Soft Target Hardening:

Protecting People from Attack

Dr. Jennifer L. Hesterman

Colonel, U.S. Air Force (retired)

Security is always seen as too much

until the day it’s not enough.

~ William Webster, former FBI and CIA Director

Andrews Air Force Base, Maryland

• Home of Air Force One

• AND 35 government tenants

• AND 20,000 employees daily

• AND Schools, churches, daycare, restaurants,

shopping, lodging, housing, 3 golf courses

• Hard target filled with soft targets

Overview

▪ What is a Soft Target?

▪ Mitigation Model

▪ Psychology of Soft Targeting

▪ Soft Targeting Motivations

▪ Soft Targets Assessment

▪ Hardening Tactics

▪ 12 Takeaways

What is a Soft Target?

A civilian-centric place

Not typically “fortified”

Vulnerable, unprotected, undefended

Security not a primary mission

Privately owned

Possibly resource constrained

Maybe co-located near hard targets

✓Actions cause results.

✓Inaction also causes results.

✓“Not seen” does not mean “not there.”

✓Goal: remove the enemy from the fight before it starts.

✓Actions are not universally applicable, must be tailored.

✓The plan is fluid; constantly assess/adjust based on

changes in the environment.

✓The “fog of war” means you don’t know everything about

the threat, there are inescapable unknowables.

✓You have no experience with the situation that might occur

in your organization; nothing that happened in the past can

prepare you.

✓Copycat attacks will happen.

Soft Target Security Truths

Mitigation Model

Psychology of Soft Targeting

➢ 90% of casualties in conflicts now civilians

➢ We protect these targets, don’t purposely strike them

➢ Perhaps bound by international law, Geneva

Conventions, individual religious doctrine or rules of

engagement in a coalition battle

➢ Threat met with disbelief, but…

▪ What do we most fear?

▪ How should we respond?

5 Emotional Traps1. Hopelessness – There’s nothing we can do.

Defeatism.

2. Infallibility – It will never happen here.

3. Inescapability – If it’s unavoidable, why even try

to mitigate.

4. Invulnerability – It can’t happen to me/us.

5. Inevitability – If it’s going to happen anyway,

why prepare.

Soft Targeting Motivations

✓ Easier, cheaper, short planning cycle

✓ Increased likelihood of success

✓ Success = Credibility

✓ Recruiting value

✓ Proof of viability

✓ As a group’s last gasp

✓ Backed into a corner

✓ Test a new strategy, tactic or weapon

Soft Targeting Motivations

✓ Fundraising through kidnapping, hostage taking

✓ Quickly damage a market

✓ Delegitimize a government – can’t protect its

people

✓ Get the government to the negotiation table

✓ Cause political instability during an election

✓ Attain global media coverage

✓ Target rich environment

✓ Psychological fear

▪ School violence on the rise worldwide; mass shootings and

stabbings

o K-12 most vulnerable

oCollege campuses already “under attack” through

espionage, cyberattacks, drug syndicates

oRelationship between higher education and law

enforcement not good (in U.S.)

▪ Kidnapping of boys and girls for profit

▪ Massacre at private, elite schools

▪ Attacks on schools by governments in civil war

Bottom line – schools are now seen as legitimate targets

Soft Target Assessment:Schools

Soft Target Assessment:Churches

▪ Church violence on the rise worldwide; mass shootings,

stabbings, theft

o Invite in all of society, especially those with problems

oOpen door

oMega-churches extremely vulnerable

o Asymmetric undertone – every religion has fringe actors

▪ Symbolic targets

▪ Attacks on churches by governments in civil war

Bottom line – churches are now seen as legitimate targets

▪ Hospital violence on the rise worldwide; mass shootings,

stabbings, theft of drugs, bombings

oOpen doors, invite in all of society, those in

psychological pain

o Increasing target of choice by terrorists

▪ Emergency room most vulnerable; multiple cases

▪ Loading docks vulnerable

▪ Theft and repurposing of ambulances by bad actors

▪ Attacks on hospitals by governments in civil war

Bottom line – hospitals are now seen as legitimate targets

Soft Target Assessment:Hospitals

▪ Nairobi Mall attack put this target in the playbook

▪ Multiple threats and attacks against malls in the U.S.

o People trapped in a confined space

oNo security checks at doors

o Symbols of wealth and prosperity

oCo-located operations may be the target: casino,

alcohol, amusement areas, aquariums

▪ For profit mentality is a factor – owners want a pleasurable

shopping experience, think security measures detract

Bottom line – Malls are targets

Soft Target Assessment:Malls

▪ Parades, festivals, bike paths

▪ Restaurants, cafés

▪ Hotels, resorts

Trends:

- Confined spaces

- Guards (if any) easily overpowered

- Small handful of attackers

- Preplanning/surveillance

Bottom line – these venues are now targets

Soft Target Assessment:Main Street Shopping/Dining/Hotels/Promenades

▪ Multiple threats worldwide

oConfined crowd of unsuspecting people

o Live television coverage

oGood news: entry control points

o Bad news: risk of insider threat high--seasonal staff a big

problem

oConcessions – opportunity for food related attack high

▪ Las Vegas, Ariana Grande concert, Paris Stadium,

Bataclan Theater

▪ Tunisia museum, Luxor attack, Dubrovka theater siege

Bottom line – Sporting and rec events are targets

Soft Target Assessment:Sporting, Recreation, Cultural Events

Airport Terminals

Rome and Vienna, 1985: 23 dead, 100+ injured

LAX, 2002: 2 dead, 4 injured

JFK Plot, 2007: al Qaeda

Glasgow, 2007: 1 dead (T)

