Security 101: A Physical Security Primer for Transportation Agencies (2009)

Below is the uncorrected machine-read text of this chapter, intended to provide our own search engines and external engines with highly rich, chapter-representative searchable text of each book. Because it is UNCORRECTED material, please consider the following text as a useful but insufficient proxy for the authoritative book pages.

27 Consistent with effective security planning is the need to deploy appropriate risk reduction methods to minimize or eliminate identified vulnerabilities or mitigating consequences. Chapter 3 discusses many of the tools and countermeasures that should be considered in the implementation phase of planning as a means to improve the security of critical infrastruc- ture and facilities, information systems, and other areas. Physical security countermeasures include signs; emergency telephones, duress alarms, and assistance stations; key controls and locks; protective barriers; protective lighting; alarm and intrusion detection systems; electronic access control systems; and surveillance systems and monitoring. What countermeasures to use in any given situation depends on what will be most useful, that is the utility of the countermeasure. Transportation agencies must examine the threats against the organization and identify the most useful means to reduce the vulnerabilities associated with those threats to acceptable levels. Utility is not solely a measure of cost. Often less costly, but more effec- tive solutions are available that the agency can select to meet security requirements. In making these choices, security designers can benefit from the use of a utility scale that assimilates and compares one countermeasure against the other. For example, Figure 3-1 shows security countermeasures along a sliding scale based on three utility factors—protection provided, cost, and effort required. Countermeasures appear on the scale moving from “Less Protection, Less Cost and Less Effort to Greater Protection, Greater Cost, and Greater Effort.” The figure does not provide relative com- parisons of the three utility factors, but does provide them for each of the factors individually. Once the utility of specific countermeasures has been evaluated, the agency should return to the concepts of systems approach, layered security, and systems integration (as discussed in Chapter 2 and illustrated in Figure 3-2) when deciding how to proceed in reducing security vul- nerabilities. Certain security design techniques or technologies are well suited to serve as “solu- tion sets,” capable of fulfilling security needs. Signs A rule of warfare that applies to homeland defense is that neither fences nor signs will deter or stop a determined enemy. However, security signs can play a very important role in the secur- ing of transportation facilities, rights-of-way, and critical infrastructure. Security signs are rela- tively inexpensive and low maintenance and can help deter aggressor actions or tactics. Maintenance of a good security sign program also helps to create a working environment in which security is perceived to be taken seriously. Employees become aware of security requirements through well-placed signs that display the status of restricted or controlled areas or signs that limit or prohibit certain activities. The signs depicted in Figure 3-3 are approved by OSHA for use in the workplace. They represent a cross-section of security designs that cover both of these categories. C H A P T E R 3 Physical Security Countermeasures

28 Security 101: A Physical Security Primer for Transportation Agencies Less Protection Less Cost Less Effort Greater Protection Greater Cost Greater Effort Place trash receptacles as far away from the building as possible. Remove any dense vegetation that may screen covert activity. Use thorn-bearing plant materials to create natural barriers. Identify all critical resources in the area (fire and police stations, hospitals, etc.). Identify all potentially hazardous facilities in the area (nuclear plants, chemical labs, etc.). Use temporary passive barriers to eliminate straight-line vehicular access to high-risk buildings. Use vehicles as temporary physical barriers during elevated threat conditions. Make proper use of signs for traffic control, building entry control, etc. Minimize signs identifying high-risk areas. Identify, secure, and control access to all utility services to the building. Limit and control access to all crawl spaces, utility tunnels, and other means of under building access to prevent the planting of explosives. Utilize Geographic Information Systems (GIS) to assess adjacent land use. Provide open space inside the fence along the perimeter. Locate fuel storage tanks at least 100 feet from all buildings. Block sight lines through building orientation, landscaping, screening, and landforms. Use temporary and procedural measures to restrict parking and increase stand-off. Locate and consolidate high-risk land uses in the interior of the site. Select and design barriers based on threat levels. Maintain as much stand-off distance as possible from potential vehicle bombs. Separate redundant utility systems. Conduct periodic water testing to detect waterborne contaminants. Enclose the perimeter of the site. Create a single controlled entrance for vehicles (entry control point). Establish law enforcement or security force presence. Install quick connects for portable utility backup systems. Install security lighting. Install closed circuit television cameras. Mount all equipment to resist forces in any direction. Include security and protection measures in the calculation of land area requirements. Design and construct parking to provide adequate stand-off for vehicle bombs. Position buildings to permit occupants and security personnel to monitor the site. Do not site the building adjacent to potential threats or hazards. Locate critical building components away from the main entrance, vehicle circulation, parking, or maintenance area. Harden as appropriate. Provide a site-wide public address system and emergency call boxes at readily identified locations. Prohibit parking beneath or within a building. Design and construct access points at an angle to oncoming streets. Designate entry points for commercial and delivery vehicles away from high-risk areas. In urban areas, push the perimeter out to the edge of the sidewalk by means of bollards, planters, and other obstacles. For better stand-off, push the line farther outward by restricting or eliminating parking along the curb, eliminating loading zones, or through street closings. Provide intrusion detection sensors for all utility services to the building. Provide redundant utility systems to support security, life safety, and rescue functions. Conceal and/or harden incoming utility systems. Install active vehicle crash barriers. Source: FEMA 430, Building, Site and Layout Design Guidance to Mitigate Potential Terrorist Attacks, 2007 Figure 3-1. Countermeasures scale by protection, cost, effect.

