Can you have too much access control?

June 21, 2019
Recent Virginia Beach shooting exposes security conundrum posed by active assailant incidents

News from last month's mass shooting in Virginia Beach, Va., that left 12 dead and five wounded at the hands of a “disgruntled employee” (as the news media always likes to call them), suggests that the police officers on scene may have had some difficulty entering or moving around the building because they did not have key cards.

Many public and private facilities have installed storage boxes containing keys (often known generically as “Knox Boxes”); most often near the front entrance doors. These are in place for responding police or firefighters to use their universal keys to get access to the master hard keys for the building. We see this most often afterhours, when police might respond to a burglar alarm call or firefighters may need to enter to check for smoke.

In the past, Knox Boxes usually held hard keys but not necessarily key cards. It’s time to expand our thinking about these storage devices. How about installing Knox Boxes at the most accessible rear and side exterior doors of the facility, so officers responding can enter from the north, south, east, or west doors? How about painting them bright orange, so they are visible as officers approach? 

We need to train our employees to remember to give their key cards to responding officers as they exit their building in any potential Run-Hide-Fight situation. We need to train our cops to ask for those key-cards and, more importantly, where they need to be used. Both of these concepts are difficult under the extreme stress of an active shooter situation where employees may be so scared, they can hardly think and the officers are so focused on stopping the shooter that they may not remember to ask for the key-cards or what doors they control.  

Are the key-cards graduated, so only certain employees, like managers or supervisors have all-access, where other employees’ cards may only work in certain areas of the building? We know these shooters make their own personalized target lists, which may include certain employees, bosses, ex-spouses or partners, HR employees, or senior leaders. HR departments and company or agency executives often keep themselves and their hard copy files or data protected under separate key-card systems. These room or suite-specific key cards must be included in any Knox Box installations.  

Reception desk employees and security officers need to have copies of all-access key cards they can give to the police in an emergency. As part of their posted orders and passdown procedures, security officers should sign these all-access master key cards in and out. We certainly want to keep those keys under careful control and not let them out of the building under normal circumstances, but the need for a master key card in an emergency should supersede keeping it under a separate lock and key that the frontline reception staff or security officers can’t control. 

Continuing the theme of officers being able to move quickly and freely throughout an unfamiliar building – within areas that the shooter may be quite familiar with – suggests that the directors and managers of security, facilities, maintenance, and IT should have the authority to disable the entire key card system building-wide in an active shooter or other mass evacuation emergency. Giving this power to only a select few – who might be out or on vacation during the event – wastes time and could cost lives. 

Some key-card systems are state of the art, adaptable, flexible, expandable, and use components that are time and stress-tested to work. Too many other currently installed systems are archaic, out of date, and combine hard key or Cipher-type locks with key cards, creating a hodgepodge, a mishmash of added-on devices and parts that cannot be completely controlled or deactivated. When asked why these jumbled systems exist and aren’t being replaced with a more streamlined systems, some security or facilities directors defer to the cost of the upgrades or the hassle of the installations. Have we not seen enough workplace shootings to re-open the discussions about not just installing key-cards, but having an intelligent plan to do so and making certain that plan includes key-cards in the Knox Boxes? 

We never want cops or employees to get trapped inside or set up for an ambush by the shooter because they can’t get into or out of an area controlled by a card reader system. And obviously it’s very disturbing for police officers to be on one side of a door ready to provide help to employees who are screaming, about to be shot by the attacker, or who are already injured, only to be stopped by the door lock system. This is the echo of the Columbine shootings 20 years ago. 

We know that mass attackers study (and even admire) the methods of other shooters. They learn from what worked and what didn’t; what caused the most loss of lives and what was foiled by security devices, brave employees or the police. The majority of these mass shootings don’t end up as hostage negotiations or hours-long barricaded suspect situations; they shoot themselves as the police close in or they force the police to do it. But these perpetrators follow the same thinking we do in professional security and access control: How do we deter, deny, delay, or defend? In their case, they want to keep police or armed security from stopping them for as long as possible. The police don’t want to get on the scene within a few minutes, only to waste more minutes trying to get inside, from room to room, or floor to floor. 

Robert May, JD, CEO of Mainstream Unlimited, a California-based security training and risk management firm, says, “Knox Boxes should be located at key access points for the building away from line-of-fire points. The police officers may need separate boxes than what the firefighters will need. You should create specific Knox Box security policies. Each box should contain both the relevant master hard keys and key-cards, in place for emergency responder access, depending on your agency’s operations.” 

Have we become too “key card happy,” putting locks at every hallway and creating unnecessary chokepoints when access control at that location is not really needed? We should not let the irony of good access control create situations where we have successfully locked out our first responders. 

About the Author:

Dr. Steve Albrecht, ASIS CPP, ATAP CTM, is an HR trainer and security consultant. He is internationally-known for his books, articles, and training programs on workplace and school violence prevention. He worked for the San Diego Police Department for 15 years. He can be reached at [email protected].