Brussels, 2016: 13 dead, 81 injured

Istanbul, 2016: 41 dead, 230 hurt

Train and Subway Stations

Tokyo, 1995: 13 dead, 6,353 injured

Madrid, 2004: 192 dead, 2,050 injured

London, 2005: 56 dead, 700 injured

Mumbai, 2006: 209 dead, 714 injured; 2008: 58 killed,104 injured

Brussels, 2016: 32 dead, 300 injured

Failed plots - Zazi, NYC Subway; Ahmed, DC Metro

Bottom line – Transportation hubs are targets

Soft Target Assessment:Transportation Hubs

▪ Preoperational surveillance

▪ Shifting tactics - multiple attacks, but not simultaneous; spread across

city, sequential to cause chaos, delay response, cause panic

▪ Targeting people fleeing from exits

▪ Attacking at the end of the event

▪ Group leader watching from perimeter, calling in real time data

▪ Spillover of attack into neighborhoods, businesses

▪ Interference of press

▪ If hostages are taken, they are “doomed captives”

Soft Target Assessment:Tactics in Recent Attacks

What can we do?

360 Burglars said….

Dr. Martin Gill’s research of murders on death row

• Why criminals choose their targets - because they are

easy!

• CCTV does not affect the way violent actors commit their

offenses, in fact, may escalate their actions

• More concerned about being stopped by people than any

type of technology

• Favor large, bulky security guards since they can be outrun

• The decision to shoot and kill a lone security guard actually

comes easy - eliminates the one key piece of evidence

Seeing the potential crime scene through the eyes of a

criminal is invaluable! So ask!

Convicted Murderers said….

Sandy Hook Elementary

Accept the threat, accurately/honestly assess vulnerabilities

Hardening Tactics

Low Vulnerability High Vulnerability

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20

7. Security Environments and Overall Vulnerability to an Attack

Does your organization have effective internal security procedures?

What is the law enforcement presence in your area?

What is the hardness, level of blast protection, etc. of your facilities?

How accessible (security presence, access control, id badges, metal

detection buffer zones, fences, etc.) is your facility?

Are your assets and/or its potential recognized as a symbol?

What level of public access is necessary for you to function?

Can you control high-speed vehicle approaches to your facility?

Source: FBI – Terrorism Vulnerability Self-Assessment Checklist

Use of Tactical Deception

- Military tactic – remember the goal of target hardening is to

remove enemy from the fight before it starts- divert/offroad

- Make target appear harder than it is through:

Language

Signage

Physical deception tactics

“Prepping the battlefield”

Bottom line – the best defense is a good offense!

Hardening Tactics

Lower the “heat”

Attractive Fortification and

“Rings of Security” Tactics

Education City

Hospital

Secured Housing

Compound

Church City

Attractive Fortification

▪ System cross applied from the military model

▪ Visualize violent scenarios in an unemotional, data driven way

▪ Harmonizing/synchronizing/prioritizing security activities

Effects Based Hardening

▪ Don’t assume that serious insider threats are NIMO (not in

my organization)

▪ As we harden facilities, the insider threat will grow

▪ Hiring process critical, but also onboarding, steady state

▪ Everyone has a public live, a private life and a secret life

▪ Managing the Insider Threat: No Dark Corners by Nick

Catrantzos (CRC Press, 2012)

Insider Threat: A “Fifth Column”

▪ Exercises: practice response from desktop exercises, to

realistic events all the way to “simulator training”

▪ Establish a command center or a hold room with

computers, phones, water and supplies, first aid kit,

checklists; evac point

▪ Be prepared on social media – pre-craft the message!

▪ Red Teaming: outside assessment, peer assessment

Crisis Response Training

Takeaways

1. Identify the “Achilles heel” – the weakest, most vulnerable part

of your organization.

2. “The human is the best weapons system” – technology not the

central part of security.

3. Build your crisis leadership skillset.

4. Fight the 5 emotional traps.

5. Consider using deception techniques in language and signage.

6. Rings of security – build relationships on the perimeter around

your facilities.

Takeaways

7. Strongly consider the insider threat

8. When budgeting, ask “what is the cost of NOT protecting

our facility/people?” Go there.

9. Think about vulnerability, not probability.

10. Invest in preparedness, not prediction.

11. Think consequences, not likelihood.

12. Shape the environment and culture you want. Take control,

get on the offensive!

Takeaways

We can strike a balance between normalcy and

vigilance!

✓ Citizens now expect/demand security

✓ Making $$ decisions based on their assessment

✓ In this age, security procedures will not scare

them away, but pull them in!

Just ask them!

Conclusion

Everyone has the right to work, study,

worship, heal and relax…

without the fear of attack.

Contact info

Dr. Jennifer L. Hesterman

Colonel, U.S. Air Force (retired)

Watermark Risk Management International

jennihesterman@gmail.com

571.289.7225 cell