Risk and Security LLC

Two Nurses Stabbed on Easter Sunday in Different SoCal Hospitals

Posted on April 21, 2014 7:17 pm by Caroline Ramsey-Hamilton Comment

Dateline: April 21, 2014

Stabbing at Olive View – UCLA Medical Center

In the early morning hours of Easter Sunday morning, a nurse at Olive View-UCLA
Medical Center in Sylmar, California was critically hurt after being stabbed
multiple times.

Prior to the stabbing, deputies said the suspect had entered the hospital and
allegedly bypassed the weapons screening area. As the deputies searched
for the perpetrator, they heard a woman scream, and located the nurse, who was stabbed in both the upper
and lower torso. The nurse was transported for medical treatment in critical condition.

Torrance Hospital – Later at 9:20 am on Easter Sunday, Thomas Fredette walked
into Torrance Hospital, in the south Bay, and grabbed a nurse from behind and
stabbed her in the ear with a sharp object, according to Los Angeles County
Sheriff’s officials. Fredette faces charges of assault with a deadly weapon,
sheriff’s officials said. He is being held on $130,000 bail.

What We Learned:

Strong Access Controls at Hospital Entrances and Exits are the first line of
defense against injuries to hospital staff. Both events were random and
apparently unprovoked.

Nursing staff in particular, should receive adequate training in situational
awareness, which may be in conflict with their total focus on caring
for patients.

Double Check these critical Potential Controls:
Stronger Access Controls
Panic & Duress Alarms at Entry Points and on Nurses working late shifts
Better Weapons Screening

Why We Need to Switch to a Risk-Based Security Model – School Stabbing at Franklin Regional, Active Shooter Incidents at Fort Hood (twice), LAX, and The Washington Navy Yard.

Posted on April 15, 2014 8:42 pm by Caroline Ramsey-Hamilton Comment

When I turned on the news today, I was in the middle of writing an article on the 2^nd Shooting
at Ft. Hood from last week, and then saw that there had been a violent knife attack at a
Pennsylvania high school, with 20 casualties and at least eight injured critically, the next day,
there was a hate crime shooting at the Jewish community center in Overland Park, Kansas.

Once again, we see violence on a mass scale, the FBI has been brought in, and next will come
information on the victims. With two major events, in two weeks, what can we deduce about the
security in place at both Franklin Regional High School, Pennsylvania, and Fort Hood, Texas.

NEWS FLASH: THE CURRENT SECURITY MODEL IS NOT WORKING!

CURRENT SECURITY MODELS

Disaster preparedness is improving, Emergency Management is working, but security is
still not where it needs to be. It is a systemic problem based on the fact that security around
the U.S. is still locked in a REACTIVE mode, not a PROACTIVE mode.

The main reason for this reactive mode in security organizations, is because most security
officers come from a law enforcement background, with a model which is based on crimes
and arrests, and it is totally REACTIVE. A crime happens and police officers go into action
and arrest the perpetrator(s).

CRIME HAPPENS = PERP IS IDENTIFIED = PERP IS ARRESTED

Unfortunately, this reactive model does not work for preventing security incidents and mass violence
because it is INCIDENT DRIVEN, not Risk-Driven. It focuses on individuals, not on a more holistic,
generalized view of Threats, and it totally leaves Solutions (Controls) out of the equation.

After studying pages of after action reviews, post-incident analyses and media sources, the one
recommendation that makes sense is that organizations need to switch to a RISK-BASED,
PROACTIVE mode for security to work.

This was highlighted in a remark made by a Pentagon official, commenting on the 2^ndFort Hood
Shooting on April 2, and the fact that new DOD recommendations for security, had just been released.

“After the Navy Yard shooting in September 2013, another round of recommendations were made
to improve security at all DOD installations, however, a Pentagon official said that the new
recommendations had not yet been put into effect at Fort Hood. At Fort Hood, very little had
changed from 2009 regarding security procedures for soldiers at the entrance gates.”