Physical Security Countermeasures 29 Source: FTA Security Design Considerations, 2004 Figure 3-2. Layers of security. Source: http://www.safetysign.com Figure 3-3. Security signs.

30 Security 101: A Physical Security Primer for Transportation Agencies Effective use of signs starts with creation of a sign plan. This written record provides a frame- work for decisionmaking about the installation, replacement, maintenance, and budgeting for the program. The sign plan identifies each sign by type and legend and contains a site plan for placement and installation. In 2006, the U.S. Army Corps of Engineers updated its Sign Standards Manual EP 310-1-6a and EP 310-1-6b. The manual’s Checklist of Sign Plan Elements shows the steps necessary to implement an effective sign plan. The checklist includes • Inventory existing signs and their condition; • Collect or develop up-to-date pictorials, maps (optimally supported by GIS), diagrams, blue- prints, or other representation of the area in need of protecting; • Prepare the site plan and sign layout materials; and • Implement the plan in conformance with established guidelines. Once the implementation plan has been accomplished, a sign inspection and maintenance schedule should be developed. A budgeted coordinated sign replacement and maintenance schedule is necessary to reinforce the message to transportation system users, employees, and the public that the agency prioritizes security on its properties and facilities. Missing signs defeat the objectives of the security plan layout while damaged or vandalized security signs reflect badly on the agency’s commitment to security. The Corps of Engineers recommends a formal inspec- tion of security signs semi-annually. The inspection should identify signs requiring maintenance or replacement, signs that can be eliminated, and the need for additional signs. Vandalized, dam- aged, or missing signs should be repaired or replaced as quickly as possible. Emergency Telephones, Duress Alarms, and Assistance Stations Historically, emergency alert or alarm systems have been hardwired communications systems linked to security control centers. Telephone boxes, panic alarm buttons, and intercom systems typically were linked to central stations where dispatchers or monitoring personnel answered emergency calls and sent response personnel to the location to help. Today, wireless technology has added new dimensions and capabilities for the security-related use of these systems. For example, The State Transit Authority of Australia has a fleet of 1,800 buses in the Sydney and Newcastle area. Every bus is outfitted with Automatic Vehicle Locator (AVL) technology, a “Driver Duress Alarm,” and a microphone that allows Authority central station personnel to hear what is happening on the vehicle when the driver activates the system. Technology has also expanded the recipient group for duress alarms to include first respon- ders themselves who can be equipped to receive a location-specific pre-recorded voice message using the officer’s existing two-way radios. These systems by eliminating the monitoring station go-between can greatly improve the response time for police or security personnel in the event of a security incident. Information can be sent close to simultaneously to the command center by digital data packet transmittal. Because of the high costs that can be associated with responding to duress alarms, transporta- tion agencies should consider using emergency alert alarm systems to conduct a thorough risk assessment to correctly establish the size and scope of the project. Once the needs assessment has been completed, the best way to accomplish the countermeasures analysis is to engineer back- wards from the response. Taking into account variables (e.g., time, distance, day of the week, and changes in staffing levels), police or security officer response capabilities, whether self-directed or through dispatch, should be examined to determine just how quickly help can arrive on the scene.

Physical Security Countermeasures 31 Next, prospective communications access points for deployment of emergency alert or alarm systems should be compared with estimated response capabilities, keeping in mind the poten- tial time variation and, where applicable, the routes and locations of agency rolling stock. If addi- tional security assets are required to make the system viable, they should be designed and planned for prior to implementation. A duress alarm or emergency communication system that often goes unanswered for an extended or unreasonable length of time creates an untenable security operating condition and should be avoided. Under such circumstances, alternative security countermeasures should be selected. Key Control and Locks It has been said that security starts and ends with closing the door and locking it. But the most expensive and well-built locking mechanism can be defeated if sufficient skill and enough time are available to the adversary or aggressor. According to the US Army Field Manual 19-30, Chap- ter 8, most key locks and conventional combination locks can be picked by an expert in a mat- ter of minutes. More sophisticated manipulation-resistant locks, locks with four or more tumblers, some interchangeable core systems, or relocking devices on safes or doors can provide an appreciable increase in difficulty, but are still subject to compromise. Locks should be considered at best to be a deterrent and more plausibly as a delay device that does not completely restrict entry to a protected area. Locks are a widely used basic security countermeasure for protecting facilities, activities, personnel, and property. They are present not only on doors, but on windows, gates, conveyances, interior offices, supply areas, filing cabinets, and virtually all kinds of other storage containers or areas as well. Locking hardware is designed to various levels of deterrence or entry delay. Performance stan- dards for locks based on these capabilities exist through ANSI/BHMAA Series 156 and United Laboratories (UL) 1034, 437, 768,294, 2058 and 305. It is recommended that the agency consult with a professional locksmith for mechanical locks or security professional for electromechani- cal or electromagnetic locks before spending security funding on new hardware or upgrades. Because keys and locks frequently are the only countermeasure used to protect assets and infrastructure, managing key access is fundamental to effective control. Maintaining a good key control system can mean the difference between having a robust security program and a com- promised unsecure operating environment. The starting point for establishing an effective key control program is to develop a sound workable policy. The policy must be requirements-based and commensurate with the necessary levels of protection appropriate for the location or set- ting. Obtaining user input into the design of the key control system can help later when main- taining discipline associated with the system is important. Management of the system should be assigned to an individual designated as the Key Control Officer (KCO). This individual should ensure the integrity of the key control process by • Exercising approval authority over the acquisition and storage of all locks and keys, • Overseeing the distribution of keys to agency employees, • Conducting inspections and inventories, • Maintaining the organization’s key depository, • Investigating key loss, and • Establishing an official records maintenance system that serves as the control point for all agency key and lock activity. Frequently, an organization will face a situation in which key control has been compromised, either through a lack of attention to security or by the failure of one or more employees to com- ply with policy. When current conditions demand the system and process be revised, the agency

