Social Engineering Blogs

Yesterday, the New York City Police Department released a report from its SHIELD initiative about the Kenya mall shooting/terrorist attack. It was a pretty damning report to say the least. Before we talk about the report, let’s talk about SHIELD is and why that’s important to understand in the context of this report. SHIELD is the NYPD’s homegrown information-sharing component with private sector security. It provides analysis on current and future threats. I’ve previously read some of SHIELD’s reports. Some were good and some were typical of fusion center reports – some meat and some potatoes but not a full meal. This report was driven, in part, to go over what NYPD and private security could learn about what happened in Nairobi. There was plenty.There were some startling revelations:Kenyan police were VASTLY outgunned. The report states, “The typical Uniformed Kenyan Police Officer is not as well equipped as their western counterparts, typically only carrying a long gun, most commonly an AK-47 style rifle with a folding stock, loaded with a single 30 round magazine. They do not carry handguns, wear body armor, gun belts or have portable radios to communicate.” Each of the terrorist were carrying 250 rounds of 7.62 mm ammunition. Lack of body armor and radios to communicate resulted in fratricide. More on that later.Responding plainclothes officers were also outgunned and had no visible identification. Remember what I said about fratricide? From the report: “Very few of any of the plainclothes law enforcement first responders displayed any visible law enforcement identification such as a badge, arm band, ID card or  a raid jacket, making identification as “friend or foe” extremely difficult for other armed first responders.”Realizing the police were outgunned, Kenya made the incident response a military matter. That’s as bad as it sounds. The report says, “Kenyan government officials decide to transfer the handling of this incident from the police to the military. A squad of Kenya Defense Forces KDF soldiers enters the mall and shortly afterwards, in a case of mistaken identity, the troops fired on the GSU-RC Tactical Team.They kill one police officer and wounding the tactical team commander. In the ensuing confusion both the police and military personnel pull out of the mall to tend to the casualties and re-group.”Responding military forces used an RPG-7 as a room clearing tool. I kid you not. And the destruction was insane. “It is reported that at some point during the day the Kenya Defense Forces decided to fire a high explosive anti-tank rocket (possibly a RPG-7 or an 84mm Recoilless Rifle) as part of their operation to neutralize the terrorists in the Nakumatt Super Market.The end result of this operation was a large fire and the partial collapse of the rear rooftop parking lot and two floors within the Nakumatt Super Market into the basement parking.”It is possible the terrorists escaped in part because the Kenyan security forces failed to secure a perimeter. It is rather elementary for the very first thing Western police do in these scenarios is to lock down the perimeter. No one comes in or out unless they can be positively identified as a “friendly”. This credentialing occurs by checking IDs and only first admitting law enforcement and first responders to exit upon verification.The mall employed unarmed officers who performed unsatisfactory “wand searches”. This is irritating to say the least. Why? Unarmed officers are appropriate for certain environments and are the way to go in most environments. However, in high value targets, such as mass gathering locations in places like Kenya, I would have used an armed component. Armed officers are not only armed but can be equipped with radios and are usually uniformed. This makes identifying them for law enforcement somewhat easier. Also, armed officers can do things unarmed officers can’t due to safety concerns such as locking down perimeters and evacuating victims.Wand searches are weak. I dislike them with a passion. Why? Officers get tricked into believing a search was “good” because the wand didn’t annunciate. This is all kinds of bad. A search should be thorough in high value targets. If you’re going to employ officers and have them search, have them be thorough and do it without a wand. I would use the wand only in environments where I had other search mitigators in place such as backscatters or X-ray search devices.So what does this attack teach us in the West?The desire of terrorist groups to attack mass gathering locations is still very alive.Places like malls should consider Kenya to be a warning. If you’re in mall security, I highly suggest going over your active shooter plan and rehearsing it on a fairly regular basis with local police departments and simulated shooters. In these exercise, test not just your ability to minimize casualties but to also test your security apparatus under stress. This is best accomplished by “killing” responders, taking hostages, attempting escape, and causing confusion among responders. Get your people used to chaos in these scenarios.Never do wand searches at high value targets and test your people regularly. I’ve gone over why I think wand searches are bad. So let’s examine why you should test and train your searchers regularly. Searching is one of the most important yet often neglected security components. We usually pick rookies and the “lowest common denominator” to do this function because it’s “easy”. Doing good and thorough searches that you can go to sleep easy with at night are not easy. Searchers should be trained on subject “tells”, physical characteristics of forbidden items by touch, sound, smell, and sight, the tools they can use to do searches better, etc. They should also be regularly “red-teamed” which is to say you should have a non-attributable person walk through security and see what they can get through. When they’re done, they should report to management their findings.Here’s a video I did on how I would search bags:CCTV and analytics are EXTREMELY important to an active shooter scenario. There are several takeaways from what we learned about CCTV and the lack of analytics in Nairobi. First, CCTV coverage was spotty in some areas. Also, the CCTV coverage was easily identified and avoided by the terrorists. We also know while they had remote viewing capability, it was five miles away and more than likely not cross-fed into the police. While a CCTV monitor can’t identify every threat, video analytics can alert them to suspicious activity. At the very least, consider it an option.Garages and parking lots should be regularly patrolled. While there was a guard posted at the entrance of the garage, had a response element been closer by, they could have locked the exterior doors to the mall.Train your employees on how to sound the alarm and IMMEDIATELY lock down their storefronts and secure customers. I would consider including them as a part of your active shooter training as well. Make that mandatory training for all storefront management and their trusted employees. I would include it in a leasing agreement if I had to.Have a HIGHLY accessible public address system to sound the alarm.Train local non-law enforcement responders on the need to “shoot, move, and communicate”. Seriously, I can’t stress this enough. There is a huge debate in the US surrounding concealed carry permit holders as responders. I’m okay with them responding, though I prefer they receive some training on  the need to identify themselves to law enforcement prior to responding via a phone call if time and circumstance permit.Equip every security person and law enforcement officer with a radio.  If you want to avoid wasting your time clearing rooms that have already been cleared or fratricide, then you HAVE TO equip your responders with radios and share your frequencies with them.Train your personnel on reporting formats like SALUTE. We’ve covered this before so I won’t bore you with the details.Train your security management personnel on casualty collection points, IED mitigation, cordons, perimeter searches, and periodic vulnerability assessments. These things can’t be overstated in training. Trust me. You’ll thank me for this later.