BY ROGER L. KEMP
From a homeland security standpoint, office, storage, and manufacturing buildings are typically not the target of a man-made disaster such as a terrorist attack. Such attacks would more likely be limited to critical locations such as key government buildings (“symbols of democracy”), transportation centers, nuclear power plants, and factories that produce war materiel (e.g., airplanes, helicopters, missiles, and other combat-related items). Nonetheless, standards are emerging for property owners and building managers to assess the vulnerability or risk level of their sites and facilities to a possible terrorist attack.
The vulnerability assessment categories and ratings given below may seem diverse and complex, but they offer a method for evaluation. A site’s potential vulnerability and risk can be determined by rating the facility using these criteria and a numerical rating for each category. The final score or assessment rating determines the site’s potential exposure to a possible terrorist attack. [Editor’s Note: This assessment is not an engineering analysis. It provides a basic benchmark for assessing the vulnerability of buildings.]
A site’s vulnerability rating can be determined using the following nine variables and ranking the response to each potential risk category using a six-point scale ranging from 0 to 5 points. The lower the numerical ranking in each category, the lower the vulnerability or risk level of the site. Conversely, the higher the ranking, the greater exposure the site has to a possible terrorist attack. The nine assessment criteria contained in this ranking process, as well as the rating scale used within each category, are explained in detail below.
VULNERABILITY ASSESSMENT
The nine criteria or variables selected for this building site vulnerability assessment are its visibility, its criticality to the jurisdiction, its impact outside of the jurisdiction in which it is located, the public accessibility to the site, the possible hazards at the site, the structure’s height, the type of construction, its population capacity, and the site’s potential for collateral mass casualties if attacked.
Visibility. The assessment item ranks the site’s visibility using the following scale.
Level 0, “invisible,” means the location is a “classified” or a “secret” location unknown to the general public.
Level 1, “very low visibility,” also means that the location is “secret” and “classified,” but that it is known by a very few people.
Level 2, “low visibility,” means that the knowledge of the site’s existence is public but generally not too well known.
Level 3, “medium visibility,” indicates that the facility’s existence is known only locally.
Level 4, “high visibility,” means the site’s existence is typically known throughout the region.
Level 5, “very high visibility,” means that the site’s existence and purpose are typically known nationally by the general public.
Criticality to jurisdiction. This assessment item focuses on the site/building’s criticality or importance to the jurisdiction (e.g., city or town) in which it is located. This assesses the impact the site’s assets have on the local population, economy, and government.
Level 0, “no usefulness” whatsoever; Level 1, “minor usefulness”; Level 2, “moderate usefulness”; Level 3, “significant usefulness”; Level 4, “highly useful”; and Level 5, “critical usefulness” to the city or town in which it is located. Level 5 is used only when a site/building is critically important to the general area in which it is located.
Site impact outside of the jurisdiction. This assesses the site/building’s impact outside of its jurisdiction, indicating the potential negative effect of losing the site or building on the area’s population, economy, and local government, and the effect of such a loss outside of the county.” The assessment ratings are Level 0, “none” (no impact); Level 1, “very low”; Level 2, “low”; Level 3, “medium”; Level 4, “high”; and Level 5, “very high.”
Level 5 is used only when a site or building is a large employer, significantly impacts the local economy, and has a close and vital working relationship with its local government.
Public accessibility. This assessment indicates the possible access to the site or building.
Level 0, “restricted,” indicates the site/building is patrolled 24/7; is fenced, alarmed, and equipped with security cameras; has controlled access that requires prior clearance; contains designated parking; unauthorized vehicles cannot park within 300 feet of the facility; and airspace and entranceways are protected.
Level 1, “controlled,” means that the facility has a 24/7 security patrol, is fenced, has controlled access for vehicles and personnel, contains designated parking, unauthorized vehicles cannot park within 300 feet of the facility, and the site has protected airspace and entranceways.
Level 2, “limited,” means that the site has security guards at the main entrance during regular business hours, is fenced, contains a security alarm, has controlled access for visitors, has designated on-site parking, no unauthorized vehicles can park within 300 feet of the facility, and has protected airspace and entranceways.
Level 3, “moderate,” means that the site/building has controlled access for visitors, has security alarms after regular business hours, has protected airspace and entranceways, contains designated parking areas, and no unauthorized vehicle may park within 50 feet of the facility.
Level 4, “open,” means site/building is open, has public access during regular business hours, has few if any safeguards in place, and has unprotected airspace and entranceways.
Level 5, “unlimited,” access, means site/building is open to the public, has no safeguards in place, and has unprotected airspace and entranceways.
Possible on-site hazards. This category rates the site according to on-site hazards. This includes the presence of legal weapons of mass destruction (WMD) materials and chemical, biological, radiological, nuclear, and explosive (CBRNE) materials in quantities that could make the site a target for a possible terrorist attack or would complicate the public response to a terrorist incident at the site if one took place.
Level 0, “none,” means none of the possible WMD/CBRNE materials are located on the site.
Level 1, “minimal,” means that “minimal” WMD/CBRNE materials are present in moderate quantities but are controlled.