The question for the Department of Defense is “how could this happen again at the same military
base? I took extra time to study the 89-page document called An Independent Review “Protecting
the Force”, one of 3 reports created after the initial Fort Hood Shooting, whene 13 were killed, and
43 injured.

If you look at the recommendations, they are very bureaucratic and procedural. They could have
been written by an efficiency expert, not by anyone with a background in security, and covered things
like policy changes, and having screening for clergy and psychologists, and improved mental health
programs. These are all important, but they do not provide a secure environment.

The LAX after action analysis’ Number One recommendation was to change
the security focus to a Risk-Based approach.

RISK-BASED SECURITY

The problem with a reactive approach is that you can’t screen and lock down everyone. At Fort
Hood, for example, there are 80,000 individuals living on the base, and probably hundreds of
visitors who go in and out every day. It’s impossible to assess the mental health, and the
‘intentions’ of all of them.

That’s why a Risk-Based Approach works – because it focuses on the potential threats and then evaluates the existing controls to see whether they offer the required amount of protection based on the likelihood of the threat occurring.

You stop violent events by controlling access and by controlling weapons. No matter how unpopular they are, you use metal detectors at certain points, you use security officers at key entrances, you control entrances and exits.

Once the event starts, you can improve security by having faster notification (panic alarms), ability
to block, or disable weapons and attackers, adequate transport, better emergency response, but to
avoid the violence, you need to have strong access control.

The Risk-Based approach makes use of annual risk assessments that are holistic in nature. They
are not done in stovepipes, they include the entire organizations, they include input from staff
members, visitors, students, vendors, soldiers, patients on how they see security from their point
of view, which is always dramatically different from management or administration.

A risk-based approach requires an organization to:

Define potential security risks.
Develop standardized risk assessment processes, for gathering and
analyzing information, and use of analytical technology
Risk-Based Security focuses on PREVENTION OF NEW INCIDENTS
whether they are active shooter, general violence, etc.
Enhances security’s ability to rapidly respond to changes in the threat environment.

MORE BANG FOR THE BUCK

According the LAX (LAWA) after action report, “Simply adding more security does not
necessarily provide better security. Determining priorities and where to achieve great
value for the dollars invested requires regular, systematic assessment of the likelihood
and consequences (risks) associated with a range of threat scenarios that morph and
change more quickly now than ever before.

Collaborative engagement in a security risk assessment process across the community builds
the buy-in needed to develop and sustain a holistic security program over time. Leaders must
be open to challenging established practices and demonstrate a willingness to change direction”.

Making the switch to a Risk-Based security program is the best recommendation for those who
want to protect their staff, students, patients, vendors, clients, soldiers, and visitors from a mass
casualty event, or for all the organizations who don’t want to have a terrible incident happen in
the first place!

Caroline Ramsey-Hamilton

President, Risk and Security LLC

Caroline@riskandsecurityllc.com

www.securityinfowatch.com/blogs

www.riskandsecurityllc.com

What Went Wrong at Fort Hood? Another Active Shooter?

Posted on April 8, 2014 5:43 pm by Caroline Ramsey-Hamilton Comment

RISK Alert Alert #530 – Fort Hood Active Shooter-April 2, 2014

Dateline: April 5, 2014

Shock and grief were the reactions when the news said, for a second time, a shooter
inside Ft. Hood near Killeen, Texas had killed 4 and injured 13 in another Active Shooting
Incident. Everyone remembered the first major shooting attack in November 2013, when
a major killed 13 and injured 43 because he did not want to be deployed to Afghanistan.

A total of 73 injured and/or killed in the two incidents!

How could this have happened? The Department of Defense had implemented many of
the recommendations of its internal, and independent review panels, and the changes had not
been enough to prevent another active Shooter incident.

The 34-year old shooter had apparently been denied a leave form, and asked to come
back the next day and he came back, with a .45-caliber Smith & Wesson semiautomatic
handgun, recently purchased at Guns Galore, and started shooting. He eventually turned
the gun on himself, after firing 35 rounds in two buildings over a 2 block area. He had a
history of mental issues, and had recently been transferred to Fort Hood.

