Whatever the next emergency or crisis, institutions are increasingly positioned to respond quickly and efficiently to protect people and property.
By Sandra R. Sabo
Once upon a time—say, 16 years ago—Loyola University Maryland's campus safety force consisted of three officers who strolled around wearing green blazers. They undoubtedly could not have fathomed how complex campus safety and security would become at the Baltimore campus, where the night shift alone now employs 16 officers.
True, the numbers of residential students and buildings have grown since 1993, but the biggest increase has come in the number of crisis situations that Loyola must be ready to address at a moment's notice, says John Palmucci, vice president for finance and treasurer. He notes, “We have to prepare ourselves to protect our students, faculty, and staff from any of the many disasters that could confront them. That means dealing with theft, a shooter, roommate issues, love-hate romances, young people who may have difficulty understanding the limits to how much they can drink. ... The list goes on and on.”
To address the wide range of incidents that could compromise safety and security at Loyola, administrators developed a campuswide, all-hazards emergency preparedness plan. That puts the college on a par with the majority of respondents to NACUBO's 2008 security survey conducted as part of the National Campus Safety and Security Project, which Palmucci chaired. Of the colleges and universities that responded to the survey, more than four out of five (85 percent) had an emergency preparedness plan. Of the remaining 15 percent of responding institutions, three out of four (76 percent) had at least reached the halfway point in developing such a plan.
“Those are impressive numbers. They confirm that institutions are taking the preparation of a plan seriously,” says James A. Hyatt, senior vice president for business and finance and chief financial officer at the University of South Florida, Tampa, who served as the project director.
Count Rollins College as one of those institutions whose plan is a work in progress. Given its location in Winter Park, Florida, the college has long had an emergency plan for dealing with hurricanes and fires—but little else.
“We didn't have an all-hazard, comprehensive plan for the institution,” explains Maria J. Martinez, assistant vice president of human resources and risk management. “The opportunity to develop one presented itself two years ago when our insurance group invited us to participate in a risk reduction agreement.” In addition to realizing it needed to update its emergency plan, the college found a financial incentive—maintaining advantageous insurance premiums for three years—simply too good to pass up.
For the past two years, Martinez and three other campus leaders have met once a week to review existing campus policies, research best practices in emergency management, and draft a unified plan for the campus that reflects a “worst case” perspective. Perhaps the group's biggest decision was to remain small; previously, Rollins' emergency operations planning team numbered about 30, with representatives from food service to facilities to academics.
“That's fine for a hurricane, when you might have three to five days to prepare. But pulling together 30 people isn't the most efficient way to deal with an active shooter or a tornado that destroys half of a residence hall at 3 a.m.,” says Kenneth H. Miller, director of campus security. “We wanted a way to be more nimble and respond quicker to emergencies.”
Now Rollins has an emergency policy-making group, consisting of the president, vice president, and the small emergency operations group. The four members of the latter group chose to implement the National Incident Management System (NIMS) at Rollins. The NIMS model, which features a common command structure and terminology, is designed to enable various public and private agencies, organizations, and departments to work together seamlessly when an emergency occurs. More than three quarters of the survey respondents (78 percent) have adopted this type of system.
“Higher education favors consensual consultation, a model that is fundamentally in conflict with the NIMS command structure, which is more military in nature,” notes Steven S. Neilson, special assistant to the president. Nevertheless, Rollins' president not only approved use of the NIMS model but also asked the college's deans to join him in attending a three-hour executive training session on the subject.
The city provided the NIMS training at no cost to the college, underscoring Martinez's observation that “small colleges shouldn't be fearful about emergency planning because they lack resources or staffing.” She continues, “Although we spent our time on this project, we didn't have a specific budget. Each of our departments chipped in to help us come up with a good plan for the entire college.”
Put to the Test
As Rollins College developed its plan during the course of two years, says Brad McKown, director of environmental health and safety, “We realized we had to go back and rewrite the earlier parts as we analyzed more information, interviewed more people on campus, and tested small parts of the plan.” Field exercises will take place in spring 2010, with the entire emergency plan scheduled to take effect in June. Even then, the plan will be reviewed annually and remain subject to change. “I don't think the plan will ever be finished,” says Martinez. “Everything can change.”
“Higher education favors consensual consultation, a model that is fundamentally in conflict with the NIMS command structure, which is more military in nature.”
Steven S. Neilson, Rollins College
Just ask Carol A. Shelby, senior director, environmental health and public safety, at Purdue University, West Lafayette, Indiana. Like 40 percent of the institutions responding to the survey, Purdue conducts tabletop emergency training exercises annually. In addition, every three months, Shelby convenes a small group to review incidents that have occurred at high schools, colleges, and universities around the country. “We walk through, in detail, how our plan would work if the same situation happened at Purdue,” says Shelby. “The discussion is similar to, but not as formal as, a tabletop exercise, and it sometimes leads us to change our approach.”
This year, for example, reviewing Purdue's readiness to handle pandemic flu prompted the group to update its influenza Web site and launch a new Web site specifically for faculty members. There, faculty can learn the latest about H1N1 prevention as well as download emergency preparedness templates and language that they can easily paste into a course syllabus.
