The role of physical security has expanded and grown rapidly over recent years. Below are some of our observations, particularly throughout the pandemic, and a look towards the changing times ahead. 

The new era of physical security

The role of private security has shifted dramatically over the last decade and beyond. Historically, the focus was on protecting assets such as property and goods, but more frequently now the sector is being asked to play an even bigger role in protecting the public from physical danger. During the current coronavirus pandemic this has increased to high profile marshalling in city centres and public areas to ensure social distancing is in place, as well as managing people and traffic through COVID-19 Testing Sites.

The role of private security has shifted dramatically over the last decade and beyond

As these responsibilities have changed so to have the expectations on the industry, which are now wide ranging. However, this is not a new phenomenon, as we have seen how this has specifically impacted on the role of door supervisors in recent years. Whereas this primarily used to be focused on protecting the venues themselves, this role has now expanded with the same door supervisors finding themselves responsible for areas beyond merely the front entrance. Not only are they fulfilling the traditional role, but they are increasingly relied upon to provide welfare and support far beyond the traditional remit.

Credit needs to be given to the industry and those within it who have driven these changes, particularly with regards to what can be termed ‘safeguarding’. Whilst mandatory SIA licence training includes specific guidance and instruction for 'safeguarding', or how to help vulnerable people, it was instigated by the industry itself. As a result, now the person being refused entry to a venue due (for whatever the reason), now finds themselves often being helped by the door supervisor, for example, by arranging a taxi for them, rather than allowing a young and/or vulnerable person - perhaps separated from their friends, to wander off alone into the night.

Pandemic constraints

Throughout the pandemic, security operatives are being deployed to provide a positive physical presence to support and instil the importance of social distancing, mask wearing and to ensure the safety of the public. Who would have thought that in 2020 it would be commonplace to see the vast majority of supermarkets, large and small, with an obvious security presence!

Filling a void (changing responsibilities)

Alongside this, and for some time increasingly private security has been asked to fill a vacuum created by greater demands on policing and consequently they have naturally moved towards contributing to what can be termed 'place management'. The latter was a concept that primarily came about as efforts increased to 'revive' towns and city centres where a safe, welcoming, inclusionary environment was seen as critical to attracting a wider demographic, rather than the dominant economy being centred around night-life, which was seen as the domain of the 'young'. You may have read about efforts to diminish the distinction between the day, evening and night-time economies and replicate what was happening in the large out of town ‘retail’ centres e.g. the Trafford Centre in Manchester. There you can shop, eat, drink, watch a film, bowl almost at any time in the day. Towns and cities have increasingly tried to replicate this, for example asking other venues, such as museums to stay open longer.

Responsibilities have also shifted towards enforcing legislation when appropriate, particularly at a local level

Consequently, with greater expectations placed on private security operatives today, as well as their traditional role of protecting property and people, their skill set is extending to include a greater emphasis on customer service and being well voiced in welfare issues. Also, responsibilities have also shifted towards enforcing legislation when appropriate, particularly at a local level, which is further evidence of security operatives increasingly taking on duties and responsibilities which have previously always been in the remit of the police or other enforcement personnel.

Framework schemes to facilitate this have transited online, and been under public scrutiny, most notably the Community Safety Accreditation Scheme (CSAS). CSAS allows Police Chief Constables to 'allocate' powers to accredited security providers operating in their geographical regions, which whilst it has been in existence for many years isn’t probably widely known about beyond the industry itself.

Training must meet the need

This leads to the question of training: we need to talk about training and what’s necessary in this new era of security, in line with the increased expectations and responsibilities of the security operative.

Where does the role of private security start and stop? All regulated security operatives have been given specific training to gain their SIA licence, and many companies operating in the field of large-scale crowd management offer their own bespoke learning and development. Such training can include:

  • Stages and pits (area found in front of the stage)
  • Externals (often outside the footprint of the licensed venues)
  • Directional stewards
  • Roaming response operatives

With such courses being optional and unregulated, how do we create an adequate baseline skills base?

