Master Project Physical Security Modeling: Crowd Simulation with Active Hazards !

(15 April 2014) !Timothy J. Karmondy

Department of Computer Science, College of Engineering and Applied Science,

University of Colorado, Colorado Springs tkarmond@uccs.edu !

Committee Members !Jugal Kalita, Ph.D. (Advisor)

Edward Chow, Ph.D. Al Brouillette !

!Abstract: Simulating the behavior of crowds under stress is useful for providing physical security for people in office buildings, data centers, schools, sporting events, transportation centers, and other venues. This project recreates and extends the efforts of Pelechano and Badler, published in “Modeling Crowd and Trained Leader Behavior during Building Evacuation”[1]. This project extends their work by adding active hazards such as a gunman and response options from police and building occupants. !!

I. INTRODUCTION !A. Overview ! This is a serious topic. I’m writing this on the anniversary of the Virginia Tech Massacre. (It was April 16, 2007.) Recent activity of active shooters are sadly recurring and chilling. That being said, I approached this project from a game theory perspective and toned down the violent implications. I used words like “bad guy” and “hurt” instead of the alternatives. In the remainder of the introduction I’ll cover the Motivation, Summary of Key References and Background, and Physical Security Input from Campus Police. Section II contains the implementation. I included the traditional aspects of simulation: model, visualization, simulation & analysis [2]. In the simulation & analysis section I (1) baselined the model against work of Pelechano, et al [1], (2) discussed modeling buildings, and (3) added Active Hazard modeling. Section III contains observations (general observations, concepts arising from modeling buildings, and security implications). Section IV contains possible follow-on work.

Page ! of !1 28

Overall, I was able to build a high-level way finding model with results similar to those of Pelechano, et al [1]. Modeling buildings added a bit more complexity but with some simplifications, the model behaved well. Active Hazard modeling added the dynamic of a “bad guy” with its interactions with “civilians” as well as two police officers. I learned some basic tactics from campus police and verified them using modeling and simulation. !B. Motivation ! A cornerstone of a comprehensive information assurance (IA) program is the physical security and safety of both personnel and equipment. The National Institute of Standards and Technology (NIST) defines IA as, “Measures that protect and defend information and information systems by ensuring their availability, integrity, authentication, confidentiality, and non-repudiation. These measures include providing for restoration of information systems by incorporating protection, detection, and reaction capabilities” [3]. The Information Security and Privacy Advisory Board (ISPAB) which advises Congress and others on unclassified Federal systems is one of many examples of the link between physical and cyber aspects in IA. Its scope includes, “[to] identify emerging…physical safeguard issues relative to information security and privacy” [4]. Physical security is included as one of the ten domains in the Common Body of Knowledge required by the International Information Systems Security Certification Consortium (ISC2) to be a Certified Information System Security Professional. Consider a fire, belligerent employee, or gunman in a building housing a datacenter which caused a chaotic evacuation with crowds pushing and shoving. Besides the human impact if your best system administrator was injured during the evacuation, her absence may also reduce system availability. For these reasons and more, physical security is part of a comprehensive IA program. This project looks at one element of physical security … crowd dynamics under stress. According to Pelechano and Badler, modeling crowds is useful in site planning, education, entertainment, training, human factors analysis for building evacuation, sporting events, transportation centers, and concerts [5]. Pelechano, et al., wrote that animating motion for large crowds has been an important goal in the computer graphics, movie and video games communities as well as for fire evacuation [panic situations], …cinema, sporting event [calm situations] [5]. To understand security, you must first understand human behavior. The work of Pelechano, et al., demonstrates two key elements of human behavior. First, a small number of trained leaders can make a huge difference in outcome, and second, communication about the best option also improves outcome. These are simple observations which may have application to other fields such as network optimization, system administrator training, and organizational risk assessment. Consider the paper by Stanton, et al. [6]. It lists factors that predict security outcomes including job tenure, organization type, company size, job type, income level, union membership, organizational commitment, span of control, technical knowledge, and negative emotional events. It fails to isolate communication about security and trained leaders (security first responders) in the workforce. This could be a topic for future work.

Page ! of !2 28

When we think of physical security vis-à-vis IA we often think about access control to restricted areas. NIST describes Personal Identity Verification Credentials for Physical Access Control Systems in Federal buildings [7]. It considers unrestricted, controlled, limited, and exclusion zones and touches on emergency situations and first responders. What happens if a restricted area is the quickest path for evacuation? In areas with people of varying access privileges, what are the risks of unauthorized access if escorts don’t proactively stay with uncleared personnel as they evacuate? This could be a topic for future work. !!C. Summary of Key References and Background ! Pelechano, et al., [1] simulated crowd behavior using a wayfinging model in a maze and building-like maze. They divide wayfinding into high-level and low-level elements. High-level way-finding describes how agents move from room-to-room. It is the focus of “Modeling Crowd and Trained Leader Behavior during Building Evacuation” [1]. In low-level way-finding, agents navigate within a room toward a target such as an exit door. This was the focus of “Controlling Individual Agents in High-Density Crowd Simulation” [5]. Pelechano, et al., [1] presented their high-level way-finding results in graphs mapping the time steps vs. percentage of agents evacuated. They demonstrated the following behavior scenarios.

