Retailers Prepare for Active Assailants
On 12 February 2007, a lone gunman attacked shoppers at the Trolley Square Mall in Salt Lake City, Utah, killing five and wounding four others. Afterward, retailers approached the U.S. Department of Homeland Security (DHS) to ask for industrywide guidance, leading the department to produce its widely shared active shooter resources, such as the “Run. Hide. Fight.” video, training posters, workshops, and other free materials.
“There was no ‘stop, drop, and roll’ campaign for shopping malls in the event of an active shooter,” says Bill Schweigart, chief of the Critical Industries Branch at DHS, which includes commercial facilities like retailers. “It was with our retail partners, commercial facilities, and our law enforcement partners that the first active shooter preparedness materials were developed.
“More than just about any other industry,” he adds, “the retail partners have been really leaning forward on this issue; it’s been top of mind, and they’ve been leading the charge.” Schweigart says that 2007 was when the seeds of the program were planted: “It was a direct result of our engagement and listening and being attentive to the retail industry.”
As far as soft targets go, retail locations are unique because of their open public access concept of operations, says William “Shannon” Brown, chief of the Commercial Facilities Section of the Cybersecurity and Infrastructure Security Agency (CISA) at DHS. While sporting arenas and movie theaters may have ticket checks or magnetometers, retail stores rely on promoting free, easy access to the facility. This is essential to their business model, but restricts access control options from a security perspective, especially for shopping centers with multiple entrances.
With so many tenants, employees, and customers in a concentrated area, shopping centers are inherently target-rich environments, says Robert Moraca, vice president of loss prevention for the National Retail Federation (NRF). In recent years, retail centers have been the site of terrorism, workplace violence, domestic disputes, active shooters, and vehicle-borne attacks. However, malls may not wish to fortify their facilities, especially with online shopping options luring consumers away from brick-and-mortar locations.
Therefore, retail organizations are focusing on preparedness and training to address active assailant risks.
In May 2016, a shooting occurred in the parking lot outside Westfield Montgomery, a shopping mall in Bethesda, Maryland. Customers fled into the mall, informing retail associates of the situation. Managers at the mall’s Microsoft store made the decision to protect their customers and themselves by locking down the location and eventually closing for the day. “The best person to make that decision is the management in the store at the time,” says Alan Greggo, CPP, CFE, senior regional asset protection manager for Microsoft’s real estate and security operations. “Their training helped them make the right decision.”
Greggo, who is a member of the ASIS Retail Asset Protection Council, regularly visits the Microsoft retail locations in the mid-Atlantic to provide awareness training and answer questions for employees and managers about best practices and procedures. Training is also provided during onboarding, and it continues throughout the employee’s career in the store.
Because retail stores experience high turnover, especially among frontline employees during high-traffic seasons like holidays, top-down training is essential. Managers and shift leaders are more likely to remain in one job for a longer period, and they can serve as security authorities during an incident. They can also regularly review security and emergency response procedures in morning huddles, during coffee meetings, and throughout the day.
Microsoft also created an emergency response booklet for the stores to use that outlines how to respond during incidents such as weather events, active assailants, robbery, or civil disturbances. The booklet outlines when to call 911 and what information to share; how to communicate with customers during an emergency; and how to evacuate safely so first responders understand at a glance that they are not a threat. Managers can start with this general corporate emergency response plan and then tailor their specific directions to their location and particular needs. A kiosk with one employee at a time should have different emergency response procedures and training from a storefront with a full-time staff of 10 or more associates and a lockable back room, for example.
“The chances of a shooting in a mall are like your chances of being struck by lightning,” Greggo says. “It’s uncommon, but not impossible.”
“The best way to prepare is to train,” says Moraca. “In an emergency, you play like you practice. You have to have situations where you train, even if it’s just a tabletop exercise or a video.” Retailers can benefit from the active shooter training younger workers will have already experienced in schools, he notes. From there, retail managers can build on that knowledge with site-specific information while getting older retail associates up to speed.
Many retailers start with an all-hazards emergency management plan that covers the basics, such as evacuations, sheltering in place, and working with first responders. The free resources from the Federal Emergency Management Agency, the NRF, and DHS prove useful in these cases. Moraca recommends hanging bilingual training posters in the breakroom or even inside employee bathroom stalls to ensure emergency procedures are read.
While the DHS materials are a great baseline to start with, “any individual facility must have its own emergency action plan, and that must be tailored,” says Brown.
“An all-hazards approach really focuses on natural disasters or manmade disasters. With active shooter, we’re really looking at a specific event with a perpetrator,” says Michelle Flores, chief of the CISA Active Shooter Preparedness and Security Program at DHS. “The motives are very different, often the time of day is different. Typically it’s a very quick event, and it’s unexpected. But there are several things a retail owner-operator can do to prepare for that. If they develop an action plan that incorporates things like Run. Hide. Fight.—not always in that particular sequence—it gives them options along that spectrum.”
The NRF is in the process of updating its retail-specific supplemental guidance to the DHS materials to provide additional insight and guidance, as well as tailoring language to fit retailers’ needs, such as changing “Run. Hide. Fight.” to “Evacuate. Shelter in Place. Take Action.” and shifting “active shooter” terminology to the broader “active assailant.”