Whilst some of this training can be accredited and/or included in recognised qualifications it can be the case that security providers have developed their own ‘guidance’, which for some companies is used to respond to emerging risks. The industry being asked to be integral to the pandemic response is an example of where companies are putting together guidance, which may be based on emerging central Government thinking.

The science of large-scale events

Over the years we have seen a real boom in events. Specifically, large scale (50,000+) music events are no longer restricted to festivals and have been seen as a lucrative source of income, for example, the use of football stadia in the closed season, to maximise year round usage.

For example, a number of years ago Manchester City Football Club staged the return of Take That resulting in a wider demographic attending events, from your older fan, probably with children the same age as they were when they last saw them live, to young children attending their first live music event and everybody in between. Safely managing these types of 'diverse' event and crowd management has become a science in its own right with many considerations including crowd dynamics, crowd behaviour, ingress and egress planning, transport plans and of course, contingency planning for the unexpected.

Maintaining public safety – applying the science

Consequently, if the overarching aim for any pandemic response is public safety, then the objective for the security industry should mirror this, aiming to maintain complete safety for the public.

If the overarching aim for any pandemic response is public safety, then the objective for the security industry should mirror this

This should always include managing the flow of people in highly charged environments, now with the added consideration of social distancing in what are worrying times for the average person on the street. Private security has a pivotal role to play as social conventions are rebuilt and the world grasps its new normal. Where you want to gain compliance by cooperation then it needs to be certain that the security operatives are: "the right people, in the right place, at the right time, doing the right things and working alongside the right partners". We believe that this can only be achieved by applying science to these situations, a skill that that is second nature to those who routinely deliver effective security.

We need to clarify the role of manned security providers covering the limitations and extent of their responsibilities. This needs to be unanimous across the licensing bodies, employers and public in order for operatives to fulfil the role and an industry benchmark set. Security firms are not the police, BUT it is important to note that their role is integral to keeping people safe.

Download PDF version Download PDF version

Author profile

Mark Burtonwood Non-Executive Strategic Director, FGH Security Ltd.

Mark Burtonwood is a Non-Executive Strategic Director for FGH Security, a market leader in social distancing and crowd control solutions.

In case you missed it

How AI and security guards work together using video analytics
How AI and security guards work together using video analytics

