Blending risk analysis with executive protection

Physical Risk Assessment – Preliminary Report
SWEIGERT, DAVE Page 1
Threat and Hazard Identification
and
Risk Assessment
COMMUNITY THEATER
July 2015
Training Material
Distributed for educational purposes only
AUTHOR:
Dave Sweigert, M.Sci.,
CISSP, CISA, HCISSP, PMP, SEC+

Executive Summary
This report is a preliminary Threat and Hazard Identification and Risk Assessment
(THIRA) report that addresses associated risks and threats to a community theatre
that may host a dignitary visit. The specific community theatre is not identified in
this high-level generic report, as this report is distributed for tutorial purposes for
the THIRA community. Actual particulars of the security details of this facility,
along with photographs, are contained in a series of confidential annexes.
Disclaimer
The author is a non-attorney security practitioner that has produced this document
as part of scholarly research. The reader is cautioned that this document is not
intended to provide specific security advice to a particular structure, venue or
setting. This document is distributed for tutorial purposes only.
Credits
The majority of illustrations used in this document have been procured from
printed materials of the Federal Emergency Management Administration (FEMA).
All others have been procured from government web-sites and Copyright has been
waived. This work is a Copyrighted work (2015).

Background
As a preliminary matter, this report will address basic terroristic threats to a
community theatre. The guiding principles for this assessment are contained in
these Federal Emergency Management Administration (FEMA) documents:
FEMA 426, Reference Manual to Mitigate Potential Terrorist Attacks Against
Buildings, and
FEMA 452, Risk Assessment, A How-to Guide to Mitigate Potential Terrorist
Attacks Against Buildings
Scope
This report provides a scenario based assessment to simulate the issues that may
impact a dignitary visiting the community theatre. For the purposes of this
scenario it will be assumed that:
a. A preliminary assessment of the structure will be undertaken (phase one);
b. Recommendations as to permanent upgrades to security will be cited (phase
two); and,
c. Specifics will be addressed concerning a dignitary visit to the theatre.
Threats to be addressed:
Improvised Explosive Device (IED) placed in building
(internal explosive attack)
IED worn by suicide intruder and exploded
IED borne by vehicle that penetrates security

Target Zones
To aid in the threat analysis of the structure, FEMA suggests the use of target
zones.
Zone 1 Building and perimeter within 100 feet
Zone 2 More than 100 but less than 300 feet
Zone 3 More than 300 feet but less than 1,000 feet
This approach can be co-mingled with threats to produce the following hybrid:
Zone 1 Internal explosive attack
Zone 2 Individual borne IED
Zone 3 Vehicle borne IED

THIRA Methodology
As the following is provided for tutorial purpose, the information expressed below
is an over-simplification. However, this approach is designed to provide a general
roadmap for conducting the THIRA.
Pre-field Activities
Identify key objectives of stakeholders Objective: conduct threat analysis of
community theatre to contain 200
patrons attending a dignitary event
Pre-threat assessment Review open source intelligence
(OSINT); such as Google maps, Google
Earth, publicly available building floor
plans, evacuation procedures, fire
prevention documents, etc.
Field Visit
Tour exterior and publicly accessible
areas
Use of a physical security checklist
completed during site survey.
Post-field Activities
Transfer data collected Prepare a written report summarizing
findings

Pre-Field Information
Building name: Name withheld Community Theatre Building
Address: Name withheld street address and identifying information
Cross streets: Withheld
Year Built: 1972
Floors/Height: Approximately four stories tall
Field Visit
Locality: Semi-urban/light-industrial
Number of occupants: More than or equal to 200, less than 400
Building characteristics: Educational/Auditorium
Business Continuity (after attack): Low
Physical Loss Impact: Local
Overall Site Accessibility: Accessible
Target Potential: Yes
Distance to unsecured vehicles: More than 75 feet (non-public road)
Perimeter Boundary: No Security / Discontinuous Security
Unobstructed view: More than 30 feet
Storage of Hazardous Materials: Low
Building Height: High, more than or equal to 50 ft. less than 100 ft. (4 floors)
Building Configuration: Circular (convex)