! ! !!!!!!

Page ! of !3 28

Figure 1. Communication vs. no comm [1]. Figure 2. Evacuation time for different crowd sizes using communication but 100% untrained leaders [1].

!Figure 4. Evacuation times for small percentages of leaders [1].

Figure 3. Evacuation time for 0, 25, 50, 75, and 100 percent trained leaders [1].

Additional background: I recently completed an independent study on Modeling and Simulating Human Behavior. The paper, “Methods of Modeling and Simulating Human Behavior” [8], and program provide an excellent background for this project. !!D. Physical Security Input from Campus Police I interviewed Sergeant Grant Lockwood and Officer Kristen Schaaf from the UCCS Police Department on 11 Feb 2014. We spoke of the threat of an active shooter and discussed some of the historical events. In general, my goal was to understand their general procedures without compromising any tactics that may put first responders at risk. In general, their procedure is to “go to the noise” (the sound of gunfire) and stop the threat as quickly as possible. The first to the scene makes a decision and if conditions warrant it, engages the threat. When the “noise” stops, they go into search mode. Simultaneously, they create an incident control center and establish a perimeter. They evacuate the students and faculty through the perimeter (hands up, quick check point) and clear the building. (Modeling behavior after the “noise” stops could be a topic of future work.) Information is sent out using E2 Campus rather than fire alarms and may use text messaging. Instructions may instruct to shelter in place or evacuate depending on the area. If people shelter in place, they are instructed to pull blinds, barricade doors, silence (off) cell phones. Building occupants’ options include “Run, Hide, Fight”. The officers recommended the YouTube video “RUN. HIDE. FIGHT.® Surviving an Active Shooter Event”[9] and the “Ready Houston” website [10]. !!

II. IMPLEMENTATION !A. Model !

Our first goal is the same as Pelechano and Badler’s, “to study evacuation algorithms’ performance when large groups of agents with individual personalities use communication to reduce their graph search space.”[1] Our motivation is similar, “to produce results that closely simulate real human behavior in these situations, and we do this by modeling the psychological factors—such as following known paths, herding behavior, loss of orientation, and so on—that affect human performance under stress and panic.”[1] For the experiments I used four scenarios. The authors wrote, “We randomly generated two scenarios and created the third with a building editor to produce an environment better resembling a real building. The three mazes each contain 100 rooms with eight of them blocked by some hazard, such as fire.”[1] I used Numbers Version 3.1 with conditional formatting to draw the scenarios, copied the results into a .txt file and read the .txt file with Java. The first two scenarios are mazes, the third is a simple building-like configuration with doors, the third is a

Page ! of !4 28

maze with 100 rooms. (I ran many more scenarios not shown in this report and found similar results.) The scenarios include the following four configurations:

In these models, a white block is a open navigable cell, a green block is an exit, and a yellow block is a passive (unmoving) hazard. To better model a building, a white block represents a room (or part of a room) and a light blue block represents a door. (The color for a door was later changed to dark blue and light blue represented a police officer.) The passive hazards are added after the agents are loaded so the agents have no idea of the location of the hazards until they encounter them. Model notes: note that in figure 5 (maze B) a hazard makes it impossible to navigate from the right side of the model to the left. If an agent has a favorite exit on the other side, she will have to find a new way out. Figure 6 (maze F) has only one exit so the results for an agent will be about the same whether it uses favorite exit or best (closest) exit way-finding. Figure 7 (maze E) is “building-like”. Figure 8 (maze T) has 100 open cells (…counted before hazards were added). I was consistent with the reference for the population. “The populations used for these trials range from N = 20 to 200 agents.”[1] I used a random distribution.

Page ! of !5 28

Figure 5. NHMazeB.txt (4 exits) Figure 6. NHMazeF.txt (1 exit)

Figure 7. NHMazeE.txt (“building-like”)

Figure 8. NHMazeT.txt (100 rooms)

