A New Course for Card Access

​

The State University of New York (SUNY) is a multiple-campus university system with more than 413,500 undergraduates and graduates and nearly 81,000 full-time and part-time employees, making it the largest public higher education system in the United States. Its flagship school is the University at Albany (UAlbany) where access control upgrades are currently occurring on its three campuses—Uptown, Downtown, and East. Founded in 1844, UAlbany has a 2005 enrollment of approximately 17,000 undergraduate and graduate students. It employs 920 full-time faculty members. The Uptown Campus is the main academic and only student residence area of the school, while the other two campuses contain a graduate library, academic and administrative buildings, as well as tenants such as pharmaceuticals maker Albany Molecular.

UPTOWN EXPANSION. There are five residence quadrangles on the Uptown Campus. Each quad houses approximately 1,200 students in eight three-story halls and one 23-story tower. The quadrangles also include lounges, recreation areas, dining facilities, and classrooms. The fifth quad is composed of apartment-style living for several thousand more students. There is also a massive Campus Center, two libraries, a performing arts center, a sports complex, and academic and administrative buildings.

According to Brian McCarthy, SUNY card systems administrator, the first generation of electronic access control on the campuses was installed a decade ago “when the vice president went to a conference, heard about it, came back, and said ‘we’re going to have door access.’ This was around the time of the one-card movement when we were already working on consolidating library usage rights, food service, and student ID.”

UAlbany’s first foray into controlled access had included 250 Gryphon (now Diebold, which purchased Gryphon) readers and controllers on exterior doors mostly on the Uptown Campus. Using the Gryphon base technology, Diebold evolved a card access control system called CF Gold.

Last year, a major upgrade and expansion of the CF Gold system began with the construction on the Uptown Campus of a new life-sciences building and the rehabbing of two floors of the humanities building. In the latter, the system would control exterior doors as well as interior doors to rooms where the theft of AV equipment and other materials had been common.

Originally, the project called for a hardwire version of the CF Gold system. Just as installation was about to begin, Diebold mentioned it was preparing to release a wireless version of CF Gold using Schlage Wyreless Access readers that linked to its Squadron controllers. Going wireless, says McCarthy, was recognized by the installation team as a way to significantly reduce the cost.

UAlbany’s Uptown Campus was built in the 1960s in modernist style. “It’s the second largest concrete facility outside of the Pentagon, and running wire is difficult and extremely expensive. It often costs more to run the wire between the parts than the parts cost themselves,” says McCarthy. Even though the product was not ready for release, McCarthy, his fellow card systems administrator, Ryan Webb, and others on the team convinced Diebold to let the school serve as a beta test site.

After transmittal tests for signal strength, it was determined that the wireless system would “work well horizontally, but not vertically,” says McCarthy. The signal strength problem was solved by placing a controller that transmits wirelessly to the card readers on each floor. This also leaves the proverbial door open for inevitable further expansion. The controllers are either hardwired or transmit their information wirelessly to the SUNY card office. Alarm conditions are sent to the campus police.

Originally, the reader-to-controller ratio was one to one, but the cost of having controllers on each floor was mitigated when a later model improved the ratio. The Diebold Squadron controllers now installed can—depending on the model—handle either 16 or 32 doors.

During the humanities building installation, $25,000 was saved by using the wireless system, McCarthy says. Webb adds that the system will yield a return on the investment each year as it enables the university to avoid paying out replacement costs for expensive high-tech equipment that was being stolen or vandalized before the installation.

The theft problem arose because the humanities building contained “smart classrooms” fitted with computers, laptops, and AV equipment; it presented an attractive target and was the perpetual victim of theft and vandalism. The solution to this costly problem was obvious: the doors to these rooms should be locked after school hours. But security was never able to fully enforce compliance with this policy.

By installing the new automated access controls, security was able to enforce the rule. Now the smart-classroom doors automatically lock at 8 p.m. As a result, the asset losses have trended down.

McCarthy notes that a major supporter of the system expansion is the school’s physical plant department, which used to have to worry about key management on all those doors before the card readers were installed. “They love the system because it saves them money on keys,” he states.

Software. The system is run by CF Gold software that resides in the SUNY card office. There are currently about 52,000 active records in the software database of students, staff, contractors, guests, and conference attendee cards. Before new students arrive, information about their specific access rights is supplied by the resident life department and preloaded into the software database.

CF Gold software is extremely flexible, but when you take advantage of that, you do sacrifice simplicity. “Flexibility is directly proportional to complexity,” McCarthy says.

“You can set it up to do one thing and then never touch it again, but it’s one of those systems where the deeper you dig, the more you can get out of it. For example, we get the information on where students live from Resident Life and from it we build a multilayered schedule. So, if you live in Johnson Hall, you get 24/7 access to the hall. You get access to the other buildings in your quad and your dining hall from 7 a.m. to midnight, and you get access to the dining halls in other quads from 7 a.m. to 8 p.m.” Under the previous system, three separate schedules would have been needed, McCarthy explains.

Another improvement to the software is a function called “calendars” that allows the system to automatically make changes to access rights on special days. As an example, “Spring break starts Friday at 6 p.m. All students need to be out by that time, but resident advisors can stay until midnight,” he says.

The SUNY card office programs the special access restrictions for the entire academic year each August. “The software will handle the turning off and back on of the students’ access by downloading the information to the controllers seven days in advance,” he states.