Under duress, communication often becomes clouded so even broad phrases like “run” or “hide” are difficult to follow without panic, says Moraca. Simple, common phrases and commands like “evacuate” or “shelter in place” instead give clearer direction and prompt employees to fall back on their training. These phrases also provide a common language shared by the public, store management, mall operators, first responders, and medical personnel.
Retail employees should also have clear instructions on how to direct and protect customers. While employees cannot compel anyone to shelter in place or evacuate against their will, most customers are looking for guidance and want to follow direction in an emergency, says Moraca. “Individuals have the right and responsibility to make their own personal risk management decisions,” he says. “You can guide them, but you can’t force them.”
This dilemma—and the options available to staff—should be addressed early in emergency preparedness training and reinforced regularly through continuous education. Having additional guidance on how to instruct, help, and protect vulnerable populations such as children or people with disabilities should also factor into training and emergency management plans, Moraca adds.
Facilities should have a primary point of contact (as well as a succession plan, in case that person is unavailable) for first responders to work with when responding to an incident. That point of contact should have easy access to keys, floor plans, contact information for tenants, and the emergency management plan to share with law enforcement, says Brown.
In emergency response planning, “one of the pitfalls folks have is not contacting their first responders, not having a relationship with the local police department, or not knowing who your fire chief is at the closest station,” he adds. “Those are things that are not all that hard to do, but they pay huge dividends if there is an incident at your facility.”
“There’s an old adage in the world of crisis response: you should never be first shaking hands with your first responders at the scene of an incident,” says Moraca. “You’ve got to meet them ahead of time, let them see your facility and walk them through, and host drills.”
The same goes for property managers. Real estate company Macerich, which manages or has investments in 55 shopping centers across the United States, holds four drills each year, and they are all tailored to each individual facility. In California, earthquake drills are more prominent than tornado drills, for example, but every facility holds one active assailant exercise per year, involving tenants and first responders alongside property management personnel.
“We can’t compel our tenants to do anything during an incident; it’s their space,” says J. Christopher Woiwode, vice president and CSO for Macerich. “But we can share information, our best practices, and suggestions; outline the Macerich action plan; and invite them to participate in drills.”
The rising rate of active shooter incidents is making shopping center owner-operators and retailers take note and seek additional ways to participate and prepare. According to FBI data, there were 50 active shooter incidents from 2016 to 2017, compared to 40 from 2014 to 2015. “Statistically, it’s unlikely, but we have to be prepared,” says Woiwode. “People are taking it more seriously.”
Woiwode notes that security leaders and store managers should prepare employees for an accurate timeline of an active assailant incident. While the event itself is usually short (often over within 10 to 15 minutes), clearing a mall can take hours. In these events, having a communications plan to send updates to tenants throughout the process via mass notification tools, text, email, telephone, intercom, or even bullhorns can help mitigate unnecessary stress. The exact tools in use can be tailored to the needs of each location; an outdoor shopping center with a large footprint might benefit from text alerts while a smaller indoor mall could use radios or speakers.
Lapses in communication can be frustrating and frightening. In the active shooter incident outside the mall in Bethesda, it took more than an hour after the incident was over for the mall to send an official notification to tenants about the event, leaving retailers hanging over the decision of whether to evacuate, shelter in place, or close down for the day.
“Shopping centers aren’t always going to communicate during emergency incidents with a degree of urgency,” says Greggo. In this case, “they thought they needed to be accurate and they needed more time to find out what actually happened before they started reporting. Some companies that operate shopping malls are much quicker to notify; they do it electronically, they send text messages to employees’ phones....But for this particular incident, there was a breakdown in communication.”
In addition to looping in first responders, retailers, and property managers, Flores says mall operators and retail security professionals should consider strengthening the communications component of emergency management planning around active assailant events, because they attract additional media attention. Having a designated public affairs officer on point as part of the emergency management team ensures that they are involved in training, they understand what the emergency action plan is, and they are available to address the press and the public early.
Communication and messaging should also factor in the unique demographics for that store or shopping center. For example, the public affairs officer should have statements prepared in multiple languages to warn people away from the location during an incident, as well as to welcome them back once the incident has ended.
Moraca recommends putting proactive measures in place to detect potential threats early, including reporting mechanisms for suspicious individuals, aggressive current or former employees, or retail associates with tenuous domestic situations that could escalate to violence.
“Few acts like this are truly random,” says Woiwode. “There is usually some recon done in advance, so we try to educate our retailers and guards to look for people bringing in large bags or to identify behaviors linked to risks.”
Woiwode also works with a network of mall developer CSOs, sharing information, trends, behavior to watch for, and good practices, while offering support and advice after incidents. “We’re unlikely to be able to provide help during an incident, because they happen so fast, but afterward I would share advice on how to deal with the press, or whether to allow a memorial on site, based on past experiences we’ve had in our properties,” he says. “We’re not keeping secrets in security.”
“The stakes are high for branded retail,” says Moraca, reflecting on stores and theaters that have closed after active assailant incidents. “No one wants to be the next headline.”
Claire Meyer is managing editor of Security Management. Contact her at [email protected]. Connect with her on LinkedIn.