Lobby Location: External
Vehicular penetration of exterior envelope: Yes
Window Support Type: No Windows (some glass in front lobby)
Building Type: Reinforced Masonry

Intrusion Detection: None
Video surveillance and assessment: None
Security Guards: None
Security Lighting: Low to Moderate

Post Field Mitigation Strategies
The following recommendations are suggested as temporary/permanent upgrades
to the facility. The temporary upgrades should be considered for the purposes of
accommodating a dignitary.
Site: (1) Close street lane and use vehicles to block vehicle traffic at times of high
alert; otherwise, (2) consider fixed anti-ram barriers around perimeter at strategic
points.
Architecture: (1) Offsite deliveries, parking and visitor screening during high
alert; otherwise, (2) optimize internal spaces to separate secure from unsecure
spaces.
Security: (1) Screen all persons at property line, at building entrance, and when
entering secured spaces during high alert; otherwise, (2) screen all persons entering
secure spaces.
Surveillance system: (1) Install extra temporary cameras to provide coverage of
parking areas, screening areas, internal areas during high alert; otherwise, (2)
provide external security cameras on building.
Vehicle circulation: (1) Consider shuttle bus transportation from parking area
outside of Zone 3 (1,000 feet away) to screening area during high alert; otherwise,
(2) create fire lanes or no parking lanes around building perimeter that are strictly
enforced with towing.

Risk Scoring
Relying on a rough order of magnitude (ROM), a basic risk scoring model can help
the THIRA practitioner to quantify risks to the visit of a dignitary to the facility.
Consequence (C) Threat Rating (T) Vulnerability
Rating (V)
Aggregate
(C+T+V)
Threat: Inside IED (explosive device) within Zone 1
The inside threat addresses devices that have been placed in the facility prior to the
event. Such devices can be designed to cause death, life threatening injuries and
property damage.
Special factors: the explosive blast-wave of an explosive device, when detonated
indoors, increases by a factor of 2 to 9 times. Therefore, an indoor explosive
device is the most threatening to the event.
Rating (V)
Aggregate
(C+T+V)
10 10 10 30
Threat: Carried IED (human borne) within Zone 2
A human borne IED can be carried by a suicide bomber that is masquerading as a
legitimate guest, staff member, visitor, patron, etc. It is assumed that in this case
the human borne IED will be exploded within Zone 2 (assuming proper security
precautions).
As Zone 2 primarily consists of open air space, the explosive impact of the blast-
wave will be greatly reduced.
Rating (V)
Aggregate
(C+T+V)
5 7 5 17

Vehicle borne IED within Zone 3
Vehicles can carry a great deal more explosives than a suicide bomber or what can
be considered an unnoticeable package hidden inside the structure. To this end,
having a vehicle borne IED explode more than 300 feet from the structure, crowd,
visitors, etc. may still cause significant damage due to the massive amounts of
explosive a vehicle can transport.
Rating (V)
Aggregate
(C+T+V)
8 10 5 23
Summary
Inside threat 30
Vehicle borne IED 23
Human borne IED (carried) 17

