This video analysis is part of our recently released training center content.

The dynamic of territoriality and how that concept leads to the creation of anchor points plays a critical role in the professional lives of our nation’s protectors.  Anchor points are the areas where we keep the things that are important to us and, therefore, they require the most security.  For observers, understanding how two key characteristics of anchor points – how they are created and how people interact with them – provides the opportunity to make objective assessments and predictions about the people within the places you visit.  The first characteristic, how people establish ownership of an area, empowers our military and police forces to locate the areas that criminals, insurgents and terrorists use to plan their operations and strike them in their own backyard.  The second characteristic, how people interact with established anchor points, allows all members of the security and defense industries to better evaluate the people attempting to access restricted areas.

Before we can take this concept of identifying anchor points from theory to tangible real life scenarios, the initial requirement is to understand what differentiates anchor points from habitual areas. We will do this by analyzing two video clips. The first video is taken inside the entrance to a Target store and the second clip is focused on the people entering a Costco.  Start by watching each of these clips through one time to get a basic understanding of the behaviors we will be discussing.

Target Entrance

\

Costco Entrance

We should start by realizing that both of these stores are very similar as they both offer customers a wide variety of food and household items to shop for. However, the difference between the two lies in the customers who are Continue reading »

As summer approaches its close, schools across the country will again be welcoming students back onto campus.  In some locations, great effort on the part of school administrators, teachers and security professionals has been undertaken to assuage the apprehension and fear of parents and students alike in regard to criminal activity within the confines of a learning environment.  However, one basic error concerning an overarching principle in security will repeatedly be made by administrators, despite their best attempts to secure our schools.  Schools will be thought of, and viewed, as anchor points, but will be treated as habitual areas. This contradiction leads to the establishment of security gaps, which create vulnerabilities that can be exploited by threats.

A habitual area is a location where people come and go with little inhibition or restriction.  It is a location where people are generally welcomed and frequent often and repeatedly.  People generally feel comfortable and move about in an inviting and relaxed environment.  Habitual areas are generally created by a proxemic pull into the area, allowing people to meet a need.  A shopping mall is a good example of a habitual area.  Generally, it is the attitudes and actions of people within the physical space that make a place a habitual area.

Conversely, an anchor point is a location where only a certain group of people are normally allowed to operate in and would feel comfortable doing so.  Individuals who are not a part of the pre-established group would not be welcomed in the anchor point.  Anchor points provide safe haven and a sense of increased comfort and security for those who are part of a specific group or subset, but only to the extent that the anchor point is secured and defended.  Anchor points are a “base of operations” allowing selected individuals or groups to operate in a controlled environment with familiar people with common goals and objectives.  There is also a proxemic pull for anchor points, but only for those who are a part of the group allowed in the location.  Unlike habitual areas, there is also a proxemic push away from the area for the unwelcomed that are not a part of the group. Like the habitual area, it is to a large extent the attitudes and actions of those within the anchor point that defines it as such.

The physical setting does also contribute to the establishment and identification of a habitual area or an anchor point.  Physical security measures such as fences, gates, the layout of walkways, lighting and entry points, help define the area and set the mood, tone, and expectation of those entering and operating within the area.  The addition of iconography (signage, symbols, markings and writings) communicating the belief, association and principles of those operating in the area can paint an accurate picture of who is welcome, what criteria must be met and the operating mores within the area.

Schools, perhaps more than ever, need to be anchor points.  Past acts of horrendous violence make this point undeniable.  However, simply believing or stating that a location is an anchor point doesn’t make it so.  It’s dangerous to declare a place to be an anchor point or have a belief that it is, yet operate it as a habitual area.  This creates false bravado, diminishes our situational awareness and impedes our ability to spot anomalies.

Patrick Van Horne talks about an experience that illustrates this point beautifully.  After the shooting last winter in Newtown, CT, Pat had scheduled a meeting with school officials to discuss training aimed at increasing situational awareness, and thus overall school security.  Pat was to meet with the school officials at the school in question.  The school officials, after meeting with Pat, boasted about the security measures they had already put in place.  They took great pride in explaining to Pat the high degree of safety, security and control they had implemented.  They questioned the need for Pat’s expertise and the training he could provide.

What those school officials did not know was that Pat had arrived early because he wanted to find the exact location of the meeting within the school and didn’t want to be late.  Pat was able to enter the school grounds, wander the halls and corridors in a number of directions, and essentially had full access to the school.  Pat went unchallenged, unencumbered and uninhibited throughout the school until finally finding the specific meeting place.  Whatever measures they may have taken to bolster security did nothing to make the school more secure against a potential intruder.  Their actions only caused them to believe they had created an anchor point, when in reality they had not.  As a result, they were lulled into a false sense of security.

A baseline can be much easier to establish in an anchor point, and thus, anomalies are more easily forced to the surface and recognized than in a habitual area because there are less variables.  Anchor points by their very nature are more controlled and regulated.  There is often a higher level of expectation in regard to appearance, behavior, customs and practices.  It doesn’t take a long period of time, or much observation, to spot the sisters from a local convent who wander into an outlaw biker bar.

