Security Failures
Security is a management problem.
Management means people, of course, and not technology. However, most people planning for their physical security view security as a technology problem: locks, cameras, alarms, and detection equipment. This sets up a dangerous situation in which the illusion of security may defeat the actual systems in place to protect people and assets.
A graduate school requested a security system design, which included a full contingent of cameras and access control readers. Money was tight for this small school, and the requested system would easily cost hundreds of thousands of dollars.
They asked “So this security system will make our security problems go away?”
What problems were they having?
“Well, nothing serious so far. We’ve had a couple of people trespass onto campus looking for a place to sleep, but no one’s been hurt. But we’re worried the next time won’t be so simple. And theft: we worry about someone stealing the laptops.”
How do they respond today to these threats?
“We don’t, really. Usually the students warn us that someone or something is wrong. And we send Jerry down to check on anyone who’s in after hours.”
Who is Jerry?
“Jerry is the librarian. He works until eight o’clock sometimes.”
Who responds after eight o’clock?
“No one.”
Who will be responding to the alarm systems in the new design?
“Jerry. But we might ask some of the grad students to help.”
Will they have access to the server, or be on email around the clock?
“No, they have classes. And no one should have access to the server unless they work here.”
So your proposed security program consists of a librarian who sometimes works until eight, and grad students who have no access and no reliable means of being notified about any security event? Who will cover the system the other twelve hours a day, and on weekends?
“That’s why we’re putting in all this equipment.”
You are putting in a lot of expensive equipment that will have no one watching or responding.
“That’s why we need to spend that money. This will make our security problems go away.”
The above is a true conversation, and reveals much about the chances this new security system will work for them. In effect, the security system will be a monumental waste of money for a cash-strapped school. These folks seriously expected that spending money on a security system would make their problems go away. The problems in fact would remain exactly as they were. They would merely have much less money at the end of the year.
No one was watching the cameras. Could a camera be equipped to signal an alarm when someone moves through an area after hours? Could an access control reader send an alert that a campus stranger slipped through the door? Yes; but no one was available to respond to e-mail alarms for most of the week. Students would blissfully go to and from classes, thinking that someone, somewhere was watching out for their safety. And no one was.
When a security event happens at a school, it usually makes national headlines (especially if someone is hurt or killed). The usual response after a tragic event is to spend millions of dollars on cameras and access control systems; but there are rarely any corresponding changes in security management, responsibilities, or auditing. This of course means that millions of dollars (often taxpayer money) is essentially wasted.
Fortunately, school tragedies are quite rare. However, schools are not the only organizations which suffer from this approach. Thousands of businesses invest in security systems that are under-utilized or indeed non-utilized, often with equally but more frequently tragic results. Ironically, businesses with an interest in protecting assets (such as retail stores and casinos) do a better job of managing security issues by active review of cameras, and intervention before a crime is committed. The irony is that the people putting assets and profit first actually do a better job of protecting people than those organizations who purport to need security to protect people.
Do not trust security. Do not assume that a camera is watching you, or that someone will respond in time. Even if staff or employees detect that you are in danger, they may have no procedures or training on how to respond. Although surrounded by cameras, readers, detectors, and alarms, you may be all alone to fend for yourself. If help arrives, consider yourself lucky. If not, consider yourself warned.