32 Security 101: A Physical Security Primer for Transportation Agencies should create a key control annex to their physical security plan. The newly assigned KCO should conduct a comprehensive survey of all agency physical assets needing protection to establish a baseline key control plan that can return efficiency to the program. Under this program, when a compromised key access point is identified, locks should be replaced, recoded, or otherwise upgraded as a security plan priority. Protective Barriers Protective barriers include fencing, other types of barriers, and landscape design. Each of these three categories will be discussed. Fencing The two main issues with the use of fencing as a protective barrier are • Placement and • The grade or strength of fencing materiel. Substituting other types of protective barriers where fencing traditionally has been used should be considered. The transportation agency should look at the design aspects of both place- ment and strength of materiel in concert to determine how the use of fencing countermeasures can reduce risk. Placement The chief use of fencing for security is as a deterrent or delaying factor. When fencing is used this way, terms such as perimeter line and controlled access zone apply. The perimeter line is the outermost line of defense for an area being protected. A controlled access zone attempts to limit access to the more immediate area being protected. The uses of fencing in these configurations are clear. For example, a fence can be used to form the outermost perimeter line. Fencing (or more generally protective barriers) used in conjunc- tion with layered defense principles offers a much broader range of security applications. FEMA 430, Site and Urban Design for Security presents a three-layer model for protecting a building against attack. Under this approach, the objective is to “create a defense in depth by creating cumulative successive obstacles that must be penetrated . . . penetration of the perimeter leads only to further defense systems that must be overcome.” Figure 3-4 illustrates the use of fencing as a security countermeasure in conjunction with the first and second defensive layers. In this configuration, the greater the distance between the building exterior and the perimeter line, the better. This “open space” concept of security per- mits designers to use an array of different security countermeasures to defend the organization’s assets, including line of sight observation, video surveillance, motion detection, and other intru- sion detection technologies. Material Security planners can use fencing to prevent as well as deter. Depending on the deployment and K Certification class of fencing material, certain aggressor tactics can be completely defeated. Primarily, threats that can be prevented relate to explosives mitigation and involve barrier- related interception of the threat at a point that creates sufficient stand-off distance to absorb dangerous explosive blast levels. K Certification anti-ram standards originated at the Depart- ment of State. The rating is determined from perpendicular barrier impact results of a truck weighing 15,000 lb (6810 kg) striking the barrier straight on. To meet the standard, the truck’s cargo bed cannot penetrate the barrier by more than 1 meter. Figure 3-5 provides additional

Source: FEMA 430, Building, Site and Layout Design Guidance to Mitigate Potential Terrorist Attacks, 2007 Figure 3-4. Use of fencing as a security countermeasure with defensive layers. Certification Class Speed (mph) Speed (kph) K12 50 80 K8 40 65 K4 30 48 (a) (b) Figure 3-5. Vehicle and crash ratings (a) and truck striking barrier (b).

34 Security 101: A Physical Security Primer for Transportation Agencies information about the vehicle and crash ratings associated with the truck striking the barriers at speeds of 30, 40, and 50 mph. Figure 3-6 shows a crash-rated fence that, according to the manu- facturer, can be reinforced with an integrated cable system to meet K8 standards. Figure 3-7 shows a cable barrier that can be used for fencing reinforcement. Protective Barriers Fences are one type of protective barrier available to security designers. Other types of barri- ers include anti-ram vehicle barriers categorized as either passive or active. Anti-ram barrier effectiveness is based on a formula: Where M is the mass of the vehicle and v is the velocity at the time of impact. Passive barriers are fixed countermeasures and include bollards (concrete-filled steel pipe), reinforced street furniture, concrete walls, planters, and berms (see Figure 3-8). Active barriers are movable or retractable in some way so as to allow passage when needed. Such barriers can include retractable bollards, crash beams, rotating wedge systems, or rising barricades as shown in Figures 3-9 through 3-11. Landscape Design Natural barriers, such as trees or water, can be used to reduce vulnerabilities. In addition, actual site planning for protected areas can be security minded with landscape design serving the dual purposes of aesthetics and function (see Figure 3-12). KE Mv Building Design for H = 2 2 Source: FEMA 426, omeland Security, 2004 Source: FEMA 430, Building, Site and Layout Design Guidance to Mitigate Potential Terrorist Attacks, 2007 Figure 3-6. Crash-rated fence.