Badging. When new faculty or staff members are hired, they go to the SUNY card office to be photographed and receive their badges. The academic affairs department assigns access control rights to faculty, while human resources does the same for staff and for tenants on the east campus, whose cards feature a different design from UAlbany students and teachers. Contractors are issued generic temporary access cards by the university’s physical plant department.

Freshmen are taken to the SUNY card office, where McCarthy and Webb photograph them and create their IDs. Returning students do not need to come to the SUNY card office at the start of a new school year. The only reason to come in is if the card is damaged or has been lost.

Campus police accept reports of lost cards and relay them to the SUNY card office. The police can also issue a temporary card for the student to use until the SUNY office is open.

The university’s Web site will soon allow students to report a damaged or lost ID and to deactivate it online, so the time between reporting a lost card and stopping access can be shortened. McCarthy, who is aware of the youthful urge to experiment, anticipates a number of students will deactivate their cards at the Web site just to see whether it works. “They will be very surprised,” he says. “Then they will have to come into the office to reactivate it.”

Functionality. The cards grant students access rights to their dorms, lounges, libraries, meal-plan cafeterias, and other buildings during prescribed times. In addition, the cards function as a debit card for snack, laundry, and copier machines. They can also be used for purchases in the student bookstore or in Campus Center eateries such as Sbarro.

Training. Student training on security generally and on the access control system in particular is handled by the resident life department. Each summer, two batches of incoming freshmen per week arrive for a campus orientation program. Part of the orientation training includes mandatory sessions on student security and safety, including issues such as the importance of never helping anyone who does not have an access card to gain access to a residence hall or lounge.

It is also at this time that students get their photos taken and their cards issued. Instruction on use of the access control system is brief, but students have few problems using the system. The most memorable student difficulty was one freshman who was unable to distinguish which quad she lived in and repeatedly tried to access the wrong dorm.

“We really don’t see them as needing a lot of formal training,” says Webb. If they don’t know what to do, they watch others, she says. However, there is a plan to tack up informational fliers near each controlled door discussing issues such as “Why your card might not work here” and “What do you do if your card doesn’t work?”

The resident life instructors also highlight the importance of being generally aware of one’s surroundings and safety. For example, they might tell new students about the case in March 1998, when a UAlbany sophomore named Suzanne Lyall disappeared moments after exiting at a bus stop inside the Uptown Campus.

In the wake of Lyall’s disappearance, the school developed campus initiatives such as the sexual assault awareness and prevention program and the safety escort service. It also adopted a community-policing model that took campus police officers out of their vehicles and placed them on prominent foot patrol. These efforts have led to a marked decrease in both violent and nonviolent campus crimes.

Faculty. The faculty had—and still have—the most difficulties with the access control system, according to Webb and McCarthy. Aside from being left out by managers or locked out by public safety personnel who’ve accidentally manually locked their classroom door, “many work in buildings that are open from 7 a.m. to 10 p.m. They don’t have to use their cards anywhere near as much as students unless they regularly work on weekends, after hours, or holidays,” says McCarthy. Most of the problems are due to swiping their cards incorrectly or trying to use a damaged card.

Group think. For each university building, a staff member has been selected as manager. He or she is charged with deciding when building doors should lock and unlock. The manager must also divide the user population into groups—for instance, a group with Saturday access, a group with around-the- clock access, or a group with 7 a.m. to 10 p.m. access Monday through Friday.

Before a recent change to Oracle-PeopleSoft enterprise application software, information could not be properly compiled and some people with a legitimate need to enter were overlooked. For example, when the access control in the humanities building was turned on, there was no comprehensive report available of the current semester’s classroom and faculty assignments. Many professors found themselves locked out of their classes and offices on weekends; in some cases, they were shut out altogether.

Webb says that she worked with various managers to create PeopleSoft user-access-rights reports. Her greatest challenge was getting the managers to explore the usage of the various building’s unique user groups. Webb’s job was, and remains, she says, “to help them think appropriately.”

One example of the limited thinking she hopes to prevent was when academic managers forgot that faculty often teach in one building and have an office in another. While managers had created a “faculty” group, they had failed to see the teachers as advisors and planners working out of assigned offices. So the faculty could get into the buildings with their classrooms but not into the buildings where their offices were.

Another misadventure occurred when the manager of one of the libraries eliminated an entire category of building users that she mistakenly believed had become obsolete. Unfortunately, the change also inadvertently locked out the staff members of the university president who had offices in that library and who had been assigned to that access group.

Despite these minor issues, the university is pleased with the way the system works. Webb says that the department’s goal is to “get as many readers on doors with high traffic as possible,” especially on six doors of the athletic facility, which has been notorious for losing keys.

Given all the expensive equipment in that building, there has been a need for constant replacement of the old keys and cores—a costly proposition for the university. Department staff expect that the readers and controllers—by obviating the need for the key-replacement expenditures—will pay for themselves within one year.

Readers and controllers have already been installed at the two Uptown Campus libraries and the student health center. In addition, there are plans to add wireless readers to suite doors in the low-rise dorms. A new administration building will also be coming online. “And we’re looking at anywhere from 50 to 100 new doors for the next academic year” spread over the three campuses, notes McCarthy.

McCarthy, who says there are now about 400 doors in the system, and no real end in sight to the expansion, believes that UAlbany is gaining a reputation as an expert on access control.

“We have representatives from another university coming down today. Any number of schools have come down to see how we do things,” he says.

And that’s fine with him. Those seeking to learn are welcome, as UAlbany is proud to share its lessons in access control.

Ann Longmore-Etheridge is an associate editor of Security Management and editor of Dynamics.