With the emergence of UAV’s, it is imperative that security plans include assessments of the risks associated with drones and aerial attacks, and consideration for security controls that can mitigate such threats.
The two core functions of any plan to secure an event are the following:
First, let’s establish a simple risk assessment framework so that we can consistently assess the risk of each threat and the effectiveness of its counter-measure. The two definitions that we will use in this post to establish this framework are Inherent Risk and Residual Risk.
The general concept of risk can be defined as a function of the potential consequences of the threat compared to the probability of this particular threat occurring.
Inherent Risk = Consequences * Likelihood
The countermeasures that are employed significantly reduce Inherent Risk. Therefore, residual risk can be defined as the amount of risk left over after inherent risks have been reduced by risk controls (security measures).
Residual risk = Inherent Risk - Impact of Risk Controls.
The image below plots the “Likelihood of Residual Risk” posed by a threat against the “Consequence” of the threat. This gives us a good framework to evaluate risks associated with any particular threat and whether security measures are effective in mitigating these threats.
For eg. At a large public festival with no security measures, the likelihood of someone’s personal belongings being stolen is “Almost Certain”, and the consequence is “Moderate”. If we refer to the chart above, this would give us a level of risk that is “Unacceptable”. But when we add countermeasures like ticketed entry, private security patrol, and surveillance cameras we can reduce the likelihood of someone’s personal belonging being stolen from “Almost Certain” to “Possible” while reducing the severity from “Moderate” to “Minor” since it would be harder to steal larger items. Then the residual risk associated with this threat would then go down from being “Unacceptable” to being a “Supplementary Issue.”
We will use the same framework to evaluate the major threats posed to any outdoor event, and analyze whether current security measures are capable of reducing the risk posed to civilians attending an event in the 21st century.
Catastrophic threats to a large outdoor event.
Pre-planted explosives or weapons.
A terrorist attack is one of the biggest threats faced by any outdoor event where large crowds are present. In the past terrorists, have planted explosives in cars, trash cans and motorbikes to attack crowds. With no security measures applied, the Likelihood of this threat is “Probable” while the consequence is “Catastrophic”. By referring to our risk assessment framework, we can conclude that the risk level is “Unacceptable”, therefore security measures should be taken to counter this threat.
The police usually perform an intensive sweep before any major event to ensure the area is clear of any pre planted explosives or threats. Before the event begins it's important to secure the area and establish a perimeter, thus preventing the general public from accessing the area. This makes it hard for anyone to carry out an attack by pre planting explosives or weapons. By employing this security measure, the likelihood of residual risk would be “Unlikely” with the consequence dropping down to “Major” or even “Moderate”. The risk level would then be a “Supplementary Issue”.
But this still isn't an acceptable level of risk, as there's a small chance for someone to plant explosives, like the Tsarnaev brothers showed us with the Boston marathon bombing. Implementing additional security measures will reduce the level of risk to an acceptable level.
National events, and most regional and local events implement additional measures such as using explosive detection canines and handlers. K-9 units and police can patrol through the event area. Security can watch live footage from surveillance systems to notice any unusual patterns or suspicious activity. Police and canines can then investigate this activity or particular area for threats. These kind of controls would reduce the Likelihood of planted explosives to “Rare”, and even when the Consequence is “Major or Moderate”, the residual risk after taking into account the security controls would be “Acceptable”.
Attendees bringing in weapons, explosives or harmful substances.
Attendees could try to bring weapons or explosives into the event. Suicide bombers strap explosives to their bodies, or hide them in personal items like a backpack. With no security measures, the Likelihood of this threat is “Probable” and the consequence is “Catastrophic”. The risk associated with such a threat is “Unacceptable”, so employing security controls will reduce this risk.
A common security measure is to screen all attendees and control access to the event. Private event security is usually hired to oversee checkpoints where attendees are screened using metal detectors. Personal items like handbags and backpacks are checked manually or through a scanner. This form of access control would make it really difficult for someone to bring in weapons or explosives inside the event area.
If somehow a person is able to bring in an explosive unnoticed, the explosive detection canines on patrol would sniff them out quickly.
Therefore the Likelihood of this threat after the security controls would be “Rare”, with “Moderate or Major” consequence. Then the residual risk of this threat could be categorized as “Acceptable”.
Active Shooter from a surrounding area.
One of the biggest attacks at a live event took place in Las Vegas that left 58 dead and 546 injured. A crowd of 22,000 had gathered to watch artists perform at the Route 91 Harvest festival when the shooting took place.
The most devastating aspect of the las vegas shooting was that the shooter fired from the 32nd floor of a nearby hotel. As a result, the bullets came from above, and the crowd of 22,000 was trapped in the event venue.
The Las Vegas shooting showed that an event can be targeted from a distance and the attacker doesn’t always need access to the event or the crowd to inflict damage. The security measures in place were not enough to deal with this kind of threat. It also underlined the importance of considering all threats and their consequences even if they fall outside the traditional scope of threats.
Unmanned Aerial Vehicles (UAV’s)
The rise is technology has opened up another avenue to cause damage from a distance. And that is the use of commercial unmanned aerial vehicles commonly referred to as drones.
Ten years ago, the only way to conduct an aerial attack would be to use a airplane or helicopter. Either of which would have been extremely difficult to get your hands on and incredible expensive to orchestrate. Even though the consequence of an aerial attack would have been “Catastrophic”, the likelihood of an aerial attack at a live event or festival was “Extremely Rare”. Therefore the risk associated with such an aerial attack was “Acceptable” and security measures to protect against aerial attacks were not needed.
But technology has advanced significantly, and now commercial drones are available to anyone for only a few hundred dollars. They have the capacity to fly significant distances and operate upto 30 mins to an hour per charge. Moreover, they can be easily modified to carry relatively heavy payloads.
Below are some of the threats posed by a drone to an outdoor event:
ISIS has already started using unmanned aerial vehicles to drop explosives of Iraqi and American soldiers.
The Department of Homeland Security has recognized the danger a drone can pose. In their latest National Terrorism Advisory Bulletin, they have identified unmanned aerial systems as a potential terrorism threat to the US.
The graphic above shows how traditional security measures protect against ground attacks, but leave the airspace above completely unprotected. This would not have been an issue a few years ago, but now it is essential that event organizers and event security companies take steps to also secure their airspace.
Referring back to the risk assessment framework, the likelihood of an aerial attack using a drone is now “Almost certain” with the consequence being “Catastrophic”, thus making the risk associated with this threat “Unacceptable”. Since currently there are no security controls that can prevent or mitigate such a threat, the residual risk level remains “Unacceptable”.
Therefore, event organizers and security personnel should be proactive in mitigating aerial threats. A good first step towards securing your airspace would be to evaluate different drone detection and mitigation technologies that can help officers detect, track and stop drones that enter the event airspace. It is time to update our traditional security infrastructure to include technology that will help protect the airspace.