Per the reference, “The leadership levels range from 0 to 100 percent. No leaders means they are all followers, and therefore when several agents meet in a cell, one random agent makes a decision and the others will follow. Followers are dependent agents, when they find themselves in a panic situation they will always follow other agents instead of making their own decision, thus simulating the herding behavior observed in real crowds during evacuation. On the other hand, 100 percent leadership means each of them will perform its own decision-making process, with its current, complete building knowledge.”[1] I used three way-finding packages to replicate these concepts. Simple: This is the most basic package and represents someone who is lost. A “simple” agent goes straight and when it can’t go straight anymore it turns left or right. (The percentage is configurable.) This could lead to the agent looping or passing a potential exit so I added algorithms to avoid this. “Simple” agents can share dead-end information with other “simple” agents in the room if communication is allowed. “Simple” agents have leadership level 0 so if leadership is allowed they will follow another agent. If there are only “simple” agents in the room, they will elect a leader and follow it. Favorite Exit: An agent with “favorite exit” way-finding knows the path to a favorite exit. (This is implemented with a distance vector (DV) … an array with each cell holding the distance to the favorite exit.) When this agent hits a hazard it recalculates its DV using this information. If communication is allowed, it shares hazard locations with other agents in the room. Their leadership score is 50. When the favorite exit is blocked, these agents revert to “simple” way finding. Best Exit: An agent with “best exit” way-finding knows the path to the closest agent. When this agent hits a hazard it recalculates its DV using this information. If communication is allowed, it shares hazard locations with other agents in the room. Their leadership score is 75. This leaves room for others with better leadership in a future program upgrade. ! The following way-finding techniques were added to simulate active hazards: Perfect: An agent with “perfect” way-finding knows the path to its destination (such as an exit) and knows all static hazards. Run to Sound: An agent (such as a police officer) using this technique runs to the sound of an active hazard. Euclidean distance is used to calculate the distance to the sound but building layout isn’t considered. As you can guess, it is possible to miss the path. As the building becomes more complicated, this becomes more visible. It is rarely a problem in a building with a single straight hall. Run to Sound with building knowledge: An agent (such as a police officer) using this technique runs to the sound of an active hazard using the best path, assuming “perfect” way-finding. Run from Sound: An agent using this technique runs away from the sound of an active hazard. Euclidean distance is used to calculate the distance to the sound but building layout isn’t considered. As you can guess, it is possible to be trapped in a dead end. When this is the case, agents may “hide”, which protects them from long range attacks from an active hazard but doesn't protect them from close-range attacks. A future upgrade could improve this “hiding” feature, including locking doors.

Page ! of !6 28

!!B. Visualization ! To visualize the movement of agents through the model, a number is shown in each cell representing the number of agents. On the bottom, the green block shows the number who have exited and case number, in this case, “EXIT: 11 of 60 18% Case 37”. Next to it, the yellow block shows the step number. Visualization size is limited by screen size, …about 10x20 cells. The visualization was improved slightly when a building was modeled and active hazards added. !

C. Simulation & Analysis ! This section contains simulation and analysis of three model areas: (1) Baseline modeling, (2) Building Modeling, and (3) Active Hazard Modeling. Baseline modeling is used as a proof of concept and is compared to the work of Pelechano, et al [1]. !Baseline Modeling This topic contains four scenarios:

1. Communication vs. no communication between agents 2. Different crowd sizes 3. Varied percentage of leaders 4. Varied training levels of leaders !

Communication vs. no Communication between agents

Each way-finding technique showed improvement when agents communicated with the “Best Exit” showing the most pronounced and “Simple” showing the least. This was shown in all the

Page ! of !7 28

Figure 9. Visualization

scenarios; however, the amount of dead ends, placement and number of exits, and placement of hazards shaped the curves considerably. Here are some results:

Page ! of !8 28

Maze F%

Eva

cuat

ion

0

25

50

75

100

Step0 10 20 30 40 50 60 70 80 90 100 110 120 130 140 150 160 170 180 190

simple 200, comm OFFsimple 200, comm ON

Figure 10: Simple way-finding with communications ON /OFF (200 agents)

Maze F

% E

vacu

atio

n

0

25

50

75

100

Step !0 5 10 15 20 25 30 35 40 45 50 55 60 65 70 75 80 85 90 95 100

fav(exit 1) 200, comm OFFfav(exit 1) 200, comm ON

Figure 11: Favorite Exit way-finding with communications ON /OFF (200 agents)

. Figure 13 shows the results of the “B” maze as compared to the results from Pelechano and Badler. Their penalty for not communicating was greater than I was able to achieve. The shape of the Best Exit scenario was most similar. The shape of the Simple curve was least similar.

Page ! of !9 28

Maze F%

Eva

cuat

ion

0

25

50

75

100

Step0 5 10 15 20 25 30 35 40 45 50 55 60 65 70 75 80 85 90 95 100

best 200, comm OFFbest 200, comm ON

Figure 12: Best Exit way-finding with communications ON /OFF (200 agents)

Maze B

% E

vacu

atio

n

0

25

50

75

100

Step0 5 10 15 20 25 30 35 40 45 50 55 60 65 70 75 80 85 90 95 100

Pelechano and Badler, Comm ONPelechano and Badler, Comm OFFbest 200, comm OFFbest 200, comm ON

Figure 13: Best Exit way-finding with communications ON /OFF (200 agents) compared with results from Pelechano and Badler

Different crowd sizes

To duplicate the movement of varying crowd sizes of “untrained leaders” as in [1], I configured the simulation with agents using “Best Exit” way finding. Again, results varied by maze. In general, the larger crowd sizes tended to allow agents to better take advantage of communication. Notice that when the flow is limited to 10 agents per cell that close to 100% were evacuated by step 30, which is a large improvement.