Physical Security Countermeasures 35 Source: FEMA 430, Building, Site and Layout Design Guidance to Mitigate Potential Terrorist Attacks, 2007 Top: Combination of low retaining walls and low bollards. Bottom, left: Combination of oversize bollard and large planters placed on very wide sidewalk. Bottom, right: Combination of tree and bollards. Figure 3-8. Barriers as countermeasures. Protective Lighting Security professionals, emergency response personnel, and safety practitioners extol the value of manufactured light to protect people and property from harm or unreasonable risk of injury. Used as a security countermeasure during hours of darkness, protective lighting can create an operating environment that provides better security than in the daytime. This can occur when Source: DOD Handbook: Selection and Application of Vehicle Barriers, MIL_HDBK: 1013/14, 1999 Figure 3-7. Cable barrier deployable as a means for fencing reinforcement.

Source: FEMA 430, Building, Site and Layout Design Guidance to Mitigate Potential Terrorist Attacks, 2007 Figure 3-9. Examples of retractable bollards and crash beams. Source: FEMA 430, Building, Site and Layout Design Guidance to Mitigate Potential Terrorist Attacks, 2007 Figure 3-11. Rising barricade. Source: FEMA 430, Building, Site and Layout Design Guidance to Mitigate Potential Terrorist Attacks, 2007 Figure 3-10. Mobile wedge barrier.

Physical Security Countermeasures 37 security designers use capabilities such as glare projection to reduce the ability of an adversary to see inside a protected area. Protective lighting objectives include the following: • Adherence to acceptable industry standards for outdoor protective lighting levels as promul- gated by the Illuminated Engineering Society of North America (IESNA) or the guidelines of the New Buildings Institute’s Advanced Lighting Guidelines, 2003 Edition; • Illumination of all exterior points within the perimeter of the protected area, including walk- ways, vehicle entranceways, fence lines, and critical structures or assets; • Non-transgressing illumination of approach areas to the perimeter line; • Deterrence of aggressor attempts at entry to protected areas; • Support for other security countermeasures (e.g., video surveillance cameras, motion-activated sensors, or security forces); and • Resistance to tampering, vandalism, neutralization, or defeat. As with other measures, protective lighting security planning requires thoughtful and careful study to make the most of the benefits of the program. In particular, because of the open access of the environment, prospective dual-use aspects of lighting should be examined for potential integration into mainstream transportation operations. Similarly, the security applicability of agency lighting configurations should be factored into operational planning and decisionmaking. Planners should also determine the upgrade prospects of the existing lighting system. Taking advantage of opportunities to retrofit existing lighting systems (luminaries) can improve light- ing quality, reduce electricity use, and extend time between required maintenance and replace- ment, while providing benefits such as improved security or safety. In this regard, although relatively inexpensive when compared with other security strate- gies, lighting plans also require a strong continuing commitment to maintenance and upkeep. Source: Michael Van Vandenburgh and Associates This proposal for the re-design of the Washington Monument grounds uses water to create a barrier. The meandering canal is beautiful as well as functional. Figure 3-12. Proposal for the re-design of the Washington Monument grounds.

38 Security 101: A Physical Security Primer for Transportation Agencies Agencies must budget for scheduled cleaning and replacement of luminaries. Different types of lighting systems can reduce the overall costs associated with upkeep while improving the efficiency of the lighting output, measured luminance (footcandles or lux). Lamps Three principal sources of light are in common use: • Incandescent lamps, • Fluorescent lamps and, • High-intensity discharge (HID) lamps. All three types convert electrical energy to light or radiant energy. Table 3-1 compares the three types of lamp categories. Luminaries Luminaries (consisting of a complete lighting unit, lamp, housing, and power supply connec- tivity) are categorized as follows: • Floodlights, • Streetlights, • Fresnel lenses, and • Searchlights. Table 3-2 provides a comparison of these categories. Alarm and Intrusion Detection Systems Alarms can detect various types of incidents (e.g., intrusion, smoke or fire, temperature change, gas, or water flow rates), as well as other emergency conditions. Their basic physical secu- rity application, however, relates principally to intrusion detection. The functionality also applies to chemical, biological, and radiological sensors, although they are more complex depending on the technology associated with the types of sensors. Intrusion detection alarm systems are an important countermeasure in the security planning toolkit. Their main purpose is to work as a force multiplier to allow for more efficient use of staffing by reducing the number of security personnel required to patrol or monitor a protected area. Assuming that a response force is nearby, alarm systems can eliminate the need for a ded- icated security patrol force. Type Life (in hrs) Efficiency* Advantages** Disadvantages** efiltrohsylevitaleRevisnepxenI22–710004–005tnecsednacnI Fluorescent 9,000 – 17,000 67 – 100 Longer life than incandescent and metal halide Shorter life than mercury vapor and HPS HID Mercury Vapor Metal Halide HPS 24,000+ 6,000 24,000 31 – 63 80 – 115 80 – 140 Longest life. Good efficiency More efficient than mercury vapor Long life and excellent efficiency *in lumens per watt ** compared with other lamps (Source: Adapted from NFPA 730 Guide for Premises Security, 2006) May not be optimal in conditions where full illumination is required immediately on activation. Depending on the type of lamp—mercury vapor, metal halide, or high-pressure sodium (HPS), the time required for HID lamps to reach full light output can range from 3 to 7 minutes. Re-strike times (cooling time required before the lamp will re-start) can be even longer— ranging from 3 to 15 minutes. Table 3-1. Lamp types.