“We know it's hard for faculty to focus on things that probably aren't going to happen,” says Shelby, “so we make it easy for them to explain to their students where the shelter is in the building and how to evacuate their specific classrooms.” Purdue and Rollins were among six campuses that participated in comprehensive site visits conducted as part of the National Campus Safety and Security Project. Others were Arizona State University, Tempe; Cornell University, Ithaca, New York; Tulsa Community College, Oklahoma; and University of Maryland at College Park.
Unfortunately, these and all other institutions of higher education also have real-life events that keep emergency preparedness plans primed for revision. Sometimes, the plan works well but still needs to be communicated more effectively.
Arizona State University, for example, had many procedures in place to manage students who exhibited troubling behavior before a 2005 incident in which a student shot another student off campus. After that, says Nancy E. Tribbensee, general counsel for the Arizona University System, “The university worked hard to make sure information about individual student conduct and potential concerns are reviewed centrally and not just by individual academic or other units, such as athletics.”
In addition to centralizing information to coordinate an institutional response, adds Tribbensee, “The university had to broadcast more completely the policies it already had in place—such as what people should do if they felt threatened and how the institution would respond to such perceived threats.” According to the survey, institutions most commonly communicate information on campus safety and security to students via new student orientation (90.9 percent), Web site (84.8 percent), and the student handbook (83.9 percent). Similar percentages also communicate this information to the entire campus community (77.8 percent) and during faculty/staff orientation sessions (77.8 percent).
Recover and Reboot
Acts of violence grab the most headlines in the press, and they also top the list of emergencies simulated by colleges and universities. More than half (57 percent) of survey respondents have conducted exercises that revolve around an act of violence.
Loyola tackled the active-shooter scenario this past summer, replicating the exercise for each of its eight-hour security shifts. Because it employs unarmed officers, Loyola included city police in the tactical training, which also tested the college's mass-notification, closed-circuit television, and access control systems. The exercise helped Loyola zero in on how to best control the situation should it ever play out in real life, such as closing down particular areas and preventing students from entering harm's way.
“Although we can lock down portions of the campus and most of the classrooms, I'd challenge any campus to completely lock down-unless it has a moat and a stone wall,” observes Timothy F. Fox, Loyola's director of public safety.
Still, after completing the exercise, Loyola invested in an enhanced access-control system for the entire campus. “Now, in two or three strokes of a mouse, we can lock down most of our 400 controllers and classrooms,” says Fox. “That enables us to isolate a building or series of buildings.” The access controls are housed in one command center, along with all of Loyola's security cameras, burglar alarms, and fire-detection alarms.
But what would happen if a hacker breached the college's computer system? Or a freak accident destroyed its main power supply? Those are the type of questions likely to be raised by Rodney J.Petersen, government relations officer for EDUCAUSE, and director of the organization's cybersecurity initiative. Petersen finds it surprising that only slightly more than half (51.9 percent) of survey respondents include cyber disruption in their emergency plans and far fewer (14 percent) conduct exercises that simulate such an incident.
“What's different about cyber disruption is that it isn't a discrete category of emergency—it can happen in conjunction with and complicate any other type of event,” explains Petersen. Consider a hurricane or flood; the rush of water could flood an institution's data center, crippling its ability to post updates on its Web site, send e-mail notifications, or broadcast via closed-circuit TV. Or, Petersen adds, “One way an active shooter could increase mass casualties would be to shut down the campus communications system, so information couldn't be shared. It may sound far-fetched, but it's certainly possible.”
Getting the power back on and returning computers to full functionality are top priorities for the disaster-recovery portion of Purdue's emergency preparedness plan. As far as addressing business continuity, Purdue places in the minority of survey respondents; fewer than one in three institutions (28.7 percent) reports having a campuswide plan for returning to normal business operations after an emergency. Approximately one in four (22.8 percent) has a business continuity plan for some parts of campus.
Those findings surprised several members of the project steering committee, including James Hyatt. He'd like to see more institutions formulating plans to bring back campus operations, such as power and IT services, as well as addressing academic continuity, such as keeping students on track with their educational goals even when a campus is physically devastated.
“During the site visits,” says Hyatt, “we found that institutions with good business continuity plans had boards that emphasized the need for one. Some boards enforced the idea by making the continuity plan part of the annual internal audit process.”
Free for the Taking
Realizing that a full-scale emergency could put Rollins completely out of business, Steve Neilson and his colleagues continue to craft the business continuity portion of the college's emergency preparedness plan. It's a huge undertaking, he acknowledges, but one made easier by the number of resources readily available to emergency planners.
“There's a wealth of information out there and an impressive number of people willing to share,” says Neilson, who gives especially high marks to the Disaster-Resistant University resources from FEMA as well as the members-only listserver discussion groups maintained by the International Association of Campus Law Enforcement Administrators. “Most of what we've done isn't original; it's taken from best practices in the field.”
