On 28 May 2022, Real Madrid defeated Liverpool one to nil in the UEFA Champions League final at Stade de France in the suburbs of Paris, France. The football match (Americans: read “football” as “soccer”) was preceded by chaotic scenes outside the stadium that delayed the match by 36 minutes—after which everyone wanted to blame everyone else for the issues.

Those issues included tens of thousands of fans swarming around the stadium area, crowds crushing against fences, police using crowd control tactics including tear gas and pepper spray, local gangs trying to capitalize on the havoc by mugging fans, and an overall unsafe environment. There were several injuries, but no fatalities, and police arrested a few dozen people. Most of the chaos focused on the side of the stadium where Liverpool fans were directed to enter.

One of the peculiarities of the incident is the difficulty in explaining why it happened. Blame was being assigned all over the place depending on who was doing the talking, from blaming counterfeit tickets to poorly performing ticketing apps to untrained or overzealous security professionals to a transportation worker strike.

French authorities initially blamed 40,000 counterfeit tickets, mostly from Liverpool fans, as the primary problem, and defended police and security personnel. (The New York Times said its investigation turned up 2,589 attempted uses of counterfeit tickets.) Eyewitness accounts describe a high level of confusion about where fans were supposed to go and anger at heavy-handed security.

The BBC released results from its own investigation yesterday. The following are the main culprits the BBC discovered.

First, there was a logistics planning failure. The New York Times reported that Liverpool requested paper tickets for its fans, and these tickets had two security features in addition to the usual optical QR code—one requiring a chemical pen to confirm and one laser engraving. The initial check for these security features was to take place a short distance from the stadium, and only people whose tickets were activated at this checkpoint would proceed to the QR code readers at the stadium.

The space allotted for this check, which the BBC reported took 10 to 15 seconds per ticket, was not large enough. That’s where the transportation strike comes in. The strike affected which train station the Liverpool fans were directed to arrive at, and the chosen site was quickly overwhelmed hours before the match was set to begin. Authorities deemed the checkpoint was becoming unsafe, and so it was abandoned. This caused massive delays at the stadium entry points.

Witnesses raise new questions about Champions League chaos at final in Paris https://t.co/45Nn7tegQE

— BBC News (UK) (@BBCNews) July 12, 2022

Next, the BBC says it interviewed many people who said another problem was a faulty ticketing app for digital tickets. People with legitimate tickets would show up at the stadium only to discover that the app was not showing the necessary QR code, with witnesses also reporting that codes would need to be scanned multiple times before they would register.

Finally the BBC looked into the issue of the stewards who were hired to help direct and control the crowd. The head of the French Football Federation told the French Senate that it hired 1,700 people to work as stewards from private security companies, and that all of them had a professional certificate with on-site training. The BBC investigation called into question the testimony, noting France’s security code does not address these personnel or the need for them to have certification in the capacity for which they were deployed.

"I think what was striking was their age," Ronan Evain told the BBC. Evain is head of the fan association Football Supporters Europe, and he was at the scene. "Extremely young students, even just out of high school, not very well trained. Some were reacting, feeling a bit of panic probably; pushing back the crowd in ways that were really not helpful."

Ultimately, French Authorities and the UEFA received the equivalent of a bloody nose over the problems at one of Europe’s most high-profile events—the Paris police chief may be hastening his retirement as one result. The game was delayed, which was an embarrassment for the UEFA, and the initial explanations put forward from authorities seemed to blame English football fans instead of poor logistical planning. But dire consequences were avoided, unlike at the Astroworld music festival in Houston, Texas, last fall.

After that tragic incident, ASIS member Bill Edwards, CPP, PCI, PSP, offered an examination of security and safety at large outdoor events, whose lessons are applicable to scenarios such as the Champions League game.

He described how venues—and local authorities—should approach a threat, vulnerability, and risk assessment for such events. Edwards said a good assessment would do the following:

• Provide venue owners and operators with the ability to identify reasonable and proportional threats and hazards and the overall risk to the property, people, and staff.
• Prioritize the threats/hazards to support the level of risk mitigation required at the venue to buy down risk before the event takes place.
• Allow for internal and external staff to organize, train, and rehearse prior to executing to gain familiarity with each other and develop standard operating procedures (SOPs) for routine and emergency situations.
• Determine if existing control measures are adequate for the upcoming event. If areas are identified as inadequate, recommendations for improvement are an outcome of the process.
• Give the venue owner or operator the ability to assess the negative impact on an event if any of the scenarios materialize.