What We Learned: The After Action Review “Protecting the Force” had detailed 89
recommendations, but by Sept. .2013, only 52 had been
implemented and none included an Active Shooter Risk Assessment.

A comprehensive Active Shooter Risk Assessment has to be the first recommendation
after any Active Shooter event. Recommendations from the previous shooting were concentrated
on new policies and procedures, mental health screening, education and training programs but
those controls did not directly influence PREVENTION of incidents.

A Review of the Most Important Active Shooter controls would have been more
likely to prevent a future shooter event, like:

Tightened Access Controls for Facilities
- Panic Alarms
- Tracking of Potential Troubled Individuals
- Metal Screening for Weapons
- Policy on Personal Weapons on Base
  
  After the Navy Yard shooting in September 2013, another round of recommendations
  were made to improve security at all DOD installations, however, a Pentagon official
  said on Thursday, April 4th, that the new recommendations had not yet been put into
  effect at Fort Hood. Unfortunately, at Fort Hood, very little had changed from 2009
  regarding security procedures for soldiers at the entrance gates.
  
  Stay Alert and make sure that any Security Incidents are reported IMMEDIATELY!

Loss of Malaysian Airlines Flight Points Out Airline Security Weaknessess

Posted on March 24, 2014 12:02 pm by Caroline Ramsey-Hamilton Comment

Monday, March 25, 2014.

This morning the Malaysian Government stated that based on all their “new”
calculations, they have concluded that Flight 370 went down in the southern
Indian Ocean.

Has terrorism been counted out for this flight – no. Until the whole story is known,
it will be impossible for anyone at this point to say that this happened because of pilot
error, mechanical failure, bad weather, or anything else. However, as we watched
the near continuous news coverage of this ill-fated flight, it was impossible to ignore
the many security weaknesses that were revealed as the drama played out, and
experts proposed possible new theories, even alien abduction!

The airlines around the world, and even the Federal Aviation Administration (FAA),
have always maintained their unique security standards, unlike other industries
which have generally accepted security practices that are used worldwide. This
standardization of security elements has made it easier for multinational corporations
with offices worldwide, to secure their supply chains, ensure improved safety and
security for their employees, contractors and vendors, and, in my opinion,
contributed to making the world a safer place.

Unfortunately, this uniformity and standardization of security practices is not
mirrored in the airline industry globally, and even blatantly ignored by other
airlines, operating in other countries.

International travelers often see the little sign that says something like: THIS
AIRPORT HAS BEEN CLASSIFIED AS UNSAFE. Of course, because these
airports are often the only airport in the country, they are used anyway.

But the fate of Flight 370 has shocked some security experts by uncovering the
lack of security at a respected airport, generally thought to be safe and secure.

For example, right after 9/11, the FAA moved quickly to security the cockpit of
U.S. planes, and keep them locked and secure during flight. So it was quite a
surprise to have a young girl smiling and telling CNN how she partied with the
co-pilot in the cockpit during a recent flight.

“The FAA rule sets new design and performance standards for all current and
future airplanes with 20 or more seats in commercial service and all cargo
airplanes that have cockpit doors. Specifically, the rule:

Requires cockpit doors to remain locked. The door will be designed to prevent
passengers from opening it without the pilot’s permission. An internal locking device
will be designed so that it can only be unlocked from inside the cockpit.

Controls cockpit access privileges. Operators must develop a more stringent
approval process and better identification procedures to ensure proper
identification of a jump seat rider.”

As the tragedy has unfolded day by day, security experts can see vulnerabilities
in the way security controls are both either not required or are not correctly and
consistently implemented on planes around the world.

The “Tombstone Mentality” of the airline industry and civil aviation organizations now
have the tombstones for 370 individuals, and everyone hopes that even though we
don’t know know exactly why this flight went down, we can all see that there are
weaknesses in international security that need to be addressed in the aftermath of
this tragedy.

After Action report on LAX Shooting Recommends Risk Assessments

Posted on March 19, 2014 1:26 pm by Caroline Ramsey-Hamilton Comment

The Los Angeles World Airports (LAWA) released the long-anticipated After
Action Analysis on the LAX Active Shooter Incident in 2013.