Dignitary Protection Scenario
This section will address the proactive steps that can be taken to provide relevant
protection in such a setting that is hosting a dignitary reception. This section will
provide a scenario-based list of counter-measures that can be deployed to provide a
high level of confidence that a negative event that endangers life or property will
not take place.
Assumptions
This scenario will assume the following:
• Protectee arrives at 10:00 am.
• Protectee (dignitary) will be in the zones for three (3) hours.
• He/she will land via helicopter about one mile from the venue
• Protectee will arrive via a six (6) to seven (7) vehicle motorcade
• He/she will be transported from motorcade to a small “green room”
• After ten minutes (10) protectee will enter “meet and greet” room to mingle
with twenty (20) local/regional/state officials and important guests
• After one half hour (30 minutes) protectee will be ushered into auditorium to
provide a speech of about 45 minutes.
• Following speech, protectee will walk a “rope line” to shake hands with
audience members for about 15-20 minutes.
• Protectee departs the area approximately 2 ½ hours later.
• This document will address protections issues up to the arrival of the
protectee.
• Protectee motorcade logistics will not be the responsibility of the pre-event
THIRA report team.
• This report will provide THIRA and protectee suggestions to the protection
details providing protectee security.
• This report will address event area logistics and site preparation and provide
examples of technical resources to assist in scholarly research.

Zone Concept
To provide the reader better clarity about the zone concept a figure is presented
below. Terminology is borrowed from the Fire Service Hazardous Materials
(HazMat) community (see cold zone, hot zone, etc.).
Notice the corridor which provides only two access points.
FEMA THIRA Fire Service HazMat
Zone 1 Hot Zone
Zone 2 Warm Zone
Zone 3 Cold Zone
External to Zone 3 Crowd Control line
The reader should observe the decontamination corridor, which penetrates the
warm zone. As will be explained later, the guest “chute” pedestrian passage way
will resemble this corridor.

External to Zone 3 boundary (+1,000 feet), aka Security Boundary
The extreme outer perimeter extends beyond 1,000 feet. To reduce threats from
vehicular circulation the following suggestions are made.
Based on the combined consequence, threat and vulnerability (CTV) score, a
vehicle borne IED is the highest threat category.
To mitigate this threat, the following actions are suggested:
• Assuming a 10:00 am arrival of the protectee, a one-way, unidirectional
traffic pattern should be deployed at 8:00 am. The end goal is to reduce,
and/or eliminate and cross (bi-directional), two-way traffic on major
adjacent streets.
• NO PARKING – SPECIAL EVENT signs shall be posted 24 hours in
advance along the one-way loop traffic pattern.
• One way traffic flow will create a quasi-boundary by disturbing normal
traffic patterns that eliminates the possibility that vehicles slow down or stop
along the one-way traffic pattern.
• The one-way loop traffic pattern can be monitored and observed by
uniformed traffic control agents, parking enforcement, reserve patrol
officers, etc.

Example of traffic loop
Outer perimeter one-way loop traffic pattern

• Consideration should be given to the use of public works personnel to
perform observation and surveillance of the roadway loop and other surface
streets between 1,000 and 5,000 feet from Zone 1.
• Public works and traffic engineering personnel can be briefed to watch for
various suspicious behaviors and provide radio call intelligence reports via
radio-equipped public works and street maintenance vehicles.
• Public works equipment such as heavy dump trucks can be utilized to block
streets to create the outer perimeter traffic loop.
Example of ancillary resources

Zone 3 (300 to 1,000 feet)
The reader should recall the below graphic and the concept of a “cold zone”.
There are two major points of entry into Zone 3 – the guest screen area and the
entrance/exit to the guest parking lot (see below).
Notice the corridor which provides only two access points.
Guest parking lot
• Pre-arranged individuals on guest list (200) receive parking passes for a
special parking lot 24-36 hours prior to the event.
• Guest vehicles with parking passes will be staged in a parking lot at least
1,000 feet from the venue.
• Parking placards must be displayed on the guest vehicle dashboard.
• The guest parking lot should be opened between 8:00 am and 9:00 am. It
will be closed at 9:30 am in anticipation of the 10:00 am beginning of the
event.
• Barrier tape, traffic cones and directional devices shall be used to create a
pedestrian chute between the guest parking lot and the Zone 2 screening
area.