How AI and humans can work together is a longstanding debate. As society progresses technologically, there’s always the worry of robots taking over jobs. Self-checkout tills, automated factory machines, and video analytics are all improving efficiency and productivity, but they can still work in tandem with humans, and in most cases, they need to. Video analytics in particular is one impressively intelligent piece of technology that security guards can utilise. How can video analytics help with certain security scenarios? Video analytics tools Before video analytics or even CCTV in general, if a child went missing in a shopping centre, we could only rely on humans. Take a crowded Saturday shopping centre, a complex one with a multitude of shops and eateries, you’d have to alert the security personnel, rely on a tannoy and search party, and hope for a lockdown to find a lost or kidnapped child. With video analytics, how would this scenario play out? It’s pretty mind-blowing. As soon as security is alerted, they can work with the video analytics tools to instruct it precisely With the same scenario, you now have the help of many different cameras, but then there’s the task of searching through all the CCTV resources and footage. That’s where complex search functions come in. As soon as security is alerted, they can work with the video analytics tools to instruct it precisely on what footage to narrow down, and there’s a lot of filters and functions to use. Expected movement direction For instance, they can tick a ‘human’ field, so the AI can track and filter out vehicles, objects etc., and then they can input height, clothing colours, time the child went missing, and last known location. There’s a complex event to check too, under ‘child kidnap’. For a more accurate search, security guards can then add in a searching criterion by drawing the child’s expected movement direction using a visual query function. A unique function like this enables visual criteria-based searches rather than text-based ones. The tech will then narrow down to the images/videos showing the criteria they’ve inputted, showing the object/child that matches the data and filter input. Detecting facial data There are illegal demonstrations and troublesome interferences that police have to deal with A white-list face recognition function is then used to track the child’s route which means the AI can detect facial data that has not been previously saved in the database, allowing it to track the route of a target entity, all in real time. Then, security guards can confirm the child’s route and current location. All up-to-date info can then be transferred to an onsite guard’s mobile phone for them to confirm the missing child’s movement route, face, and current location, helping to find them as quickly as possible. Often, there are illegal demonstrations and troublesome interferences that police have to deal with. Video analytics and surveillance can not only capture these, but they can be used to predict when they may happen, providing a more efficient process in dealing with these types of situations and gathering resources. Event processing functions Picture a public square with a number of entries into the main area, and at each entry point or path, there is CCTV. Those in the control room can set two events for each camera: a grouping event and a path-passing event. These are pretty self-explanatory. A grouping event covers images of seeing people gathering in close proximity and a path-passing event will show when people are passing through or entering. The video analytics tool can look out for large gatherings and increased footfall to alert security By setting these two events, the video analytics tool can look out for large gatherings and increased footfall to alert security or whoever is monitoring to be cautious of protests, demonstrations or any commotion. Using complex event processing functions, over-detection of alarms can also be prevented, especially if there’s a busy day with many passing through. Reducing false alarms By combining the two events, that filters down the triggers for alarms for better accuracy to predict certain situations, like a demonstration. The AI can also be set to only trigger an alarm when the two events are happening simultaneously on all the cameras of each entry to reduce false alarms. There are so many situations and events that video analytics can be programmed to monitor. You can tick fields to monitor any objects that have appeared, disappeared, or been abandoned. You can also check events like path-passing to monitor traffic, as well as loitering, fighting, grouping, a sudden scene change, smoke, flames, falling, unsafe crossing, traffic jams and car accidents etc. Preventing unsafe situations Complex events can include violations of one-way systems, blacklist-detected vehicles Complex events can include violations of one-way systems, blacklist-detected vehicles, person and vehicle tracking, child kidnaps, waste collection, over-speed vehicles, and demonstration detections. The use of video analytics expands our capabilities tremendously, working in real time to detect and help predict security-related situations. Together with security agents, guards and operatives, AI in CCTV means resources can be better prepared, and that the likelihood of preventing unsafe situations can be greatly improved. It’s a winning team, as AI won’t always get it right but it’s there to be the advanced eyes we need to help keep businesses, premises and areas safer.

Protect physical assets from cyber-attacks
Protect physical assets from cyber-attacks

