When Aaron Alexis entered the Washington, D.C., Navy Yard on September 16, 2013, and began a shooting rampage that ultimately left 13 dead, including the shooter, officials followed the usual protocol by calling for anyone who could safely leave the building to do so. Hundreds of government contractors and military personnel followed that advice. The evacuation probably saved lives. But then people who left the building were assembled and bused to Nationals Park, where they were interviewed by police and able to meet with family members. That could have put them at risk anew if they were targeted while waiting for the buses or if the assembly point was already known to the attacker.

While rallying points are accepted as a best practice, they probably shouldn’t be, according to Felix Nater, president of Nater Associates, Ltd., who spoke at a meeting of the Mid Atlantic Disaster Recovery Association (MADRA) in Arlington, Virginia. The problem is that the rallying point is typically a well-advertised location, often near the facility. Anyone with bad intentions could plant a bomb there ahead of time, then create an incident inside a facility, leading everyone to head to the rallying point, where the bomb awaits their arrival.

“Why do we have to rally the people at a centralized location?” Nater asked. “We’re all adults, so why can’t we just...go home?”

He suggests that companies could use mass communication and notification systems not only to send employees alerts about an emergency situation but also to allow employees to let the company know they are safe.

And it should be emphasized to employees that it’s their responsibility to use the system—whether it’s to call a number or send a text or e-mail—to indicate that they’re safe.

One system that Nater mentioned, talking with Security Management after his MADRA presentation, was Amerilert, which “sends out a message to any form of communication, or computer, including texts and e-mails,” he explained. “Personnel have the option to select the forms of contact and can update their own information.”

Created by Omnilert, LLC, of Leesburg, Virginia, Amerilert is a cloud-based system that covers the “full continuum of an emergency situation” by allowing administrators to customize alert communications to employees, members, partners, volunteers, and the public before an emergency occurs so they have a response plan in place, says Ara Bagdasarian, CEO of Omnilert. These messages are crafted and saved in the Amerilert system, where they can be issued simultaneously through text messages to mobile phones, e-mails, landline phones by voice calls, RSS readers, Web site pages, and more to reach everyone who might be impacted by the situation.

Administrators can set up accounts on the Amerilert Web interface and create groups that they would like to communicate with, such as employees at a specific office location. Those employees are then invited to become subscribers, setting up their account information and providing the correct contact information.

When an emergency occurs, such as an active shooter scenario, the administrator can initiate the Amerilert system through the Internet, or via phone, to begin pushing alerts to subscribed employees so that they can take the proper precautions for that situation, whether that’s sheltering in place or evacuating the building.

Once employees have received the initial emergency notification alerting them on what to do, they can respond—using e-mail, a text message, or a phone call—to confirm that they received the alert and to let the administrator know when they are no longer in danger if the administrator desires.

However, this isn’t always a good requirement to put into practice, depending on the size of the user base. “Part of the potential issue with that is if somebody doesn’t respond back…it might send a false positive that somebody is in harm’s way, or danger,” Bagdasarian elaborates, adding that this can quickly escalate if a large organization is using the system because many people are likely to forget to respond to messages.

Amerilert can also be used for other communications to the employee base—to make other requests, ask other questions—not necessarily only for emergencies. “The technology is incredibly powerful– but what’s equally important is defining when to use Amerilert…if there’s a preventable situation, that’s when you want to use it—define the line of using a mass alert,” Bagdasarian says.

Nater also highlighted Everbridge Mass Notification, a mass notification and alert system from Everbridge of Glendale, California. This system cycles through every form of communication until it reaches the intended recipients, he said. Everbridge allows users to send notifications to individuals or groups, using lists, locations, and visual intelligence. The notification system functions similarly to Amerilert, allowing administrators to create contact groups and initiate alert notifications.

The alert is pushed out to all of the employees’ contact numbers, with “message escalation” following a preference order chosen by the employee. These alerts are pushed out until employees confirm that they’ve received the alert. The system also automatically publishes the organization’s specified communication to designated Web sites, Intranet sites, internal systems, and social media to ensure that everyone receives the alert in some format.

Once employees receive an alert, they can respond to let their administrator know that they received the alert, that they’re taking the proper precautions, and that they’re safe. The system also allows feedback through RSS feeds and social media networks.

These types of notification systems help eliminate the need for rallying points in case of an evacuation, which avoids the potential vulnerability to a secondary attack that a pre-announced or highly visible assembly point can create.

Security professionals just need to think creatively. “All it takes is software, and it’s out there,” Nater said. “We just have to change our ways.”

An App Approach to Emergency Communications

Last October, as a participant in a Virginia statewide earthquake drill, George Mason University (GMU) rolled out the notification feature of its new mobile application geared towards emergency preparedness, says David Farris, GMU’s director of emergency management and fire safety.