Example of pedestrian cone and belt “chute” barrier
The following actions and tasks should be accomplished 24 – 48 hours prior to the
event:
• Trash removal vendors empty all fixed trash cans and remove portable trash
cans and dumpsters.
• Grounds keeping operations shall be halted 24 hours prior to the event.
• Sprinklers should be de-activated.
• Begin increasing roving patrols by non-sworn security officers, grounds
keepers, maintenance workers, etc.
• Excessive overgrowth of brush and shrubs trimmed back.
• Deployment of highway construction type 400 kilowatt generator with 50 ft.
telescoping light array to flood darkened areas and shadowy buildings the
night prior to the event.
• Deployment of Jersey Barriers to areas identified as weakened sections that
would permit vehicle penetration of the security zone.
• Increased litter patrols, increased sworn Law Enforcement Officer (LEO)
patrols (sporadic and random), etc.

Example of Jersey Barrier
The following actions should be accomplished four (4) hours prior to the event (by
6 am):
• Placement of barrier POLICE tape around the Zone 2 perimeter.
• Placement of barrier POLICE tape around the entire guest parking lot.
• Commencement of four (4) roving law enforcement patrol cars to patrol the
Zone 3 outer perimeter in a continuous fashion.
• Commencement of four (4) roving LEO foot patrols walking the Zone 3
area.
• Two LEO patrol cars stationed in guest parking lot to control entry.

Zone 2 (100 to 300 feet)
Recall that the human borne IED threat is considered the least of all identified
risks.
There is only one entrance into Zone 2, a controlled screening area. The controlled
screening area will “funnel” guests through a screening process. This access point
is located at the opposite end of the guest “chute”.
It will be necessary for preliminary screeners to be posted at the entrance to
the guest “chute” at the guest parking lot. The screener team at the guest
parking lot will perform initial observational screening, reminding persons to
return heavy bags, and questionable packages to their vehicle.
The screening process will rely on wanding, ad hoc pat-downs, and magnetometer
passage. The screening area will resemble the figures below:
Tables for bag inspection, magnetometers for pedestrian inspection

The remainder of the guest “chute” that enters into Zone One shall be comprised of
hardened barriers, such as seen below.
Hardened barrier for guest “chute” from Zone 2 to Zone 1
There will also be a wanding and pat-down team to assist with handicapped or
special needs individuals.
Example of wanding

It is estimated that a single individual can clear the screening process in 30 seconds
(two (2) per minute). 200 individuals would take 100 man-minutes of screening.
With four (4) magnetometers, wands and pat-downs, this should take about 25-30
minutes.
Tasks to be completed and/or on-going activities to commence prior to 7:00 am:
• Twelve (12) private security screeners arrive to set-up equipment
(magnetometers, tables, wand stations, etc.).
• Two two-person counter assault teams arrive to support interdiction of
human-borne IED.
• One two-person bomb sniffing Explosive Ordinance Disposal (EOD) K-9
team deployed onsite at screening area. Will remain stationed at screening
area for possible alerts to IEDs.
• Two two-person LEO teams are deployed to screening area.
• Two LEO patrol cars are positioned as obstacles near screening area to deny
vehicle penetration of the area.
• One Basic Life Support (BLS) ambulance is deployed near screening area
with two-person Emergency Medical Technician (EMT) crew to handle
guest emergencies.
• Aid Station First-Aid tent deployed at near entrance of guest parking lot and
guest “chute” to handle any minor medical emergencies (extra chairs, eight
cases of bottled water, awning and shade. Maintained by volunteers from
American Red Cross.
• Two two-person LEO teams deployed to roving patrols within 100 feet of
screening area.