The same principle applies to our schools, but only to the extent we are willing to truly establish schools as an anchor point and put the measures and practices in place that establish it as so.  Pat probably wasn’t challenged or even given a second look as he walked unfettered through the school because of the mistaken notion that anyone on the school grounds must belong there and / or someone has already  “cleared” the subject.  If we aren’t willing to defend schools as anchor points, and make clear through deeds, not just words, that only a preselected group of people are welcome, then there is no point in even considering it an anchor point.

Well-intentioned people will most times follow the protocol of school entry.  Those with ill intent certainly will not.  In fact, they will look for the gap in security measures caused by the incongruence between believing the school to be an anchor point, but operating like a habitual area.  Here are some key questions to ask to check for those security gaps.

• Are check in and checkout procedures well established and followed consistently for every visitor?
• Do teachers, administrators and other school staff feel empowered to challenge anyone they don’t personally recognize?  Are they required to do so?
• Of those individuals that are personally recognized, do school staffers still inquire as to the purpose of their presence?
• Are there requirements in place regarding what can and cannot be carried onto the campus by visitors?  Are there measures in place to check bags, boxes, etc.?
• as the concept of defense in depth been employed HHasHas the concept of defense in depth been employed?  Has a buffer zone around and leading up to the anchor point been established?
• Is there a means by which to quickly Is there a means by which to quickly and clearly identify bona fide visitors from strangers from a distance and upon first glance?
• Is a consistent message being sent about how welcome a stranger may feel simply entering the school grounds by way of iconography, the physical setting and placement of fences, gates, entry ways, walkways, foliage, lighting, and the actions, attitude and demeanor of school personnel?

Perhaps most importantly, school personnel must be trained in how to quickly establish a baseline for their school for any given day, time of day, or special event, and then spot the anomalies that rise above or fall below that baseline.  School personnel must be able to spot those behavioral threat indicators displayed by an individual before a full incursion of the anchor point can unfold and develop.

The defense of an anchor point relies on being proactive, not reactive.  Too many schools rely heavily on reactive measures to preserve life and property after a dynamic event has unfolded.  A true anchor point exists because those that occupy it have made it clear that those not part of the group are unwelcome, creating a proxemic push from the area.

Schools need to be anchor points for our students, teachers and staff, so that teaching and learning flourishes in an environment of safety and security, absent of the threat of violence.  We must establish them as such.  Teachers and staff need to be adept at observing and searching for anomalous behavior. We must train them to do so.  Schools need to be operating left of bang. We must get them there, and keep them there.

This Article Has Become Part Of An E-Book, You Can Download It Here

Establishing and implementing a security plan is not a one-time event.  It is a process that requires continuous testing and improvement.  Security plans are established at anchor points in order to protect those inside from not only outsiders and non-members, but also from any insiders who have criminal intentions.  While I believe that behavioral analysis provides security practitioners with the information and insight needed to accomplish these goals, the concept has also been gaining traction in other areas.  In a recent article published in the Wall Street Journal: Risk and Compliance Journal about how to “How To Crack Down On Insider Threats,” Gordon Hannah, a principle in Deloitte & Touche’s Security practice, notes that by adding behavioral profiling to existing security practices, organizations “can effectively neutralize the insider threat and mitigate the risk a single individual can cause.”[1] These insider threats can span the spectrum of violence from being bullied by a coworker, the theft of intellectual property, harassment or even an active shooter scenario. While the threat of insider attackers is widely acknowledged, the ability to proactively identify these workers with dishonest intentions continues to be a challenge.  One way that organizations can reduce this risk from insiders is through the practice of penetration testing.

The penetration test, which is commonly used in the context of computer and network security, is a way for security officers to determine how capable they are at preventing both internal and external threats.  The goal of a penetration test is to identify where you are vulnerable so that you can later determine how to plug that gap.  The process begins by establishing a baseline for the entrance that insiders will have to pass through.  By going through the steps and process outlined in “How I Break Down A Video,” we can establish the patterns that are present and have a quantifiable structure to build off of.

Step 1 – Baselining: Where the penetration test requires a focused effort is on the different groups of insiders that use the entrance you are trying to protect. One example is the anchor point that gets established inside of an airport terminal at the individual gates.  There are a number of groups that are allowed into the jet-way once their credentials have been verified: passengers, flight attendants, pilots, gate attendants, maintenance staff and the crew that resupplies the planes with the food and drinks.  For the gate attendant who serves as the bouncer and sentry at this particular anchor point, her task is to assess each of these groups and know the patterns that each group is supposed to follow. These are the insiders with a legitimate reason for being there, or those trying to appear to be insiders.  Consider the following picture taken of the people attempting to board a Southwest Airlines flight.

For the sake of clarity and the specific purpose of the article, I’m not going to elaborate on the complete baseline for this anchor point, but I recommend that you first go through the baselining process and then consider how the following commentary would fit into the larger established norm.