Page ! of !10 28

Vary Crowd Size Best WF, Comm ON

Perc

ent E

vacu

atio

n

0

25

50

75

100

STEP0 5 10 15 20 25 30 35 40 45 50 55 60 65 70 75 80 85 90 95 100

C:41 NHMazeT.txt C:on best: 20 C:42 NHMazeT.txt C:on best: 60 C:43 NHMazeT.txt C:on best: 100 C:44 NHMazeT.txt C:on best: 150 C:45 NHMazeT.txt C:on best: 200

Figure 14: Demonstrate impact of crowd size with 20 - 200

Vary Crowd Size Best WF, Comm ON, Flow Limited

Perc

ent E

vacu

atio

n

0

25

50

75

100

STEP0 10 20 30 40 50 60 70 80 90 100

C:36 NHMazeT.txt Fl:on(10) C:on best: 20 C:37 NHMazeT.txt Fl:on(10) C:on best: 60 C:38 NHMazeT.txt Fl:on(10) C:on best: 100 C:39 NHMazeT.txt Fl:on(10) C:on best: 150 C:40 NHMazeT.txt Fl:on(10) C:on best: 200

Figure 15: Demonstrate impact of crowd size with 20 - 200

!Varied percentage of leaders

To investigate various percentage of leaders I first configured the simulation with Simple agents (non leaders) and Favorite Exit agents (leaders) with leadership on. I then ran the sim again with leaders using Best Exit way finding. It did not require 100% leaders to give performance very similar to 100% leaders. Results are very similar to Pelechano and Badler’s, ”Here we can conclude that an optimal percentage of trained people during an evacuation would be only about 10 percent. For lower values the evacuation time for the same percentage of evacuees takes at least twice the time. On the other hand, having more than 10 percent trained people only increases evacuation time by at most 0.16 times.”[1]

!!!!

Page ! of !11 28

Figure 16: Vary percentage of leaders using Best Exit

Vary % Leaders

Perc

ent E

vacu

atio

n

0

25

50

75

100

STEP0 5 10 15 20 25 30 35 40 45 50 55 60 65 70 75 80 85 90 95 100

C:118 NHMazeE.txt LDR:on C:on sim: 200 C:119 NHMazeE.txt LDR:on C:on sim: 196 best: 4 C:120 NHMazeE.txt LDR:on C:on sim: 188 best: 12 C:121 NHMazeE.txt LDR:on C:on sim: 180 best: 20 C:122 NHMazeE.txt LDR:on C:on sim: 100 best: 100 C:123 NHMazeE.txt LDR:on C:on sim: 50 best: 150 C:124 NHMazeE.txt LDR:on C:on best: 200

Varied training levels of leaders

Again, performance is building dependent. Consider figures 17 and 18, Maze F where there is only one exit and Maze B were a part of the maze is blocked. In Maze F (figure 18), since

there is only 1 exit, favorite way-finding works the same as best way-finding. In Maze B (figure 18) part of the building is blocked so there is a huge penalty for having a favorite exit. Maze E (figure 19) is building-like with one blocked. In general,

• Simple way-finding with no comm or leadership gives the low-level baseline.

• Best way-finding with comm and leadership gives the high-level baseline.

!!!!!

Page ! of !12 28

Vary Leader Training

Perc

ent E

vacu

atio

n

0

25

50

75

100

STEP0 15 30 45 60 75 90 105 120 135 150 165 180 195

C:25 NHMazeF.txt LDR:on C:on sim: 180 fav: 20(1) C:26 NHMazeF.txt LDR:on C:on sim: 180 best: 20 C:27 NHMazeF.txt LDR:on C:on sim: 180 fav: 10(1) best: 10 C:28 NHMazeF.txt C:on sim: 200 C:29 NHMazeF.txt C:on fav: 200(1) C:30 NHMazeF.txt C:on best: 200 C:31 NHMazeF.txt sim: 200

Figure 17: Vary leader training in Maze F

• Favorite exit way-finding can be good or bad. If the exit is blocked, performance can be worse than simple with no comm or leadership (Maze B fig. 18). If the exit is the best option, it could give equal or better performance contribution than best way-finding since the agents don’t have to look for the blocked exits (Maze E fig. 19).

• Mixing best and favorite way finding gives good results if the favorite exit is available.

Page ! of !13 28

Vary Leader Training

Perc

ent E

vacu

atio

n

0

25

50

75

100

STEP0 15 30 45 60 75 90 105 120 135 150 165 180 195

C:25 NHMazeB.txt LDR:on C:on sim: 180 fav: 20(1) C:26 NHMazeB.txt LDR:on C:on sim: 180 best: 20 C:27 NHMazeB.txt LDR:on C:on sim: 180 fav: 10(1) best: 10 C:28 NHMazeB.txt C:on sim: 200 C:29 NHMazeB.txt C:on fav: 200(1) C:30 NHMazeB.txt C:on best: 200 C:31 NHMazeB.txt sim: 200

Figure 18: Vary leader training in Maze B

Vary Leader Training

Perc

ent E

vacu

atio

n

0

25

50

75

100

STEP0 15 30 45 60 75 90 105 120 135 150 165 180 195

C:25 NHMazeE.txt LDR:on C:on sim: 180 fav: 20(2) C:26 NHMazeE.txt LDR:on C:on sim: 180 best: 20 C:27 NHMazeE.txt LDR:on C:on sim: 180 fav: 10(2) best: 10 C:28 NHMazeE.txt C:on sim: 200 C:29 NHMazeE.txt C:on fav: 200(2) C:30 NHMazeE.txt C:on best: 200 C:31 NHMazeE.txt sim: 200

Figure 19: Vary leader training in Maze E

D. Building Modeling ! Next I extended the the simulation to more realistically model a real building. This Objective was met with the simulation behaving much the same way as before. I’ll limit my discussion to new concepts and improvements based on the building models shown in figures 21 through 24. The discussion is included in the observations section. !