Recent cyber-attacks have disabled and even shut down physical assets. Robust foundational security and training staff, able to recognise an attack can help mitigate the threat, as ABB’s Rob Putman explains. Edge devices and data analytics As cyber security specialists, we must navigate an ever-changing threat landscape, one that is made even more complex by the increased interconnectivity between Operational Technology (OT) and Information Technology (IT), as companies look to leverage edge devices and data analytics, as well as remote connectivity, in the wake of the COVID-19 pandemic. As the threat surface evolves, the industry must guard against attacks on key physical infrastructure, carried out by a range of malicious actors, including nation states and criminals intent on blackmail. The chemicals sector, a high-value target for cyber-criminals Cyber-criminals view the chemicals sector, as a high-value target, because of the potential cost In 2017, not long after a ransomware attack that targeted Maersk, the world’s largest shipping firm, made the news around the world. Another cyber-attack, this time targeting physical industrial assets, generated fewer headlines, and yet could have resulted in both real, as well as financial, damage. Cyber-criminals view the chemicals sector, as a high-value target, because of the potential cost, both financial and reputational, to the operator, should production be interrupted or stopped entirely. Cyber security vulnerabilities put physical assets at risk The attack in question, a ‘Triton’ custom malware attack on a petro-chemical facility in Saudi Arabia, targeted a safety system, taking over system controllers. Bugs in the code triggered an emergency shutdown, but could have led to the release of toxic and explosive gases. It was a vivid reminder of how cyber security vulnerabilities are increasingly putting companies’ key physical assets at risk. Two more-recent high-profile incidents illustrate my point. In February, a Florida water treatment plant was hacked. The malicious actor remotely accessed the system for three to five minutes, during which time they opened various functions on the screen, including one that controls the amount of sodium hydroxide (NaOH) in the water. The hacker changed the NaOH from about 100 parts per million to 11,100 parts per million, which could have resulted in a mass poisoning event. Colonial Pipeline cyber-attack incident Then, in May, the Colonial Pipeline system that originates in Houston, Texas and carries gasoline, and jet fuel, suffered a ransomware attack. Using a VPN, hackers targeted back-office IT systems, forcing Colonial to shut down IT hosts and network infrastructure, severing communication with those OT systems that are responsible for communicating ‘transactional data’ associated with fuel delivery. In this instance, a single compromised password disrupted Colonial’s ability to invoice its customers. This dependency on OT data stopped pipeline and business operations, and the company was elected to pay the hackers an initial ransom of US$ 4.4 million, in order to restore operations. The Colonial attack was multi-dimensional, in that it not only impacted Colonial’s business, but also the wider US economy and national security, since the pipeline transports nearly half of the east coast's fuel supplies. Outdated IT system elevates physical risk The increased interconnectivity between IT and OT can also create vulnerabilit Attacks such as these prove that, armed with little more than a laptop, an email account and access to the dark web, determined hackers can cause disproportionate damage to physical infrastructure. As mentioned at the outset, the increased interconnectivity between IT and OT can also create vulnerability. Producers often want to know: Is it risky to connect a production asset or their operational environment to the Cloud? My answer is, if you do so without having done any risk audits around people, processes and technology, or without enhancing and maintaining that environment, then yes, that is risky. For example, we often observe that the life cycle of a production asset far outlasts the IT systems that are used to run it. Take a cement kiln. Several generations of plant operators may have come and gone, but that asset may still run, using legacy software, such as Windows XP and why not? Need to replace aging distributed control systems Well, that’s fine, if you are not concerned about having that asset compromised, and all that entails. A ‘flat’ IT network, an aging distributed control system, and machines with legacy versions of Microsoft Windows, all these elements, which are still commonplace in many industries, make it much easier for attackers to find and infiltrate a company, without needing sophisticated tools. The age-old mantra of not interfering with a piece of equipment or software that appears to be working, often applies to the individual assets. For example that cement kiln that are still controlled by the same Windows XP-based control software. However, if we’re honest, things have changed quite a bit, not because something was broken, but because innovation came in. That same kiln control system is most likely connected to other systems, than when first commissioned and that opens it to exposure to threats that it was never designed for. The human element There is a misconception that IoT-connected devices can open companies to risk There is a misconception that IoT-connected devices can open companies to risk, but many recent, high-profile cyber-attacks have been conducted from a laptop, by hacking someone’s VPN, or are a simple phishing/malware attack. In all these cases, the human element is partly to blame. Take the Florida attack. The compromised computer at the water treatment facility was reportedly running an outdated Windows 7 operating system and staff all used the same password, in order to gain remote access via the Teamviewer app, which the hacker was then able to use. Physical and human assets, key to robust cyber security Discussion on the best way to mitigate the threat is often framed solely around specific technical solutions and ignores the fact that robust foundational cyber security is really driven by two very different, but equally important, types of capital: physical assets (e.g. production machinery), and human assets. The truth is that smart digital software and industry-renowned cyber security applications, while critical, are in many cases, only as good as the weakest human link in the chain. Industry would, therefore, do well to ask itself the following question: Do we have a security problem, or a complacency problem? At this juncture, it is important to point out that the majority of companies that ABB works with, are at least aware of the threat posed by cyber attackers, and the potential impact of an attack, on their revenues, reputation and bottom line. User error and human-generated exposures Making sure staff are aware of the threat and training them to respond properly, if they are targeted, is vital However, user error and human-generated exposures are where most of these attacks occur. Those human failures are mostly not due to malicious intent from employees, but to the lack of training of the employees on secure behavior. Making sure staff are aware of the threat and training them to respond properly, if they are targeted, is vital. However, there are also age demographics at play here. Much of the operations employee base is heading towards retirement and often, there is no plan or ability to backfill these people. Need to invest in new digital and automated technologies If you think you don't have enough people now, in order to stay on top of basic care and feeding of the OT environment, with regards to security, what is that going to be like in 20 years? For this reason, there must be a major industry reset, when it comes to its workforce. Companies must invest in new digital and automated technologies, not only to ensure that they stay ahead of the curve and mitigate risk, but also to attract the next generation of digitally literate talent. Robust cyber security is built on solid foundations When we talk about foundational cyber security, we mean fundamentals, such as patching, malware protection, high-fidelity system backups, an up-to-date anti-virus system, and other options, such as application allow-listing and asset inventory. These basic controls can help companies understand their system setup and the potential threats, identify vulnerabilities, and assess their risk exposure. The Pareto principle states that around 80% of consequences come from 20% of the causes. In the context of cyber security, that means 80% of exposure to risk comes from 20% of the lack of security. If companies do the foundational things right, they can manage out a significant amount of this risk. Importance of maintaining and upgrading security controls However, having basic security controls, such as anti-virus software in place, is just the first step on that journey. Equally important is having someone within the organisation, with the requisite skill set, or the extra labour bandwidth, to operate, maintain and update those security controls, as they evolve. Educating, training and recruiting existing employees, and the next generation of talent, along with forging partnerships with trusted technology providers, will ensure that industry can leverage the latest digital technologies, in order to drive business value, and secure physical assets against cyber-attacks.