With that in mind, here are some institutional initiatives from which you might borrow ideas for your own campus:
Text for all. Rollins College automatically downloads all of its students' contact information into the text-messaging system used during emergencies. Students can opt out, rather than opt in (the method used by 70 percent of survey respondents with text-messaging systems). “Since communicating during an emergency is so important, we're thinking we should make it an opt-out system for faculty and staff as well,” says Neilson.
Peer sharing groups. Two years ago, Shelby called 10 of her emergency planning peers and invited them to Purdue for a day of casual, yet confidential, discussion of emerging issues. Thus was born the Big Ten Campus Emergency Preparedness Directors group. It meets annually for two half-days, with a different university hosting each year.
“We spent much of this year's meeting talking about H1N1 and emergency preparedness in football stadiums. We also talk about incidents that have transpired on our individual campuses—and what is discussed in the room stays in the room,” says Shelby. “Any group of similar-sized institutions can do this, either statewide or regionally, and share how they address safety and security issues.”
Student involvement. Purdue's student government appoints a Student Campus Safety Task Force, which meets approximately four times per semester. Several student leaders, as well as two religious leaders from the local community, also serve on the university's Campus Safety and Emergency Preparedness Committee. The 39-member group meets monthly, primarily for education purposes. Several meetings, for example, have focused on what actions are—or aren't—allowed under the Family Educational Rights and Privacy Act (FERPA), the Clery Act, and the USA PATRIOT Act.
“The other impetus for the committee is relationship building. We want to get key people from the university and the community together before a crisis hits,” explains Shelby, who chairs the committee. “That way, when something happens and I pick up the phone to make a request, the person on the other end not only knows me but also understands what I'm asking for.”
Coordinated preparation. Cornell University developed its Emergency Planning and Recovery (EPR) system to provide administrative units with online tools for developing their own emergency and business continuity plans; each unit is expected to “return to normal” within 30 days of an emergency interruption.
“It has information relative to pandemic preparedness, for example, to ensure units take an all-hazard approach to their planning,” says Allen J. Bova, Cornell's director of risk management and insurance. The highly secure system also contains the names, responsibilities, and contact information of the key employees needed during and after an emergency. Because the EPR system integrates into the university's HR, facilities inventory, and identity management systems, says Bova, “everything is automatically updated with current information, which reduces the burden on individual units.”
Cross-campus consultation. At Loyola, the director of public safety and the director of student life meet once a week to review the previous weekend's incidents, the response to those incidents, and any ongoing implications.
Similarly, the dean of student affairs at Rollins College maintains a password-protected database that tracks students who have been involved in residence hall altercations or judicial hearings or identified by academic advisers as potentially having problems. Once a week for about an hour, representatives from student affairs, academia, athletics, and campus security meet to review the current list of students and decide who is the best person to reach out to each one. The database is updated regularly, as students are referred to the counseling center or situations are otherwise resolved.
Community policing. Since 2006, Loyola University Maryland has augmented its security force by hiring off-duty Baltimore police officers. As part-time college employees, the officers typically work four- to six-hour shifts and focus on the area of campus that tends to generate more problems.
“The other impetus for the committee is relationship building. We want to get key people from the university and the community together before a crisis hits.”
Carol A. Shelby, Purdue University
“The city police officers ultimately develop a better appreciation for and understanding of life on a college campus,” says John Palmucci. “As a result, when our students get into difficulty off campus, the city and the Baltimore Police Department work more closely with us.” An added benefit: The officers' familiarity with the Loyola campus reduces their response time to 911 calls because they already know the locations of various buildings.
A big-picture view. Taking a tip from corporate America, Indiana University, Bloomington, has appointed an associate vice president for information and infrastructure assurance to serve as the equivalent of a corporate chief security officer. “The technologies used to protect the three types of assets—human, physical, and cyber—are increasingly converging,” says Rodney Petersen, “so it makes sense for one person to focus on integrating the protection of information, infrastructure, and people. Appointing a chief security officer may be an effective way to coordinate campus safety and security.”
Ready for Anything
Petersen encourages every institution to think of emergency preparedness exercises not as tests but rather as training for faculty and staff who, after all, receive training in other aspects of their jobs. Tabletop or field exercises will increase their comfort level—and help build interjurisdictional relationships—when the next crisis occurs.
Petersen served as director of IT policy and planning at the University of Maryland, College Park, when a tornado ripped through the campus in 2001, just weeks after 9/11. “Before then, the university hadn't spent a lot of time talking about natural disasters, but serious planning went on as a result of those incidents,” he remembers.
“The reality is that natural disasters, such as [hurricanes] Katrina and Rita and the floods and fires we've had in the last few years, plus the shootings at Virginia Tech and Northern Illinois, force campus administrators to either develop or update their plans.”
So what's the next major event to influence emergency planning? No one knows. But being ready for whatever it turns out to be—and its short- and long-term consequences—is at the core of emergency preparedness.
“I once read that 90 percent of all emergency plans are useless. The emergency that actually happens is the one you probably haven't planned for,” says Cornell's Bova. “But what is beneficial in that case are the relationships, the communication links, and the culture of teamwork established during the planning itself.”
SANDRA R. SABO, Mendota Heights, Minnesota, covers higher education business issues for Business Officer.