Page ! of !14 28

Leadership ON/OFFPe

rcen

t Eva

cuat

ion

0

25

50

75

100

STEP0 10 20 30 40 50 60 70 80 90 100 110 120 130 140 150 160 170 180 190

C:26 NHMazeE.txt LDR:on C:on sim: 180 best: 20 C:926 NHMazeE.txt C:on sim: 180 best: 20

Figure 20: Impact of leadership

Page ! of !15 28

Figure 22: Conceptual building with two outer halls.

Figure 21: Conceptual building with 1 central hall. White blocks represents rooms and halls, green … exits, light blue … doors. Grey blocks are room areas which are curtained-off to keep simple way finding working well, avoiding local way-finding issues.

!

Page ! of !16 28

Figure 24: Part of Engineering Building, trimmed & edited to be visualized on screen.

Figure 23: Part of Engineering Building, limited by screen size.

! !E. Active Hazard Modeling ! The last objective of this project was to simulate crowd behavior with an active hazard and try to glean some physical security related implications. Recall, based on research with campus police that building occupants should run, hide, fight [8] (in that order) when faced with an active hazard. Also, it is standard procedure for the first officer on the scene to address the threat and if possible, stop it. The second officer on the scene works as backup. Additional officers cordon the area and manage a checkpoint. Officers do not help civilians on the way in. It is their training to address the threat as soon as possible. Time is of the essence! What questions should the model investigate? 1. RUN, HIDE, FIGHT [9] : Is the RUN, HIDE, FIGHT [9] tactic good? Compare the results

(casualty rate) of a standard evacuation to running only, hiding only, fighting only, and all three together.

2. Concealed carry: What is the impact of arming civilians (assuming they don’t shoot each other)? Compare the results with different percentage of of armed civilians.

3. Police: Does a police response help? Compare RUN, HIDE, FIGHT [9] with no police response and with a timely police response.

4. Time: We know intuitively that time is of the essence. How sensitive is time? Compare the arrival of the first police officer at varying times.

5. Tactics: Is it better for the first police officer to act immediately or wait for the second to arrive? !

Scenario: In this scenario the bad guy plans to start firing in class when he hears some pre-positioned explosives go off. He thinks he can shoot his way out of the building and run away in a wooded area. Students and teachers may or may not be armed. One or two police offices will arrive a short time after the incident starts. When the bad guy is hurt or exits, students and teachers leave the building. !Building the Active Hazard Model: !Agent Roles: Agents take on one of three roles in this model. !Active Hazard (a.k.a. “bad guy”): The bad guy starts at a random location. He starts shooting any agents in range at a set time (T). This time coincides with a passive hazard going off. While continuing to fire, he makes his way toward an exit using one of the standard way-finding techniques (simple, favorite exit, best, perfect). !Police: The first police officer arrives at time T+t1 at exit X and moves to the sound of gunfire using “run to sound” or “run to sound with building knowledge” way-finding. The second

Page ! of !17 28

officer arrives at T+t1+t2 at exit Y (could be the same exit) and also runs to the sound. When a police officer is within range of the bad guy, he engages him. !Civilians (a.k.a. “agents”): At the sound of the first explosion, agents may either evacuate, run from the sound, or hide if backed into a dead end. If agents are in close range of the bad guy, they may actively engage him (i.e. fight). If they are armed, they use the gun. If not, they use an improvised ad hoc attack. ! Agent Attributes: Agents have new attributes which greatly influence the results. They include: - Accuracy with a gun - Accuracy with ad hoc attack - Ammunition - Range - Extended range penalties - Shots per time step - Shots per target !Active Hazard Modeling Results !1. RUN, HIDE, FIGHT [8] : Is the RUN, HIDE, FIGHT [8] tactic good? Compare the results

(casualty rate) of a standard evacuation to running only, hiding only, fighting only, and all three together.

Page ! of !18 28

Evacuation v. RUN HIDE FIGHT (ENGR3) (averaged over 10 runs)

Casu

alty

Rat

e

0

5

10

15

20

STEP0 5 10 15 20 25 30 35 40 45 50

Lower Control Limit (Evacuate)Average (Evacuate)Upper Control Limit (Evacuate)Lower Control Limit (RUN HIDE FIGHT)Average (RUN HIDE FIGHT)Upper Control Limit (RUN HIDE FIGHT)

Figure 25: This figure shows that the RUN HIDE FIGHT response results in a lower casualty rate than a standard evacuation. Results were averaged over 10 simulations and the upper and lower control limits show one standard deviation.