Example of American Red Cross aid station

Zone 1 (Building to 100 ft)
The inside, or inner-building, threat was identified as the area of most risk.
Therefore, more mitigation counter-measures will be deployed within Zone 1 (as
compared to other zones). The highest potential threat for Zone 1 remains the
placement of an IED pre-event.
Tasks to be completed 48 hours prior to the event:
• Staff advised building will be closed during event.
• Arrangements made to deliver packages off-site (UPS, Fed-EX, etc.)
• Inventory of all staff working in building to include Social Security Account
Number (SSAN) and Date of Birth (DOB) receive Live Scan background
check (15-20 staff).
• Local fire prevention inspection of the building, removal of unnecessary
chemicals, cleaners, HazMat items. Securing of remainder chemicals in
small amounts (cleaning fluids, etc.) under lock-and-key.
• Local government building inspection service conducts building inspection.
• Selection of “green room” for dignitary use (to accommodate 10-12
persons), equipped with several phone line jacks (RJ-11).
• Selection of “meet and greet” room to accommodate 15-20 persons.
Installation of two Closed Circuit Television (CCTV) cameras that provide
feed to recording device in secure area.
• Hours of access to building restricted to day-light hours until after event.
• Commencement of one two-person roving private security patrol around
exterior of building and internal to the building.
• Commencement, by private security, of door lock checks, questioning
strangers in the building, etc.
• Final cleaning arrangements, final custodial chores, “spring cleaning” of
facility to sanitize building for excess debris, unnecessary clutter, etc.
• Walk-thru of building with facility manager to conduct preliminary
inspection of all rooms.

Example of fire inspection
Tasks to be completed 24 hours prior to the event:
• Building temporarily closed. No further in and out traffic from non-visit
staff personnel.
• CCTV cameras installed in main auditorium to provide coverage of exits and
audience. Video feed to secure room with recorders.
• “THIS AREA UNDER VIDEO SURVEILLANCE” signs posted at all
entrances and on stand-alone placards within the building.
• Essential personnel issued special event picture ID badges (5-7 individuals);
such as: facility manager, chief electrician, fire prevention, etc.
• EOD K-9 unit (two-person) begin sweeping floors and offices.
• Four (4) additional private security guards deployed for exterior patrols.
• Two LEO patrol cars deployed near exterior areas.
• Press and media platform deployed to the rear of the auditorium following
sweep of the area.
• Offices locked after EOD K-9 sweep, locks reset allowing only master key
access and denying access to other key holders.

Tasks to be completed 12 hours prior to the event (during daylight hours):
• Guest “chute” barriers deployed.
• Screening area equipment deployed and barriers put in place.
• Magnetometers tested.
• Two (2) private security guards deployed to screening area to observe and
protect all equipment and materials.
• Two (2) two-person EOD teams conduct visual inspection of all areas of the
building for potential IEDs (confirming offices are locked, assessment of
auditorium, evaluation of maintenance areas).
• Spare 440 Kvolt CalTrans type generator deployed in appropriate area to
operate as electrical power back-up.
• Spare magnetometer deployed in the event of malfunction.
• CCTV cameras deployed to provide coverage of screening area.
• AREA UNDER VIDEO SURVELLIANCE signs deployed at appropriate
areas around screening area.
• Deploy two (2) additional private security officers (total of six (6)) for
exterior patrols and door checks.
• Deploy two (2) additional LEO patrol cars (total of four (4)) for exterior
surveillance.
• Test CCTV recording equipment.
• Issue special event badges to all personnel on-site. Conduct roll-call.
Personnel accountability checks.
• Final check of roster of personnel that will be “working” the evnt the
following morning. Verification of availability, alternates, etc.