Physical Security Countermeasures 39 Alarm systems can be used • In place of other security countermeasures that are not viable because of safety concerns or operational requirements or • As a supplemental security measure. The main elements of an intrusion detection alarm system are the sensors, the alarm proces- sor, the monitoring system, and the communications architecture that connects these elements. The components of an alarm system include the following: • Main Control Unit, • Keypad, • Input Devices (Sensors), • Transformer, • Power Supply, • Telecommunications, and • Output Devices. An alarm system can be hard wired (the system uses wires to connect all input and output devices to the main control unit) or wireless (the system uses radio waves or RF to transmit intru- sion alarms). Some systems, known as hybrids, use a combination of both hard-wired and wire- less signal carrying methods to communicate intrusion or status. Thephysicalsecuritydeploymentof intrusiondetectionsystemsusuallyoccurswithother security countermeasures such as natural and manmade barriers, access control systems, and other sensor technologies.Foranintrusiondetectionalarm system to be effective, there must be both an active or passive monitoring capability and a security or law enforcement personnel response team capacity. Sensors are the input devices for intrusion detection systems. Intrusion sensors can be either interior or exterior as illustrated by Figures 3-13 and 3-14. Interior sensors detect intruders • Approaching or penetrating a secured boundary (e.g., a door, wall, roof, floor, vent, or window); • Moving within a secured area (e.g., a room or hallway); and • Moving, lifting, or touching a particular object. desUspmaLnoitpircseDsesopruPepyT Floodlight To project to distant points To illuminate perimeter fence lines, critical facilities, and high-priority assets tnecsednacnI HID ropavyrucreM.syawecnartnednasaeraegraletanimullioTthgilteertS Fresnel lens To protect high-security locations where transgressing light will not affect the neighboring community Directional high-glare units that project a fan-shaped light beam approximately 180 degrees in the horizontal and 15 to 30 degrees in the vertical Searchlight To augment fixed lighting at a given location Incandescent Incandescent HID Designed with a focused beam width that can be projected to distant points, thereby illuminating a specified area or location. Use in homeland defense is vital. Used to illuminate perimeter fence lines, boundaries, critical facilities, and high-priority assets. Used to illuminate large areas. Their light distribu- tion patterns can be either symmetrical or asym- metrical. Symmetrical street light luminaries are placed in locations that will cascade light through- out the area to be covered. Asymmetrical street lights direct light by reflection or refraction into the area to be lighted. Mercury vapor lamps are widely used in street lighting because of their long life. Provides a powerful concentrated beam. Ranges from 12 to 24 inches in diameter of reflection and from 250 to 3,000 watts. Often portable Table 3-2. Comparison of lights.

40 Security 101: A Physical Security Primer for Transportation Agencies EXTERIOR SENSORS AREA DETECTORS AQUATICPERIMETER LINE SENSORS INGROUND SENSORS VOLUMETRIC SENSORS VIDEO SENSORS UNDERWATER OVERWATER •BALANCED MAGNETIC SWITCHES (Gate) •VIBRATION •TAUT WIRE •FIBER OPTIC •STRAIN SENSITIVE CABLE •ELECTROSTATIC FIELD •BURIED PRESSURE LINE •PORTED COAX BURIED LINE •FIBER OPTIC •GEOPHONE •MAGNETIC •ACTIVE INFRARED •MICROWAVE •PASSIVE INFRARED •PASSIVE INFRARED/ MICROWAVE •RADAR •LASER RADAR •VIDEO MOTION DETECTION •SONAR •FIBER OPTIC •RADAR •VIDEO MOTION DETECTION Source: SAVER Summary; Handbook of Intrusion Detection Sensors, 2004 http://www.dhs-saver.info Figure 3-13. Exterior intrusion sensors—applications index. INTERIOR SENSORS WALL/ CEILING/ VAULT HALLWAY/ ROOMWINDOW • BALANCED MAGNETIC SWITCHES • GLASSBREAK • BALANCED MAGNETIC SWITCH • FIBER OPTIC • STRAIN SENSITIVE CABLE • VOLUMETRIC SENSORS – MICROWAVE – PASSIVE INFRARED – PASSIVE INFRARED/ MICROWAVE – AUDIO • BEAM SENSORS – ACTIVE INFRARED • VIDEO MOTION DETECTION DOOR • STRUCTURAL VIBRATION Source: SAVER Summary; Handbook of Intrusion Detection Sensors, 2004 http://www.dhs-saver.info Figure 3-14. Interior intrusion sensors—applications index. Exterior sensors detect intruders crossing a perimeter or boundary or entering a protected zone. Although many interior sensors should not be exposed to weather, exterior sensors must be able to withstand outdoor weather conditions. Exterior sensors have a higher nuisance alarm rate than their interior counterparts and a lower probability of detection, primarily because of uncontrollable environmental factors. Many different types of sensors are used in intrusion detection alarm systems. These sen- sors detect through sound, vibration, motion, and electrostatic and/or light beams. Determin- ing which sensors to deploy in response to security vulnerability depends on both operational considerations (e.g., the facility’s hours of operation; the presence of system users, staff, or other personnel; the value of material, equipment, or other critical assets; and the response time of security forces) and technological limitations (e.g., concerns about radio and electri- cal interference, sound levels, weather and climate, and other environmental factors). Ideally, the agency should seek professional security assistance in planning for intrusion detection alarm systems.