The RUN HIDE FIGHT [9] active shooter response shows a much lower casualty rate than a response based on a standard fire alarm-type evacuation. The results for a simulation with 200 people including one gunman in a portion of the Engineering Building is shown in the figure. In this simulation a passive hazard goes off at step 5. Notice that the majority of the casualties occur between step 5 and 15. The bad guy uses best exit way finding to leave the building quickly. The standard deviation is shown in the figure. The starting point of the bad guy and building occupants is random and is largely to blame for the variance. The next figure show the difference between different evacuation techniques. In order from best to worst: RUN HIDE FIGHT [9], run & hide, run only, fight while evacuating, standard evacuation. Running seems to have the most impact. In this model the running algorithm is somewhat complex. An array is created containing the Euclidean distance from each cell to the source of the sound. If the agent is close to the sound (within about 5 or 6 cells) it runs to the cell with the highest distance from the sound. If the agent is out of range, it uses its normal way finding technique to evacuate. This is important to avoid agents “holing up” rather than getting out of the building.

!!!!Page ! of !19 28

Evacuate v. run v. run+hide v. fight v. run-hide-fight (ENGR3)

Casu

alty

Rat

e

0

4

8

12

16

STEP0 5 10 15 20 25 30 35 40 45

Average (Evacuate)Average (RUN HIDE FIGHT)Average (RUN)Average (RUN+HIDE)Average (FIGHT)

Figure 26: This figure show the difference between different evacuation techniques. In order from best to worst: RUN HIDE FIGHT [8], run & hide, run only, fight while evacuating, standard evacuation.

!! The next figure shows the maze used to shake out issues with the active hazard scenario. Its geometry made it easy to visualize the running behavior of agents and the way finding techniques of the police tracking the bad guy.

2. Concealed carry: What is the impact of arming civilians (assuming they don’t shoot each other)? Compare the results with different percentage of of armed civilians.

Page ! of !20 28

Figure 27: “MazeY” was used to shake out active hazard interaction

Concealed Carry Effectivenes (Engr3)

Casu

alty

Rat

e

0

1.75

3.5

5.25

7

STEP0 5 10 15 20 25 30 35 40 45

Average 0% C:3007 ENGR3.txt best: 198 perfect: 2Average 5% C:3007 BLDG_ENGR3.txt best: 198 perfect: 2Average 50% C:3007 BLDG_ENGR3.txt best: 198 perfect: 2Average 100% C:3007 BLDG_ENGR3.txt best: 198 perfect: 2

Figure 28: Varying the number of students and teachers with a concealed weapon.

As the next figure shows, concealed carry reduces casualties. Remember, in this scenario the bad guy tries to leave immediately. That is why the casualty rate tails off at about step 20 even when no one has a concealed weapon. If the bad guy continued a more aggressive path, the impact of concealed carry would be even greater. ! Consider a different configuration where the bad guy doesn’t exit but continues. The casualty rate continues to climb. At step 45 the difference between 0% concealed carry and 100% is a 16% reduction in casualty rate.

Page ! of !21 28

Concealed Carry Effectivenes (MazeY)

Casu

alty

Rat

e

0

5

10

15

20

STEP0 5 10 15 20 25 30 35 40 45

Average 0% C:3115 NHMazeY.txt sim: 200 Average 5% Average 50%Average 100%

Figure 29: Concealed carry impact when bad guy doesn’t exit.

!3. Police: Does a police response help? Compare RUN, HIDE, FIGHT [8] with no police

response and with a timely police response.

!Police response reduces casualty as shown in figure 30. Notice that when the bad guy evacuates quickly using best-exit way finding, the police have no impact. When the bad guy stays longer “wondering around” using simple way finding, police have an impact. !4. Time: We know intuitively that time is of the essence. How sensitive is time? Compare the

arrival of the first police officer at varying times. ! Police response time impacts casualty rates. This figure shows, however, that in the time it takes to engage the bad guy (~step 15), the bad guy does considerable damage.

Page ! of !22 28

Police Impact ENGR3 (arrive at step 10)

Casu

alty

Rat

e

0

3

6

9

12

STEP0 5 10 15 20 25 30 35 40 45 50 55 60 65 70 75 80 85 90 95

Average (Police 20 reps) SIMPLE C:3115Average (No Police 20 reps) SIMPLE C:3107Average (Police 20 reps) BEST C:3015Average (No Police 20 reps) BEST C:3007

Figure 30: Casualty rate when police respond and when they don’t.