The 83-page report was written by an independent consultant who analyzed
all aspects of the Shooting incident and includes a list of “Major Observations
and Recommendations.” The recommendations are “to provide focus for
LAWA’s efforts toward continuous improvement in it’s security and emergency
preparedness programs.

These areas were highlighted in the report as “7 priority observations that merit
special consideration.

Recommendation 1.1: Evolve the LAX Security Program to reflect a more
integrated assessment of security risk and provide for the ongoing development
and management of mitigation measures.

Recommendation 1.2: Based on the RISK ASSESSMENT and updated security
plan, consider the focus and structure of security functions to determine whether
realignment and integration are needed.

Recommendation 1.3: With the benefit of recent vulnerability and risk assessments,
take a risk-based approach to evaluating current security programs and explore
intelligent use of technology.”

Once again, doing frequent Security Risk Assessments and managing the security
program and enhancements to follow the recommendations of the Risk Assess-
ment are the first recommendations in the After Action Analysis of an Active
Shooter Incident.

In my experience, in most organizations, Facility Security Risk Assessments are
not conducted correctly, are not reported to senior management, and not used as a
tool to ADJUST AND FOCUS the security program based on RISK.

Why aren’t security risk assessments done more often?

1. People don’t have the right expertise to do a full risk assessment.

2. Security managers view Security Risk Assessments are too difficult
to undertake.

3. Law enforcement personnel still do not understand the concept of risk
assessments and instead, tend to rely on checklists of controls or
security elements, rather than integrating all the information to
create a true Risk-Based model for security.

The solution to this problem is to use affordable, easy to use software tools, like
the Risk-Pro Application for Facilties Security Assessment and their Risk-Pro
Application for Active Shooter Incident to simplify the process of doing more
frequent risk assessments and using them as a management tool to focus
security so it will be able to recommend the security enhancements that are
needed, and not only how MUCH to spend, but actually dictate the order
of necessary controls.

Far from being a boring, intellectual exercise, well done security risk
assessments can dramatically reduce the possibility of an active shooter
event, and also mitigate the many negative consequences that come
from such disruptive incidents.

Putin Analyzes his Risk on Invading Crimea

Posted on March 3, 2014 9:40 pm by Caroline Ramsey-Hamilton Comment

The invasion of Ukraine’s Crimea region by Putin’s “un-labeled” troops
illustrated two major principles of a Risk Assessment.

#1 – Secure your Critical Assets First

It’s not about the citizens of Crimea, not about the Ukraine wheat fields, or
even it’s use as a pipeline pass-through area. It’s all about the Black Sea
Ports. These ports are absolutely critical to Russia (and also to PUTIN
– the EGO), because they are a critical place to ship gas and oil from,
and they also give Russia their only access to the Mediterranean,
in case Putin urgently needs a gelato!

The second principle of a risk assessment is

#2 – Analyze all the Potential Threats

I read a great article over the weekend about how Putin had sized up the
EU and the European bankers, and calculated that the threat of any interruption
of the Russian-European banking relationship was zilch – zero. Bankers are
not going to reduce their profits by refusing to do business with Putin.

The next potential threat is U.S. retaliation or sanctions. Putin correctly
calculates that the US didn’t get out of Iraq and almost out of Afghanistan
to immediately send any boots on the ground to Crimea or eastern Ukraine.
We can threaten to curtail his trips to Vegas and Disneyland, but the U.S.
is not going to start a war over this.

Putin did his risk calculation and decided that his chance of getting in any
serious trouble was VERY SMALL and his potential gain was VERY HIGH:

1. He gets to look like a tough guy again.

2. He gets lot of media attention from the whole world (doesn’t care what
media writes about him, as long as they spell P*U*T*I*N correctly and
gets him back on the world stage again.

3. And, the clincher is that he can pull the troops out anytime he wants,
send them back home, and no real harm done.

But I did pay attention in my history class, and I am hoping out loud that
we are not on the precipice of another war!