Physical Security Countermeasures 41 Electronic Access Control Systems Access control systems limit or restrict the access of personnel or vehicles either into or out of a controlled zone or area. The technology used can be basic or complicated, depending on the needs and requirements of the resource or area to be protected. Systems can stand alone to con- trol access to a single entry point or be multi-portal, computer-based, and capable of controlling access to hundreds of doors and managing thousands of identification credentials. Before implementing an access control system, the agency should have a well-defined under- standing of the threats and vulnerabilities to be addressed. In addition, sensitivity to the follow- ing factors is important: • The nature and tempo of activity in and around the protected area; • The size of the authorized population; • Variation in degrees of accessibility in terms of access levels and time; • The physical characteristics of the area being protected; • Limitations or restrictions caused by the operating environment; • Climate and weather conditions affecting system operations; • Staffing, training, and support levels available for operating and maintaining the system; and • The availability of security forces to respond to a report of an unauthorized entry. Protecting transportation agency operations and assets can be a difficult proposition. Because of the open and ubiquitous operating environment, it is not always possible to control people’s movements. Inappropriate screening of system users may create an untenable level of inconven- ience that results in the loss of customers. Similarly, an agency whose employees are confronted with unnecessary, time-consuming access control regimens will, at best, suffer a loss of produc- tivity through queuing or, at worst, have the system itself compromised by activities such as door propping. Access control performance must correspond to the needs of the organization by being responsive to throughput requirements, defined as “the measure of the number of authorized per- sons or vehicles that can process through an ingress or egress point within a period of time.” (SAVER Summary; Handbook of Intrusion Detection Sensors, 2004 http://www.dhs-saver.info) The accurate identification of controlled or restricted areas through a rigorous determination of what locations, assets, or resources need protection is essential to achieving acceptable throughput. The difference between the two is based on the necessity of access. Controlled area access should be limited to persons who have official business within the area. Restricted area admittance should be limited to personnel assigned to work in the particular area or other per- sonnel who have been expressly cleared and authorized. Other individuals entering restricted areas should be accompanied at all times by an authorized individual. The following criteria can assist in defining agency-controlled areas or restricted areas: • Operating areas critical to continued operation or provision of services, • Locations where uncontrolled access would interfere or disrupt personnel in the performance of their duties, • Storage areas that contain valuable equipment or materials, • Locations where operations can result in the existence of hazardous or unsafe conditions, • Office areas where sensitive or confidential information is located, and • Command and control areas that house critical functions. The main elements of an access control system are • Barriers, • Verification or identification equipment, • Panels, and • The communications structure that connects these elements.

42 Security 101: A Physical Security Primer for Transportation Agencies Source: SAVER Summary; Handbook of Intrusion Detection Sensors, 2004 http://www.dhs-saver.info Figure 3-15. Cipher access control barrier. The system must also be able to communicate either directly or indirectly through human interface with response security forces. Access control barriers are identification-based, requiring the person or vehicle requesting access to possess some form of information or technology that can be read by the system. Elec- tronic systems are computer-controlled with access determinations made through the query of an authorized user database. Figure 3-15 shows a cipher access control barrier widely used in areas that require frequent entry by authorized users. The cipher lock controls access using information the individual knows (a combination). Figure 3-16 shows a token-based drop arm barrier system used to supplement security per- sonnel at the vehicle entranceway to a controlled area. The vehicle contains some form of a read- able proximity sticker, such as a bar code or other device, that automatically lifts the drop arm barrier once the authorized user database has been interrogated. Source: SAVER Summary; Handbook of Intrusion Detection Sensors, 2004 http://www.dhs-saver.info Figure 3-16. Token-based drop arm barrier system.

Physical Security Countermeasures 43 Figure 1: Iris Diagram2 Figure 2: Iris Structure3 Figure 3: Minutiae5 Figure 4: Other Fingerprint Characteristics6 Figure 3-17. Biometric technologies including iris recognition, fingerprint identification, voice recognition and palm print identification. There are many types of access control system barriers and perhaps even more identification methods—there are at least nine different card-encoding technologies available, including the better-known technologies such as magnetic stripe or proximity. Today smartcard technology and biometric systems are becoming more and more prevalent. Smart card technology is used to describe a single card that performs more than one function (e.g., access control and photographic identification). Access control-related biometric technology differs from cipher in that the individual seek- ing entry knows authorizing information and a token, based on something the individual pos- sesses, is read by the barrier. As shown in Figure 3-17, biometric technology is based on who the individual is. TCRP Report 86, Volume 4: Intrusion Detection for Public Transportation Facilities Handbook contains a checklist for sizing or engineering an access control system (see Table 3-3). However, this list should only be used in conjunction with the help of security professionals specializing in designing and implementing access control systems. Establishing an integrated access control system can be complex, given that the effort involves both short- and long-term issues of design, maintenance, continued operation, training, and testing. Access control systems can be expensive and costs are easy to underestimate. Expenditures associated with system infrastructure can climb quickly as the organization’s needs grow and

44 Security 101: A Physical Security Primer for Transportation Agencies mature. Security planners should contemplate access control implementation based on lifecycle costs and multi-year capital planning. Surveillance Systems and Monitoring More and more every day CCTV is being used as a security countermeasure for both home- land security and crime prevention. The public has, for the most part, accepted the presence of videocameras in public places as a routine part of their daily coming and goings. Video systems can now be observed in use in facilities such as banks, shopping centers, transporta- tion facilities, casinos, gas stations, convenience stores, and stadiums. Outdoor surveillance cameras are being mounted in downtown districts in major cities, highways, parks and recre- ation areas, and even at intersections where traffic violators are being caught on film running red lights. Source: Adapted from National Science and Technology Council (NSTC) Subcommittee on Biometrics http://www.biometricscatalog.org/NSTCSubcommittee Pores Ridge Bifurcation Ridge Ending Island Figure 6: Palm Print and Close-up Showing Two Types of Minutiae and Other Characteristics. Figure 5: Voice Sample: The voice input signal (top of image) shows the input loudness with respect to the time domain. The lower image depicts the spectral information of the voice signal. This information is plotted by displaying the time versus the frequency variations.10 Figure 3-17. Continued.