!Page ! of !23 28

Impact of Police Response Delay (ENGR3), 2 Police, 1 starting at each exit

Casu

alty

Rat

e

0

3.5

7

10.5

14

STEP0 5 10 15 20 25 30 35 40 45

Average (20 reps, SIMPLE) 0 Police Response DelayAverage (20 reps, SIMPLE) 10 Police Response DelayAverage (20 reps, SIMPLE) 20 Police Response Delay

Figure 31: Impact of police response time- 0, 10, 20 step delay

Response Time

Casu

alty

Rat

e

0

3

6

9

12

STEP0 5 10 15 20 25 30 35 40 45 50 55 60 65 70 75 80 85 90 95

Average C:3115,ENGR3, 0 DelayAverage C:3115,ENGR3, 30 Delay

Figure 32: This figures shows the decrease in casualty rate with an immediate response as compared to a delayed response.

5. Tactics: Is it better for the first police officer to act immediately or wait for the second to arrive?

It is better for the first officer to engage immediately (step 0) rather than waiting for backup

(step 30). What I find surprising is that two agents arriving at step 0 is much better then one. I hypothesize that this is influenced by the accuracy and range of the police as compared to the bad guy. When only one police officer engages, the bad guy may disable him. When two police officers engage together, the bad guy rarely disables both of them. ! !

III. OBSERVATIONS !!A. General Observations !1. Building configuration and hazard location does make a difference. Pelechano and Badler

hid this by averaging their data . The differences provide more insight into crowd behavior in real buildings.

Page ! of !24 28

Tactics (MazeY)Ca

sual

ty R

ate

0

5

10

15

20

STEP0 5 10 15 20 25 30 35 40 45 50 55 60 65 70 75 80 85 90 95

Average(/20) C3115 P1: 0 P2:0Average (/20) C3115 P1: 0 P2:30Average (/20) C3115 P1: 30 P2:30

Figure 33: Impact of tactics. In the ideal case, both police offices arrive at time zero (yellow). The second (green) case shows police #1 arrive at step 0, and police #2 arrives at time 30. In the worst (blue) case, both officers arrive at step 30.

2. Agents that way-find toward one favorite exit have a disadvantage compared to both simple and best way-finding when there is more than one exit since this method goes toward a specific exit and the other two methods have no exit preference. This behavior is exaggerated if their favorite exit is blocked. On the other hand, if all exits except their favorite exit are blocked, favorite-exit way-finders have an advantage.

3. My simple way-finding algorithm may be better then [1] and may over estimate the way- finding ability of people who have no idea where an exit is.

B. New Concepts Arising from Modeling Buildings 1. Doors, halls, and rooms: Buildings, unlike mazes, have doors, halls, and rooms. Each have

a different “status” code in the program to enable them each to have their own characteristics. Rooms and halls are shown in white, doors in blue, and the exits and hazards are still green and yellow respectively.

2. Agents populated to rooms only: The routine to populate agents in the model was modified to populate the rooms only. During class time, most students should be at their desk.

3. Rooms have dimension: This causes a problem with “simple” high-level way finding that won’t register a four-cell room with one door as a dead-end. To fix this I greyed out some cells within the rooms to give the rooms a concept of depth but not width. This modeling adjustment is only needed for the “simple” way-finding model. “Best” and “favorite exit” way-finding still work great without it.

4. Improved visualization: The numbers of simple, favorite-exit, and best way-finding agents was added. Also added was the status of communication (C:off or C:on), status of flow limiting (f:off or f(#) where # is the flow limit), and status of leadership (L:on, L:off).

5. Map size extended past screen size: I enabled the simulation to accept maze sizes larger then the screen allows but only visualize a portion. Figure 23 shows the north-west portion of the Engineering Building. After working with it a while I concluded that it was better to trim down the scale and simplify a portion of the building to fit on the screen (fig 24) ; after all, the components of M&S are modeling, simulation, visualization, and analysis[2]. What fun is it if you can’t see what’s going on? If my target audience is law-enforcement, they might rather see the visualization than the graphs alone.

6. One vs. two hall building: Consider a building with a single central hall (fig. 21) and one with two outer halls (fig. 22). The first obvious observation is that it takes two hazards to block an exit when you have two halls. The evacuation times and graph shapes were similar (within about 10 steps) for simple and best way-finding. In the favorite exit model, the favorite exit was blocked. The result was surprising. The two-hall model was much better. The result exposed a model anomaly. When agents using favorite-exit way-finding discover their exit is blocked, they revert to simple way-finding. As simple way-finders, they go straight until they can’t go straight anymore. In the single hall model, rooms are across the hall from one another. The simple agent ‘runs’ from one room, across the hall, and right into another room. In real life, even a panicked person would tend to turn onto the hall and not choose the second room. To fix this in the engineering building map, I offset the rooms across the hall. (I’ll leave the model fix to another project, considering the next concept.)

Page ! of !25 28

7. Butterfly effect: In agent-based modeling, a small change can have a large effect. I found the flow limiting models could cause loops when leadership was in place. Simple way-finding is stable and best way-finding is stable but when a simple way-finder follows a leader but is then separated due to flow limits, its internal map is disrupted. There is a parallel in real life…when I’m a passenger in a car, I have a much harder time finding my way home than when I drove.

8. Overall: The model is faster than before and results are consistent. I’ve run many regression tests with good results. The model is ready to add a gunman and police! !