3 Killed, 4 Others Injured at Columbia, MD Mall Shooting

Posted on January 26, 2014 9:42 am by Caroline Ramsey-Hamilton Comment

Saturday morning at the Columbia Mall, in this neat, planned community was cold and many people decided
to go to the mall! Columbia, Maryland is a large mall, situated between Washington DC and Baltimore
in the Maryland suburbs. I’ve been there frequently – in fact, last month.

Unfortunately, at 11:15 in the morning, a young man entered the mall and started shooting. Some witnesses
said he was shooting down into the Food Court from the 2nd Level. The shots were centered in a surf, skateboard
and snowboarder store called Zumiez.

Two young people were killed, store employees, Brianna Benlolo, 21, of College Park, MD; and Tyler Johnson
25, of Ellicott City, MD, and a man police identified as the shooter. He had killed himself, but was wearing more
ammo and had more ammo around him.

A bystander was shot in the foot, and others were injured in the chaos that started when the 8-10 shots
were fired and someone yelled, “There’s a man shooting”. But these injuries were judged to be minor.

ONE MORE ACTIVE SHOOTER. ONE MORE YOUNG MAN WITH NO MOTIVE. Seven families devastated
and looking for answers.

Again, we look at access control, and due to the NRA effect, making it ridiculously easy to carry a gun, even
a concealed gun almost anywhere, we have to start with what kind of access we should allow to public places,
like schools, malls and airports.

In a risk and reward calculation, it’s basically, does the right of an individual to take a loaded gun anywhere
they want, supersede my right to safely shop at the local mall on a Saturday morning? I think it does.

Now the burden is on the mall owners about how many of these shootings it’s going to take before we start
seeing armed guards at malls, and access control devices like metal detectors, at entrances to the larger malls.
Because think of what the mall owners lost – they lost their reputation as a “SAFE” place to go. They lost
almost a whole day of sales, and maybe they will lose another day.

The local police and county Executive were on TV saying police arrived within 2 minutes of the shootings.

and the SWAT team entered the Mall and did a store by
store search, while the media trucks assembled in the parking lot.

If people want to take loaded guns everywhere and society
thinks that’s great – then store owners are going to have to
increase security and be able to have tools to exclude these
people.

Guns are for hunting, not for shopping!

Terrible day for Columbia Mall and it’s customers, I guess it’s a wonderful day for the security industry that will sell
lots more metal detectors, cameras, monitoring, panic alarms and more. Because that’s what we need to keep
the public safe.

RiskAlert Incident Report #473 – Hospital Admin Killed at Home

Posted on January 6, 2014 12:43 pm by Caroline Ramsey-Hamilton Comment

RiskAlert INCIDENT REPORT 473 – ACTIVE SHOOTER 12-27-2013

Oschner Hospital Administrator Shot to Death in his Home in Active Shooter Spree

Dateline: December 27, 2013 pm

A Louisiana man attacked his former in-laws, his current wife, and the Administrator of a hospital
where he’d worked, killing three and wounding three others before killing himself, authorities said.

The shooter, Ben Freeman, 38, was found late Thursday night in his car along a highway,
dead from a self-inflicted gunshot wound to the head.

The shootings happened at four locations in two parishes about 45 miles southwest of New Orleans
on Thursday. The first report came about 6:40 p.m., when Lafourche Parish Councilman Louis Phillip
Gouaux, who was shot in the throat, called 911 from his home in Lockport, Houma, La.

The suspect, Ben Freeman, 38, was the ex-husband of Gouaux’s daughter Jeanne, Lafourche Parish
Sheriff’s Office spokesman Brennan Matherne said in a news release.

Gouaux’s wife, Susan “Pixie” Gouaux, was dead when deputies arrived. Louis Phillip Gouaux and his
daughter, Andrea Gouaux, were injured and taken to Interim LSU Public Hospital in New Orleans.
Both were in critical but stable condition, Matherne said.

About 20 minutes later in Raceland, Ochsner St. Anne General Hospital Administrator Milton Bourgeois
was shot and killed at close range at his home. His wife, Ann Bourgeois, was shot in the leg, and taken
to the New Orleans hospital, where she was listed in stable condition. Raceland police said Bourgeois
was shot at close range and his wife was shot in the leg.

