) had held exercises to rehearse emergency protocols with first responders.

[T]wo in three mall security directors characterized their local police as being at least somewhat involved in their security planning. Nearly half (44%) of mall security directors stated that law enforcement officials regularly shared key intelligence with them, and another 34% said that information was sometimes shared.

But ... mall security directors would like even more help. And they need to do more:

By a large majority (63%), mall security officials would welcome greater involvement of their state DHS and law enforcement officials in security planning.

One of the most consistent and striking findings during the site visits was that malls we visited have not made any significant investment in increased security following 9/11.

We observed that, in sites that had received Buffer Zone Protection Program (BZPP) funds, local law enforcement, working with the state homeland security offices, took the initiative and contacted area malls to conduct a risk assessment. … Risk assessments, when conducted, have largely been driven by the BZPP application process. …Without undergoing some form of risk assessment process, it is difficult for mall managers to arrive at an understanding about what elements should be protected and which strategies should be employed for prevention of specific assets.

None of the malls we visited had developed ways to coordinate with first responders in the event of an emergency. The only means of communicating with first responders was by phone. The general plan in all cases was that, once first responders arrived on the scene, they would take charge and mall staff would follow any instructions they were issued by police or fire officials. In none of the malls we visited was it clear who would be responsible for briefing first responders or how mall security evacuation plans would be coordinated given law enforcement’s need to retain and interview eyewitnesses.

We found wide variation in how local law enforcement and regional terrorism task forces had been involved in mall security. We observed malls that had a close relationship with local law enforcement. … On the other hand, we also observed malls that had little relationship with local law enforcement. These malls were generally not privy to police intelligence data and did not participate in risk assessments or emergency plans.

We did not encounter any active programs to evaluate what guards derived from terrorism training, or if terrorism prevention and response was actually incorporated into daily work routines. … With no tabletop or live exercises and no clear standards for evaluation, it is impossible to say how well staff would respond in the event of a disaster.

And when compared to the security at malls in Israel, the security at American malls looks positively shoddy:

According to the [mall] security directors that we spoke with [in two Israeli malls], local law enforcement and emergency service representatives often conduct joint exercises with mall security. The exercises include comprehensive drills attended by the district fire brigade, ambulance system, and the entire police district. In addition, there is open intelligence sharing between mall security and local law enforcement. In one mall, police briefed the mall security chief weekly. In the other, the local police district held monthly meetings during which antiterrorism intelligence was shared and discussed with key individuals in the community, including mall security directors. One of the malls we visited provides the local police district with an onsite substation. This allows a subset of officers to become knowledgeable about mall operations and physical layout. It also allows these officers to get to know the mall’s security staff. Finally, mall security and local law enforcement share interoperable communication systems. In the event of an emergency, each unit could communicate with one another over a shared radiocommunications band.

According to the security officers we talked with, the malls [in Israel] usually conduct about 50 drills per month. These range from minor procedural drills to covert drills during which false bombs are planted and attempts are made to bring them into the mall. Major exercises are carried out in cooperation with the police, who evaluate the adequacy of the response by mall security. When security officers fail to detect planted threats, they are retrained. If they fail a second time, they are fired. In addition, a system of positive incentives is also utilized. If a security officer detects a problem during a drill and acts accordingly, that officer will receive a monetary bonus.

The study authors admit that it's unrealistic and unnecessary to try to protect American malls to the same degree that malls are protected in Israel. But they suggest a few reasonable steps "steps that are not expensive and would not alter the experience of consumers":

1. Conduct formal risk assessments and take steps to mitigate known risks on a costbenefit basis
2. Develop and rehearse detailed and coordinated emergency response plans and involve stakeholders
3. Standardize antiterrorism training courses.
4. Enhance partnerships with the public sector.

Once again, the emphasis is on developing relationships, collaborating, and sharing information. That's the foundation. Training and interventive measures can then build on this foundation.