• Passengers stand in line in numerical order in their assigned boarding group. This forced channelization helps the gate attendant observe the behaviors of those about to board by separating them from the other people sitting in the area.  Members of this group might show elements of familiarity or unfamiliarity, based on how frequently they fly, but if a passenger shows familiarity with one stage of the boarding process for a Southwest flight, they should show familiarity with all steps in the process.  Those familiar with Southwest’s boarding process should also behave in a way that indicates comfort.  As passengers line up to enter, the gate attendant could focus her attention on someone displaying familiar cues yet are also uncomfortable.  This could be due to an annoying or loud traveller nearby, but the deviation from the familiar and comfortable will identify someone who stands out and can let the attendant know to contact this person and attempt to discover the cause.

• The flight attendants and pilots would also show a high degree if familiarity with the boarding process. This familiarity is common with insiders and they have a great deal of experience in airports.  Even if they are in an airport they haven’t travelled through before, because all Southwest gates are set up the same, they should be very familiar with the layout and the process for them to check in and board the plane. The pattern of flight attendants would be different from passengers in three areas.  First, they won’t be waiting in line like the passengers.  Second, the flight attendants would also show that they have a pre-existing relationship with the other members of the crew as many teams work together day in and day out. As they walk up to the gate, I would expect them to be arriving as a group and being friendly towards each other in a way that I would not expect from passengers who were not travelling together. Finally, because flight attendants regularly work the same route, they might also show indicators of familiarity with the gate attendant at the airport. While flight attendants and passengers both have a process for boarding the plane, the processes are different enough that they both required being defined and differentiated.

• When observing the maintenance staff working at the gate, they might not have a clear boarding process the way the passengers and the flight crew do, but they exhibit behaviors that would indicate familiarity.  The maintenance staff might not have a pre-existing relationship with the flight crew on a personal level, but may display familiarity based on the responsibilities that each provides while the plane is at the gate. For example, a member of the maintenance crew would know which attendant to talk to if there are any problems, or to let them know when they are complete with their work.

By establishing a baseline and expanding on the behaviors and details for each and every group that has access to an anchor point, you now have a very well-defined norm and can begin planning your penetration test.  

Step 2 – Red Cell: It is at this point where the red cell comes into play where you can identify the specific behaviors that would deviate from this baseline and begin to outline possible causes for each.  If the baseline is comfortable, define why a member of the flight crew would display over-the-top-dominant, uncomfortable or submissive cues.  You can also define how a member of these groups might act if questioned or challenged when they are innocent and when they have violent intentions.  This red cell phase is the planning time of the penetration test and a chance to look objectively at each possible situation and vulnerability.

Step 3 – Test: Once you have established a baseline and red celled how a criminal would behave in different scenarios (dominant, submissive, uncomfortable, comfortable) you can instruct the people tasked with testing the security measures on specific behaviors they should exhibit in their probing attempts.  The person responsible for maintaining security at the gate first has to know how to observe and classify each cluster of behavior, and this is an opportunity to coach and mentor the attendant on the behavior she observed of a passenger and how she did (or didn’t) respond.  The goal of the actual test is to not determine which group of insiders is the risk, but to determine the vulnerabilities in the bouncer and coach that person to greater effectiveness.

This ability to coach the guards is one additional benefit to defining the role of the bouncer the way we did in the “Identifying Anchor Points” article.  By understanding the dominant cluster of behavior, you can mentor your guards (or whoever is tasked with scanning those approaching your building, police department, or patrol base) to determine how intense a display of dominance is required to meet your security goals. If there is an event at the building you are responsible for protecting, maybe you choose a higher-intensity dominance for the special circumstances that wouldn’t be necessary on slower days. By looking at each behavior in the cluster, you can tailor the security posture to meet the needs as well as compensate for guards less capable at observing the subtle behaviors that he should be searching for.

Testing Your Anchor Points: As we have noted throughout this issue, treating an anchor point like a habitual area, or simply assuming that security is effective, is extremely risky.  Even if your anchor point doesn’t require the same degree of security as an airport terminal, it doesn’t change the need for penetration testing. While an airline is attempting to reduce the risk of flying as much as possible, some office buildings might accept a greater degree of risk because of a lower probability of attack. Regardless of where on the security spectrum you are operating, the penetration test is designed to identify the vulnerabilities that a security plan is supposed to address.  How the security gaps that you find in your penetration testing get fixed is a decision often made by top-level leadership, but the objective planning and testing that I’ve talked about in this article and in this issue of The CP Journal provides those leaders with the information needed to make intelligent security decisions.

Like animals, humans are territorial. Territoriality is rooted in our DNA. On a daily basis we make a claim to the space around us. We protect our “personal space.” We place pictures and other personalizing items on our desks and workspaces to ensure that other people know this is our space. If we are students, we sit in the same seat on a daily basis and then get upset if someone sits in that seat one day, because it is “my seat.” We place “no trespassing” signs on our property. We look at people strange if they get too close to our cars. Territoriality has been defined as: “an individual’s behavioral expression of his or her feelings of ownership toward a physical or social object” (Brown, Lawrence, and Robinson, 2004). In other words, humans develop feelings of ownership over the space around them and objects they normally interact with, and they express this ownership through subtle and overt signs—through aggressive postures, explicit warning signs, proxemic behavior, and other such indicators.

Continue reading »