Level 2, “low,” means that WMD/CBRNE materials are present in moderate quantities but are controlled.
Level 3, “moderate,” reflects that there are major concentrations of WMD/CBRNE materials for which there are established control procedures and the materials are secure.
Level 4, “high,” means that major levels/concentrations of WMD/CBRNE materials are on the site but that only moderate control features are in place.
Level 5, “very high,” indicates that major concentrations of WMD/CBRNE materials are on the site, no safeguards are in place, and this material is readily accessible to employees as well as nonstaff personnel.
Building height. This assessment category reviews the structure’s height, ranging from underground to a skyscraper.
Level 0, “underground,” indicates that the entire structure was built underground and would suffer little or no damage in an aboveground terrorist attack. Level 1 indicates a “single story”; Level 2, a “low-rise” structure, is a building that is less than five stories in height; Level 3, “mid-rise” structure, is one that is between five and 11 stories high; Level 4, “high-rise” structure, indicates a building of between 12 and 29 stories high; and Level 5, “skyscraper,” means that the building structure is more than 30 stories high. Since skyscrapers in America’s cities are few and far between, not many buildings would fall in this category.
Building construction. This assessment recognizes the sturdiness of the building’s construction. Level 0, “underground,” has the lowest vulnerability level from an attack perspective.
Level 1, a structure which is specifically rendered blast-resistant, or one that is protected by earth berms and embankments.
Level 2, “reinforced concrete,” is a building with steel beams within its structure.
The next three assessment levels in this category include buildings constructed with steel beams, masonry, steel studs, and wood: Level 3, “structural steel or masonry”; Level 4, “light frame” structures, typically contain steel studs; and Level 5, “wood structure,” is the most vulnerable type of structure from a terrorist standpoint.
Site population capacity. This assessment category indicates the maximum number of individuals at the site or building at any given time. Level 0 indicates that no population whatsoever is located at the site; Level 1 means between one and 250 people are at the site; Level 2, between 251 and 5,000; Level 3, between 5,001 and 15,000; Level 4, between 15,001 and 50,000; and Level 5, more than 50,000.
Potential for collateral mass casualties. This vulnerability assessment category reviews the maximum number of people within a one-mile radius of the site, reflecting the potential for collateral mass casualties in a major terrorist attack.
Level 0 indicates between 0 and 100 people; Level 1, between 101 and 500; Level 2, between 501 and 1,000; Level 3, between 1,001 and 2,000; Level 4 between 2,001 and 5,000; and Level 5, more than 5,000 or more people could be killed by a successful terrorist attack to the site.
Figure 1 provides a form for assessing sites/buildings based on the above descriptions and ratings.
SITE VULNERABILITY RATING
 Figure 1. Vulnerability Assessment Form |
The total number of points from the above nine ranking categories should be between 1 and 45. The total points for this assessment are broken down into five vulnerability or risk levels: negligible, low, medium, high, and critical. If your site’s total points are at the highest end of a category, it is prudent to prepare your facility for the next highest level of vulnerability.
- Negligible: 0-9 points
- Low: 10-18
- Medium: 19-27
- High: 28-36
- Critical: 37-45
Based on this site or facility’s vulnerability assessment rating, its owners/managers may want to take a number of commonsense remediation measures to offset the facility’s potential vulnerability to a possible terrorist attack. These measures include but certainly are not limited to providing perimeter fencing, installing parking security safeguards for employees and delivery persons, purchasing on-site surveillance cameras, using landscaping and vertical impediments to prevent vehicles from getting too close to the site, implementing some type of employee identification recognition process, and using security guards to protect the facility against possible intentional human wrongdoing.
Finally, review the four phases of emergency management: prevention, mitigation, response, and recovery. It is much less expensive to initiate upfront remedial measures to prevent an attack on your site or facility. Although there are no 100-percent foolproof safeguards, you can take commonsense measures as outlined above to minimize the possibility and effect of a terrorist attack and thereby limit the loss of life and property.
The use of assessment questionnaires to determine a site’s vulnerability and risk exposure level to a possible terrorist attack is likely to increase in future years. It is much less expensive to plan now than to have to respond later.
Although this assessment-rating process appears to be objective, greater consideration should be given to the weight that each category represents in the overall vulnerability equation. For example, an expert in this field could find a good reason to give more points to one assessment category than another. Also, if a terrorist uses a nuclear device, the various vulnerability assessment categories would have little meaning. For this reason, the criteria selected represent a general assessment of a building/facility’s vulnerability. This assessment tool is valuable for evaluating the vulnerability of public and private buildings/facilities to a possible terrorist attack.
Additional information on assessing and mitigating facility vulnerability to a terrorist attack is available at the following Web sites:
Federal Emergency Management Agency (FEMA): www.fema.gov
U.S. Department of Homeland Security (DHA): www.dhs.gov and READY.GOV: www.ready.gov.
ROGER L. KEMP, Ph. D., is a policy advisor in homeland security to the International City/County Management Association (ICMA) in Washington, D.C., and a career city manager. He is the author of Homeland Security: Best Practices for Local Government (ICMA, 2003).