Physical Security Countermeasures 45 Order SystemCharacteristic Explanation Information Needed 1 Number of Locations Is this system for one physical location or multiple locations? List of locations 2 NetworkConnectivity If multiple locations, what kind of network connectivity exists between the sites? Example T-1 data line, or via Internet 3 Area of Containment Is area enclosed by security barriers? Fences, Walls, Building, Gates/Portals Area map with barriers and gates identified for each location 4 System Zones How many security zones? These are areas of limited access (by time, training, need, etc.) Defined zones on map 5 Access Rules Need to determine rules for access to systems zones. A matrix of personnel and business/safety rules that allow access. Example – Chief of Security has full access all the time. Office janitor has access to public administration building during work hours only. Full list in matrix form 6 Gates/Doors/Portal What are the number of personnel and vehicle portals? (Portal = gate, door, etc.) A count of portals by type 7 Personnel Tracking Is there a need to know if people are either in or out? Or just secure check in is needed? Secure in & out requires ACS readers on both sides of gate / portal Secure in & out or just secure in—by location 8 Material Tracking Is there a need to track vehicles, trucks, computers or other ‘materials’? Yes or no. If yes provide a list. 9 Number of Badges How many people = number of badges. (Badges = Access Cards) Count 10 Number of Trackers If tracking materials is needed, how many? Count by type 11 HazardousConditions Area card reader installed in hazardous locations? Limits types of readers 12 Biometrics Are biometrics used, and if so what type? Yes or no. If yes what type? 13 Reader Type What type of reader? Examples – RF proximity, Biometric Reader Type 14 Badge Type What type of badge is needed? Follow Reader Type 15 Badge Information What information is needed on badge? Name, photo, employee number, etc. Graphic of front & back of badge with ALL data 16 Badge Production Need to determine number & type of badging stations. Input included number, type, and physical locations Count & location of badging production stations. 17 Tracker Information What information is needed on the material tracker ‘badge’? Full description 18 Traffi c How many people use the system on a daily basis? Number of accesses.In & Out = 2 19 History How much data is to be saved. Including badges issued, portals transferred, access changes, period of data retention. Study of traffic to size ACS data storage requirements 20 Data Integration Does the ACS interface with other systems? Examples include HR,time & attendance, etc. Data integration plan with database mapping 21 Intrusion Detection Is an IDS present? If so what type of integration is required? Yes or no. If yes list interfaces 22 Video Interface Is there an interface between ACS and video systems? Video at portals? Badge photo pop up upon access? 23 Computer OS Is there a preferred Computer Operating System? Influence on chosen ACS 24 Installation Support Is support labor for installation readily available? In house, contract, turnkey? 25 System Support Is support labor for maintenance & repair available? In house or outsource? 26 System Operation Is support labor available for system operation? In house or outsource? Source: TCRP Report 86, Volume 4 Intrusion Detection for Public Transportation Facilities Handbook Table 3-3. Checklist for sizing or engineering an access control system.

The term CCTV is synonymous with surveillance technology and has come to be used as a generic descriptor for video systems. Originally the term was used to differentiate between broadcast television and private video networks. In general, CCTV is a system of one or more video cameras connected in a closed circuit or loop. The cameras provide input images to a television monitor for viewing. Depending on security objectives, the CCTV system may also include a recording and playback capability (see Figure 3-18). Effectively integrating CCTV into a transportation agency’s security program demands that planners exercise a high level of conceptual understanding of the capabilities of the technol- ogy and its ability to meet organizational requirements and needs. Video systems do not provide any form of denial of attack or delay in response to aggressor tactics or actions. They present no physical barrier, nor do they control access or reduce exposure to dangerous conditions. In the strictest sense, CCTV seeks to deter aggressor actions or targeting through an increase in the aggressor’s perceived risk of capture or his belief in the suc- cessful interdiction and prevention of an attack. Recognition of this cir- cumstance means that to effectively deploy CCTV as a deterrent requires aggressor knowledge of the presence of the system. In addition the aggres- sor must believe that the CCTV system will indeed prevent or reduce the likelihood of success (see Figure 3-19). CCTV also serves a second almost equally important role as a security tool capable of greatly improving the performance and responsiveness of security forces and intrusion detection systems, including alarm and access control. By adding video surveillance to these systems, an agency can remotely moni- tor and assess security conditions during a security incident. In fact currently available advanced video surveillance technologies can further expand the With an overt CCTV camera, the public (and offenders) can clearly see the surveillance camera and determine the direction in which it is facing. Source: US DOJ, Video Surveillance of Public Places by Jerry Ratcliffe, 2006 Figure 3-19. Overt CCTV camera. 46 Security 101: A Physical Security Primer for Transportation Agencies Source: SAVER Highlight, CCTV Technology, 2005 http://www.dhs-saver.info Figure 3-18. SAVER highlight CCTV.