The EU called for a ban on police use of facial recognition but not commercial use. Why?
The EU called for a ban on police use of facial recognition but not commercial use. Why?

Recently, the European Parliament called for a ban on police use of facial recognition. In the US, too, some cities have restricted police use of facial recognition. The first question that comes to mind is - why ban police from using technology that is allowed to private companies? Point of difference The key difference between the way police use facial recognition and the way commercial facial recognition products work is that: The police get a picture of a suspect from a crime scene and want to find out: "Who is the person in the picture?" That requires as wide a database as possible. Optimally - photos and identities of all the people in the world. Commercial facial recognition products such as those used by supermarkets, football stadiums, or casinos answer different questions: "Is the person in the picture on the employees' list? Is the person in the picture on a watch-list of known shoplifters?" To answer these questions doesn't require a broad database but rather a defined list of employees or a watch-list of specific people against whom there is an arrest warrant or a restraining order. Use of facial recognition AnyVision helps organisations leverage facial recognition ethically to identify known persons of interest "Facial Recognition Apps Should Be Provided to the Police with an Empty Database". This is exactly the subject of the open letter sent by AnyVision, to the British Biometrics and Surveillance Camera Commissioner, Prof. Fraser Sampson, titled: "Facial Recognition Apps Should Be Provided to the Police with an Empty Database". AnyVision recently raised $235M from Softbank and another leading VCs is a visual AI platform company that helps organisations across the globe leverage facial recognition ethically to identify known persons of interest, including shoplifters, felons, and security threats. Ethical use of facial recognition AnyVision CEO Avi Golan wrote, "The ethical use of facial recognition is a thorny one and requires a nuanced discussion. Part of that discussion has to explain how facial recognition works, but, just as important, the discussion must also involve how the technology is used by police departments and what checks and balances are built into their processes.” “We recommend building their watchlists from the ground up based on known felons, persons of interest, and missing persons. Some facial recognition solution providers have scrapped billions of photos and identities of people from social networks, usually without their consent." "Unfortunately, this method of facial recognition has justifiably angered privacy groups and data protection agencies around the globe and damaged the public trust in accuracy and reliability of facial recognition systems.” Preventing invasion of citizen’s privacy We believe an unjustified invasion of citizens' privacy can be prevented, false arrests can be reduced" “We believe that lists of suspects should be limited and justified. In this way, unjustified invasion of citizens' privacy can be prevented, false arrests can be reduced and public confidence in technology can be increased.” Golan added: "AnyVision is willing to share its industry insights and best practices from our vast research experience with leading global players, including name-brand retailers, global hospitality and entertainment companies, and law enforcement agencies from around the world.” Balancing public order and crime prevention “If the regulations set forth by Surveillance Camera Code of Practice are committed to the principles outlined above, then law enforcement agencies can strike the right balance between the need to maintain public order and prevent crime with the rights of every person to privacy and non-discrimination before the law." Recently Clearview AI CEO told Wired; the company has scraped 10 billion photos from the web - 3 times more than was previously known.