The university is using Irving Burton Associates’ (IBA) In Case of Crisis mobile app that allows administrators to customize emergency information they would like to be available to students, faculty, staff, and administration should an emergency occur on campus. As more students were carrying smartphones on campus, "it became the next obvious step,” Farris says.

Prior to the app, GMU was using traditional methods—posters, television messages, and Web sites—to get information out to the campus community about what to do in case of fire, severe weather, active shooters, earthquakes, and more. The university also printed flipbooks for faculty use, but they weren’t always effective because information would go stale, they would be lost, or people didn’t use them as a reference.

Even though information was also made available to students on the Internet, GMU discovered that many weren’t able to find what they were looking for because of a generational difference, Farris says. “We’ve discovered that students don’t use Web sites the way that my generation uses Web sites, which is we go in, and we search for a Web page, and then we browse through the Web page,” he explains. “We’ve found that students…Google what they’re looking for, and they’ll look at the first couple of things that pop up, and that’s it. And we realized that when we did that, we weren’t finding information we wanted students to have, nor was our information on our Web site necessarily...concise enough for them to reference in an emergency.”

GMU decided to make a change and began looking at mobile apps. This was the summer of 2012 and such mobile apps were just beginning to hit the market. The university was approached by IBA, a Herndon, Virginia, company that had launched its app in 2011 for use at the London Olympics.
 
In Case of Crisis works by allowing institutions to use an online portal to upload individual instructions and safety guidelines that can then be published in an app format available through the Apple App Store and Google Play. Users can download the app, which saves those instructions or a smartphone, where they can be accessed even if cellphone service isn’t available.

Making the information available when networks are down was a main focus of the app building process because often in a crisis situation— such as a tornado—networks are down, leaving people unable to access information that would require a signal, says IBA General Manager Chris Britton.

The university began testing a version of IBA's app in March 2013. IBA added new flashlight and siren features on the recommendation of Farris. “When they started integrating my ideas into their product, that’s when I thought, ‘You know what, this could be a really good partnership,’” Farris elaborates.

During the testing period, GMU also realized that it needed to make its emergency response information more concise and more understandable for the university's diverse student body. “I needed to look at (the information) and go, 'Well, would a new student from the Middle East understand what this means?'” Farris says. “And that was important to us also, to make sure that it was intelligible to everybody.”

GMU consolidated the information that would be in the app, which was finalized in August, to nine main topics: Prepare, Notification, Emergency Contacts, Bomb Threat, Disability, Earthquake, Evacuation, Fire, and Hazmat.

Each topic, when touched, opens up a new page with specific instructions of what to do in each scenario. There is also a button on the bottom of each page that brings up a list of university-specific emergency phone numbers that can be called from within the app. These are especially important because the campus may be remote and dialing 911 may get you someone 20 miles away, while dialing the campus police will get you someone 500 yards away, Britton explains.

A link to the local forecast from the National Weather Service and a link to area hospitals was also added under Farris’ recommendation to make an all-inclusive interface. “We hope that once people open up that app, it’s literally the click of two buttons to...call the right person if they needed to,” he says.

The app also allows GMU to use push notifications to alert users of a situation on campus. That feature, as with the phone calls, does require an active cellphone network. GMU will not be using the notifications for emergency alerts this fall as it currently uses its Mason Alert system for alerts, but it will be using In Case of Crisis notifications for announcements of drills—such as the October 17th earthquake drill—and information reviews.

For the earthquake drill, people were directed to the app through an announcement via the university’s emergency notification system. Users were then instructed how to respond to the earthquake. 

The university plans to promote the app through other universitywide drills, including tornado drills and tests of the emergency notification system. However, GMU won’t be using the app for other types of emergency notifications just yet, Farris says.

“We wanted to make sure that we have the resources and the administrative procedures in place to sustain using In Case of Crisis as another means because it would require me to login to a separate system, and I’m concerned that in the heat of the moment, I’m going to find myself buried in the emergency and not able to remember,” Farris explains, adding that he and IBA are working on a solution to automate the process.
 
In addition to the publicly available app that is encouraged for student use, GMU is developing three other versions targeted towards its Executive Council and Emergency Operations staff. These other versions are password- protected to limit access to those who are credentialed to use them, Britton says.

The Executive Council version is focused on what the university needs to do when there’s an emergency. It provides council members with guides to issues that need to be considered, actions that need to be taken, and an order of succession. “So if...our senior vice president can’t reach the president because he’s out of the country, she can go to the app, and she can look at that list, and go, ‘Oh, his successor is so-and-so,’ hit a button, and call that person, or e-mail that person, directly out of the app,” Farris explains.

GMU’s approach is similar to a trend that IBA is noticing in the business community with more and more businesses looking to adopt technology that can help business continuity in a crisis situation, Britton says. “We’re starting to see a lot of interest from corporations that traditionally have treated business continuity more as a Web site-driven thing and what they’re finding is that, well, Web sites go down, Web sites aren’t available when communications go down, and having something that’s a mobile-based solution is really powerful.”