C. Security Observations and Implications !1. RUN, HIDE, FIGHT [9] :

1. The RUN HIDE FIGHT [9] technique is better than a standard fire-drill-type evacuation. 2. Running is the most important part of the RUN HIDE FIGHT[9] technique. !

2. Concealed carry: 1. Ignoring the secondary implications of arming civilians, concealed carry reduces casualty

rates. 2. Depending on the scenario, arming only 5% of civilians has a noticeable reduction in

casualty rates. 3. When the bad guy stays longer, the impact of concealed carry increases. !

3. Police: 1. Police response does help, especially when the bad guy stays in the building longer. !

4. Time: 1. A timely police response decreases casualty. 2. Considerable casualties are incurred in the first step of bad guy activity. 3. Depending on the configuration of the building, civilians may run away from the threat

after the first few steps. This may decrease the impact of the police who arrive after this happens. !

5. Tactics: 1. It is better for the first police officer on the scene to engage the bad guy immediately. 2. The difference between one officer at time 0 and one at time 30 as compared to both at

time 30 isn’t as large as I expected. This is likely due to the possibility of the bad guy disabling the police officer.

3. It is best to have two police officers arriving at time 0. It is considerably better than having one. !!! !

Page ! of !26 28

IV. FOLLOW ON WORK This section contains ideas for follow on work. 1. Evaluate first responder tactics and evacuation techniques during a fire or other physical

active hazard. !2. Improve “hiding” by including feature such as locking doors. !3. Evaluate different “bad guy” actions and behaviors including multiple bad guys. !4. Consider the paper by Stanton, et al. [6]. It lists factors that predict security outcomes

including job tenure, organization type, company size, job type, income level, union membership, organizational commitment, span of control, technical knowledge, and negative emotional events. It fails to isolate communication about security and trained leaders (security first responders) in the workforce. This was the draft topic for my thesis. !

5. When the “noise” stops, the police go into search mode. This could be added to the algorithm. !

6. When we think of physical security vis-à-vis IA we often think about access control to restricted areas. NIST describes Personal Identity Verification Credentials for Physical Access Control Systems in Federal buildings [7]. It considers unrestricted, controlled, limited, and exclusion zones and touches on emergency situations and first responders. What happens if a restricted area is the quickest path for evacuation? In areas with people of varying access privileges, what are the risks of unauthorized access if escorts don’t proactively stay with uncleared personnel as they evacuate? !

V. CONCLUSION ! This project successfully achieved its objectives. It built a model with results similar to Pelechano, et al [1]; It modeled a realistic building; and it modeled an active hazard situation. The RUN HIDE FIGHT [9] technique was modeled and found to be very effective. Concealed carry seemed to save lives, all other things being equal. The police tactic where the first on the scene immediately addresses the active hazard was modeled. This tactic was good as long as the police had a skill and range advantage over the bad guy. This reflects the real-word caveat … the first on the scene makes an assessment and, if prudent, engages immediately.

Page ! of !27 28

!REFERENCES !!!

[1] N. Pelechano and N.I. Badler, Modeling Crowd and Trained Leader Behavior during Building Evacuation, University of Pennsylvania, USA; IEEE 2006 ![2] John A. Sokolowski, Catherine M. Banks, Principles of Modeling and Simulation, A Multidisciplinary Approach, 2009 ![3] NISTIR 7298 Revision 2, Glossary of Key Information Security Terms, U.S. Department of Commerce, May 2013, downloaded on 22 Jan 2014 from http://nvlpubs.nist.gov/nistpubs/ir/2013/NIST.IR.7298r2.pdf ![4] Information Security and Privacy Advisory Board (ISPAB), downloaded on 22 Jan 2014 from http://www.nist.gov/itl/csd/soi/ispab.cfm ![5] N. Pelechano, J.M. Allbeck and N.I. Badler, Controlling Individual Agents in High-Density Crowd Simulation, University of Pennsylvania, USA; Eurographics/ ACM SIGGRAPH Symposium on Computer Animation (2007) D. Metaxas and J. Popovic (Editors) ![6] J. M. Stanton, K.R. Stam,P. R. Mastrangel, J. Jolton, “Behavioral Information Security: Two End User Survey Studies of Motivation and Security Practices”. Proceeding of the Tenth Americas Conference on Information Systems, New York, August 2004 ![7] NIST Special Publication 800-116 A Recommendation for the Use of Personal Identity Verification (PIV) Credentials in Physical Access Control Systems (PACS), November 2008, downloaded on 22 Jan 2014 from http://csrc.nist.gov/publications/nistpubs/800-116/SP800-116.pdf ![8] T.J. Karmondy, “Methods of Modeling and Simulating Human Behavior”, University of Colorado, Colorado Springs, 2013 ![9] RUN. HIDE. FIGHT.® Surviving an Active Shooter Event website downloaded 9 Mar 2014 from https://www.youtube.com/watch?v=5VcSwejU2D0 ![10] Ready Houston website downloaded 9 Mar 2014 from http://www.readyhoustontx.gov/trans-runhidefight.html !

Page ! of !28 28