Practical Advice

Organizations need to take a variety of steps to prepare for worst-case scenarios

• By Jana Rankin
• September 01, 2017

JUST A FEW MONTHS AGO MARKED THE 10-YEAR ANNIVERSARY OF THE SHOOTING MASSACRE AT VIRGINIA TECH. ON APRIL 16, 2007, 23-YEAR-OLD STUDENT SEUNG HUI CHO SHOT AND KILLED 32 PEOPLE AND WOUNDED 17 OTHERS BEFORE KILLING HIMSELF. THE INCIDENT, WHICH RANKS AS ONE OF THE DEADLIEST MASS SHOOTINGS IN U.S. HISTORY, WILL ALWAYS SERVE AS A REMINDER TO SECURITY AND LAW ENFORCEMENT PROFESSIONALS ABOUT THE IMPORTANCE OF HAVING WELL-CRAFTED, DETAILED AND PRACTICED INCIDENT MANAGEMENT AND EMERGENCY RESPONSE PLANS IN PLACE ON CAMPUSES.

A report of the incident commissioned by former Virginia Gov. Tim Kaine found significant breakdowns in communication between the university and the campus community. For example, the report noted that university administrators failed to send out a campus-wide notification about a pair of homicides committed by Cho at the West Ambler Johnston residence hall, which preceded the mass shootings at Norris Hall, until nearly two hours after the fact. It also stated that “university practice may have conflicted with written policies,” which is a classic problem with many incident response plans in place today.

Oftentimes, an organization or school will create a plan and just file it away on a shelf to collect dust. If a plan isn’t regularly reviewed and practiced, then when it comes time to deal with an actual emergency— severe weather, a health scare or an active shooter—the chances for loss of life and injuries are higher.

But, what are the hallmarks of a good incident management and emergency plan? Discussed below are several key considerations that every organization, both public and private, should take into account when developing these plans, and how to ensure the guidance they provide remains timely and relevant.

COMMUNICATION IS KEY

As evidenced by Virginia Tech and numerous other tragedies, communication should be the first and foremost consideration in the creation of any emergency response plan. Internal communication between an organization and their employees or a school and their teachers and students should take precedent, followed by external communication with law enforcement and other first responders.

It sounds simple enough, but there are numerous questions that must be asked and answered to ensure that accurate and timely information is communicated during an emergency situation. Some of these include:

• What channels will be used for emergency communications? This used to be a more straightforward proposition than it is today. Mass notification solutions give organizations the ability to send out both standardized and custom messages through a variety of methods— text, email, etc.—with the push of a button. The way people consume information is always changing, and the advent of social media has thrown an additional layer of complexity into the mix. While a text may work best for one person, sending a Tweet may be just as effective to another. Change to an email or digital signage can reach more individuals. Try to adopt a strategy that is as comprehensive as possible and fits the needs of your particular situation.
• Who is responsible for communicating with both internal and external stakeholders during an emergency? There needs to be a clearly defined chain of command within every organization as to who should be responsible for communicating with each group of stakeholders (employees, first responders, etc.) and how they are going to communicate with them. There should also be backups to fulfill these duties in case one or more people are out at given time.
• How do we want to tailor communications for different situations? Because each emergency event is different, response protocols can vary. How a bomb threat is handled within a facility is obviously much different than an active shooter. As such, the messages and their content that people receive need to reflect to proper procedures to follow for a given situation.

ADDRESSING EXTERNAL STAKEHOLDERS

Communication with external stakeholders, such as the relatives of employees and students, is also paramount and can help organizations and schools mitigate the potential of a situation from going bad to worse. In the aftermath of the recent murder-suicide at North Park Elementary School in San Bernardino, Calif., parents fearing for their children’s lives began flocking to the school while it was still an active scene. This type of behavior not only puts the lives of parents at risk, but it also poses a distraction for law enforcement who must make sure the threat is neutralized.

One way to avoid having a repeat of this situation is to get out ahead of it and send out a mass notification—text, social media change to voice broadcast call, email, etc.—apprising these stakeholders of the situation to the best extent possible and letting them know that it’s not safe to come to the facility. Designating a location beforehand that people can go to during a crisis in the area nearby and communicating that in the same message is another good way to avoid having throngs of panicked people show up on your doorstep at the worst possible time.

INVOLVING FIRST RESPONDERS IN EMERGENCY PLANNING

It almost goes without saying but it is paramount that first responders, namely local law enforcement and fire department officials, should be involved in the incident management planning process for any organization. Not only do they need to understand what the specific emergency messaging and evacuation protocols are of a particular business or institution, but they also need to be familiarized with the ins and outs of facilities themselves. Knowing the various points of ingress and egress, locations of security cameras, and so forth will help them respond better at a moment’s notice.

Failing to keep first responders in this decision- making loop or providing them with updated contact information for the principals can have disastrous consequences. Just take the aforementioned report on the Virginia Tech shooting, for example. It noted that police were not adequately involved in the decision-making process. The report stated:

“The emergency response plan of Virginia Tech was deficient in several respects. It did not include provisions for a shooting scenario and did not place police high enough in the emergency decision-making hierarchy. It also did not include a threat assessment team. And the plan was out of date on April 16; for example, it had the wrong name for the police chief and some other officials.

“The protocol for sending an emergency message in use on April 16 was cumbersome, untimely, and problematic when a decision was needed as soon as possible. The police did not have the capability to send an emergency alert message on their own. The police had to await the deliberations of the Policy Group, of which they are not a member, even when minutes count. The Policy Group had to be convened to decide whether to send a message to the university community and to structure its content.”

Another critical aspect that can help first responders in a worst-case scenario is making maps and other diagrams of campuses available. Even if an organization is in sync with public safety leaders in the planning process, those officers and firefighters first arriving at a scene may not know where to respond. The ability to quickly access a building layout is essential for saving lives when seconds count.

PRACTICE, PRACTICE, PRACTICE

No matter how robust an organization’s plans might be in dealing with a variety of disasters, they are virtually worthless if they are never practiced. In addition to holding at least two internal tabletop training exercises per year covering all possible scenarios, organizations should try to hold one major response tabletop or full-scale exercise that incorporates public safety personnel.

Tabletop exercises simulate a real-life event, complete with stressors that can be replicated over and over. It forces people to think on their toes and revert back to established protocols in order to take the next step of the training event. There may even be some issues brought to forefront as a result of holding the exercise that no one was aware of previously. Organizations that conduct tabletops are generally able to respond better during an actual emergency because their plans have been tested and employees or students have practiced how to respond.

Additionally, holding regular drills, say for sheltering in place during severe weather or for fire evacuations, should take place at least once a month. This takes little time, can be very basic in nature, and keeps folks aware of where they need go in the event of an actual emergency.

LEVERAGE NEW TECHNOLOGIES

Technology continues to shape every industry and security is no exception. As the development of mass notification and other emergency communication systems continues to evolve, being able to utilize the newest systems and devices will only help organizations improve their response during emergencies of all types. The capability to track and locate all people on a given campus in real time by simply using smartphones and then integrate that information with existing access control, video surveillance and other security systems installed within a facility is available today.

Putting this type of data at the fingertips of first responders will undoubtedly save lives in the future. Every organization owes it to their stakeholders to explore these technologies, learn how they can put them to use in their own facilities and mitigate against potential tragedies down the line.

President Dwight D. Eisenhower was once quoted as saying “plans are useless, but planning is indispensable.” Truer words have never been spoken when it comes to developing and implementing emergency response protocols.

This article originally appeared in the September 2017 issue of Campus Security Today.