Physical Security Countermeasures 47 effectiveness of video monitoring. Switchers that permit operators to select between video images, multiplexers that facilitate simultaneous viewing, and new video analytic capabilities are in use to aid operators by directing their attention to priority images (see Figure 3-20). Technology such as facial recognition software and thermal imaging systems can further increase the value of video surveillance (see Figure 3-21). In 2007, the American Public Transportation Association (APTA) published The Selection of Cameras, Digital Recording Systems, Digital High Speed Train-lines and Networks for use in Transit related CCTV Systems, as a part of its IT Standards Program Recommended Practice (RP) Series. APTA IT-RP-001-07 V1.2 is a valuable technical resource for transportation agencies considering implemen- tation or upgrading of CCTV systems. The document covers the selection and use of cameras for CCTV at stations as well as on moving transportation con- veyances such as buses or train cars. Recording devices and backbone architec- ture for support of CCTV are discussed in detail. In its overview section the APTA RP states: This level of quality is intended to facilitate the requirements of the systems design through a formal ‘Systems Requirement Specification’ (SRS) allowing the systems to be designed for every day safety and security require- ments as well as revenue protection and anti crime and anti terrorist applications requiring the identification of unknown people and objects depicted within images and allow systems to be designed to meet the 4 industry accepted categories known as Detect, Monitor, Identify and Recognize The industry-accepted categories of Detect, Monitor, Identify, and Recognize are used by APTA to frame the functional requirements of CCTV systems. Specifications are based on image resolution criteria that depend on the security purpose and use for the video system. Figure 3-22 provides a comparison of screen size image projections for these categories. Operational context and applicability for each of the categories is provided in Table 3-4. This semi-covert CCTV camera may have a crime prevention advantage over an overt system because offenders can never be sure in which direction that camera is facing. Source: US DOJ, Video Surveillance of Public Places by Jerry Ratcliffe, 2006 Source: SAVER Summary; Closed Circuit Television Technology Handbook, 2006 http://www.dhs-saver.info (a) (b) Figure 3-20. Overt CCTV camera. Figure 3-21. Thermal imaging camera (a) and photo (b).

Figures 3-23 and 3-24 illustrate the categories by focusing on image resolution requirements for successful “identification” of a suspect. The photographic images in the bottom two pictures are cropped, enlarged, and enhanced from the photos immediately above them. The determination of image resolution requirements is perhaps the most important aspect of CCTV system design. Without usable images, security personnel cannot discharge their respon- sibilities. However, the costs attributable to CCTV design can increase exponentially when secu- rity planners overreach the system capabilities to meet criteria that serve no objective purpose. This problem extends not just to image quality but also to the functionality of the other compo- nent parts of video systems. CCTV design should start with a needs and requirements analysis based on the findings of the agency’s risk assessment. Activity-driven performance functions should be identified that articulate each vulnerability or security objective that the CCTV system should address. 48 Security 101: A Physical Security Primer for Transportation Agencies Source: APTA, The Selection of Cameras, Digital Recording Systems, Digital High Speed Train-lines and Networks for use in Transit related CCTV Systems; draft 2007 Figure 3-22. Screen size image projections.

Physical Security Countermeasures 49 Source: APTA, The Selection of Cameras, Digital Recording Systems, Digital High Speed Train-lines and Networks for use in Transit related CCTV Systems; draft 2007 Function Screen image (size of image when viewed on a monitor without zoom) Typical applications (not limited to and for example only as specific areas will vary according to local conditions) Detect Not less than 5% A figure occupies at least 5% of the screen height. From this level of detail an observer should be able to monitor the number, direction and speed of movement of people, providing their presence is known to him. Perimeter security Long range images over parking lots, etc. Monitor Not less than 10% The figure now occupies at least 10% of the available screen height. After an alert an observer would be able to search the display screens and ascertain with a high degree of certainty whether a person is present or not. Entrance areas. Perimeter security medium range. Medium range security of entrance halls, platform areas, etc. Recognize Not less than 50% When the figure occupies at least 50% of screen height viewers can say with a high degree of certainty whether or not an individual shown is the same as someone they have seen before. Mobile applications: interior car and bus surveillance at door or call button area. Front facing applications on vehicles or areas where bus or train exteriors are viewed. Short range security for hallways, revenue and ticket areas, railroad crossings, call buttons and parking garage entrances/exits. Elevator lobbies. Identify Not less than 120% With the figure now occupying at least 120% of the screen height, picture quality and detail should be sufficient to enable the identity of an individual to be established beyond reasonable doubt. Mobile applications for cash boxes/fare machines and crew safety. Short range applications at ticket barriers, fare machines, cash rooms, garage barriers and secure door entrances (licence plate and payment machine). Table 3-4. Operational context and applicability.

50 Security 101: A Physical Security Primer for Transportation Agencies Source: APTA, The Selection of Cameras, Digital Recording Systems, Digital High Speed Train-lines and Networks for use in Transit related CCTV Systems; draft 2007 (b) (a) Source: APTA, The Selection of Cameras, Digital Recording Systems, Digital High Speed Train-lines and Networks for use in Transit related CCTV Systems; draft 2007 (a) (b) Figure 3-23. Closed-circuit tele- vision image likely to be suitable for personal identification. Figure 3-24. Closed-circuit tele- vision image unlikely to be suit- able for personal identification.