Tasks to be completed four (4) hours prior t to the event.
• Establish Incident Command Post (use of mobile Sheriff’s Department ICP
[RV type of vehicle]).
• Activate Operations Section (OPS) for Security at ICP. Roll-call of LEO
forces on-site; to include: ten (10) additional LEO patrol vehicles and four
(4) additional foot patrol rovers.
• Radio-checks, operational briefings.
• Activate Fire-Life Safety Manager (FIRE/MEDICAL) within OPS. Deploy
two additional BLS ambulances (one in guest parking, additional BLS rig at
screening area).
• Pre-position fire engine company with team of four (4) fire-
fighters/paramedics (FF/P) at appropriate staging point. Radio checks.
Establish emergency MAYDAY frequency for FIRE/MEDICAL.
• Pre-position HazMat unit in an appropriate area with crew of four FF/Ps.
• Deploy six (6) “port-a-potty” units near the screening area – within secure
zone.
• Deploy four (4) “port-a-potty” units in the guest parking lot.
• Deploy two-person sniper team on highest point (building adjacent to event
venue); radio-checks, roll-call.
• Additional EOD K-9 sweep of all building areas.
• Building is placed in “lock down” status. All entrances closed except
screening area. Eight (8) additional private security officers position to the
exterior of locked door entrances.
• Deploy four (4) bike patrol LEOs to begin exterior perimeter surveillance
and continuous loop of inspection.
• Issuance of event ID credentials to all appropriate staff near badging staging
at screening area.
• Activation of City Emergency Operations Center (EOC) with four (4)
support staff to coordinate with LEO and FIRE/MEDICAL.
• Deploy two (2) Wildland radio cache tactical repeater at highest building
location.
• Distribute Wildland radio cache King/Bendix radios to all personnel.

Example of Incident Command Post
Example of Operational Briefing

Example of Tactical Repeater
Tasks two (2) hours prior to the event:
• Roll-call, equipment check, radio checks, personnel accountability.
• Additional EOD K-9 sweep of exterior of the building.
• Staffing of areas (greeters, screening, guest chute, ID badge check).
• Issuance of color-code vests to private security, screeners, etc.
• Open guest parking lot, staff with eight (8) parking lot attendants; attendants
to remind guests to leave all personal articles in their automobiles.
• Impose Temporary Flight Restriction to 2,000 feet; Civil Air Patrol (CAP)
begins a 5-mile loop pattern over the event at 1,000 feet with radio contact to
ICP.
• Deploy rope lines and press/media barriers in auditorium.
• Allow press/media to begin deployment of cameras, audio feeds, etc.

Tasks one (1) hour prior to the event:
• Medivac helicopter at nearest hospital goes into hot stand-by mode,
establishing radio communications with ICP (pre-arranged).
• BLS ambulance rig-to-hospital VHF radio checks.
• Two (2) LEO patrol units deployed to Emergency Department (ED) of
nearest designated hospital (pre-arranged).
• Trauma ED teams goes into hot stand-by mode; surgical team in ED (pre-
arranged).
• Hospital security establishes barrier tape and cone entrances to ED.
• Hospital deploys four (4) additional private security officers to ED.
• Hospital activates Incident Command center and emergency operations plan
(can receive credit for drill activation).
• Hospital establishes contact with City EOC and ICP.
• City EOC establishes contact with designated nearest Federal Aviation
Administration radar control point to verify clear traffic pattern.
• Pre-arranged for local tower at FAA controlled executive airport to halt all
take-offs and divert all incoming aircraft at 9:45 am.
• ICP provides City EOC with status update from CAP every ten (10)
minutes.
• EOD K-9 team joins additional EOD K-9 team at screening area.
• Guests arriving, walking to screening area, under observation for behavior
anomalies (behavioral screening).
• Final check of “green room”, “meet and greet room”, “press and media
area”.
• Press arrive, credentials checked, equipment inspected, begin set-up at press
platform.
• Guests begin to pass thru magnetometers, receive pat-downs and wanding.
• Prior to auditorium entry: rope lines deployed, final visual inspection, re-
deployment of six (6) LEOs to the auditorium.
• Reployment of two (2) LEOs to the “green” room.
• Reployment of two (2) LEOs to “meet and greet” room.

PROTECTEE ARRIVES

END OF DOCUMENT

Blending risk analysis with executive protection

Recommended

Recommended

More Related Content

What's hot

What's hot (15)

Similar to Blending risk analysis with executive protection

Similar to Blending risk analysis with executive protection (20)

More from David Sweigert

More from David Sweigert (20)

Recently uploaded

Recently uploaded (20)

Blending risk analysis with executive protection