Freeman had been employed at three area hospitals over the last few years, including Oschner St. Anne Hospital, where Lafourche Parish Sheriff Craig Webre said he had been a registered nurse before he was fired in 2011. All three hospitals were put on lockdown for a while Thursday.

Freeman’s wife, Denise Taylor Freeman, was found dead in the couple’s home in Houma in Terrebonne Parish. Matherne said her cause of death was not immediately known.

RISKAlert is a publication of Risk & Security LLC at www.riskandsecurityllc.com.

Get Management’s Attention for Security – Shooter Kills the Hospital Administrator

Posted on January 6, 2014 12:14 pm by Caroline Ramsey-Hamilton Comment

Every Security Officer I’ve ever met has mentioned how difficult it can be to get funding for additional security! It is a never-ending mission, to get the budget for a security program that will truly protect an organization.

Hospitals are no exception. They have suffered their own financial problems and because security is not seen as a ‘clinical’ or ‘patient care’ issue, it is easy to take money from security and put it somewhere else.

But there’s one sure way to get management’s attention for Security — having a security incident. And if you don’t have one at your organization, high profile security incidents at other facilities will all grab management’s attention.

In my Risk-Pro Security Incident Report today, a shooter killed four, wounded three, and then killed himself. What was unusual about this incident was that the shooter went to the Hospital Administrator’s house and shot the administrator dead, and then shot his wife who was taken to an area hospital.

Most executives and administrators think about security as sort of an abstract concept, that doesn’t directly affect them. But it might, and by sending your management a copy of our Risk-Pro Incident Report, you’ll get their attention this time!

(Subscribe to the Risk-Pro Incident Report program by sending an email with the word SUBSCRIBE on it to info@riskandsecurityllc.com)

Got a House near the Coast? The Storm Surge Lessons we’re Learning from the Philippines Disaster and Hurricane Sandy…

Posted on November 16, 2013 3:53 pm by Caroline Ramsey-Hamilton Comment

You already know that the climate is getting progressively warmer, and sea levels around the world
are rising.

This new climate reality played out last week in the Philippines, an archipelago nation with over 7000 islands, as a giant typhoon smashed into the central Philippines districts and destroyed everything in its path, including housing for millions of people living near areas around the cities of Tacloban and Cebu and other islands.

With thousands already dead and thousands more in island areas that have not been reached yet,
the ultimate death toll may be weeks in coming, but some experts think it could top over 15,000 people.

If, like me, you live near an ocean coast anywhere, you have to wonder how future storms may affect your region.

The rising sea levels are already invading fresh water wells along Florida’s east coast, polluting the fresh water with salt, and forcing cities to find new fresh water sources. Saltwater seeping in from the ocean keeps spreading farther west, threatening to ruin the freshwater supplies that provide most of South Florida’s drinking water.

Even though the US doesn’t get typhoons, it does get hurricanes, and what we learned in this typhoon, just like we learned in Hurricane Sandy in October, 2012, was that it’s not the wind, it’s not the rain,
it’s the STORM SURGE that creates the disaster.

In the recent typhoon, the storm surge, while not technically a tsunami, pushed up an enormous amount of water on shore, that destroys everything it touches and pushes the water inland, dragging along houses, trees, cars, people, animals, giant ships, hotels and anything else it finds on it’s path.

“As a nation we don’t understand storm surge well, nor do coastal communities understand storm surge risk,” said Jamie Rhome, a storm surge specialist at the Hurricane Center. “It’s one of the hardest things to communicate.”

Storm surges can travel inland up to thirty miles and can quickly push up rivers, and bays. “People
don’t understand how far inland storm surge can go,” Rhome said. “It penetrates well inland, goes up rivers, into bays. It goes wherever it can, and people don’t realize they are at threat of flooding.”

Cities and regional planning groups need to re-examine the storm surge threat in their areas, and make plans to deal more effectively with these lethal storm surges that may come from hurricane and typhoons in the future.