CIOIN

There is perhaps no image of security more striking than the site of the World Trade Center in New York City. It was the scene of a terrorist bombing in 1993 that killed six people and, ten years ago, the epicenter of an attack that changed the world forever.

The events of September 11, 2001, marked the end of security as we all had known it, and the beginning of an era that now includes intense checks at airports, amplified scrutiny for those who want to travel across borders, a major focus on national security, and more emphasis within organizations on mitigating risk and evaluating how well they are protected. Difficult lessons were learned at the World Trade Center on September 11, 2001. And now, from an office 19 floors above the site, Louis Barani oversees the construction and design of a security system that heeds those lessons and will take the new World Trade Center into the future.

Barani, a naval veteran who has 25 years of government and private-sector experience in security-risk management and critical-infrastructure protection, was brought in to be World Trade Center Security Director after working at the Port Authority's Office of Emergency Management as general manager for security programs. He was charged with bringing together a disparate set of security and building-management systems, as well as the many stakeholders involved in the process of developing security for what is possibly one of the most talked-about redevelopments in the world. When the redesigned and reconstructed site is finally opened, it will comprise five new skyscrapers, the National September 11 Memorial and Museum, a transportation hub, a retail complex and a performing arts center.

"The conditions on the site are separate and distinct stakeholders and components," says Barani. "The five towers, the memorial and museum, the transportation hub, underground roadway, network, vehicle security center—they all have different security and building-management systems, and all are controlled by their own operations and security command centers. What we needed to accomplish was situational awareness for the entire site to coordinate responses to events that could have a negative impact."
And that is what Barani is now developing. An event- and identity-management system he refers to as a Situational Awareness Platform. The system will overlay security and building-management systems (BMS)—including access control; CCTV; alarm; fire; chemical, biological, radiological and nuclear (CBRN) defense; HVAC; elevator control; and visitor management—and fuse and correlate information from them to create that situational awareness. It will give Barani and his team information about events, conditions and even identities that can be used by law enforcement and fire and life safety crews as needed.

"We had to find a way to generate as much information as possible, fuse it, correlate it and bring it into one location," explained Barani. "We took two products—event management and identity management products from VidSys and Quantum Secure—and developed an integration between them with a single rules-development driver. This way we can correlate information from the event and the identity and have a better situational awareness."

Barani explains that the identity management piece might come into play if, for example, an employee's access card is stolen or lost. If someone steals a card and is trying to get into a critical area, such as a closet containing sensitive assets, a central chiller plant, or a critical electrical area, it will generate a single alarm. But if there are multiple attempts made using that card, it will be flagged by the system because it does not clear a threshold of acceptability.

Scenario in the Mumbai-style Attack

"We will know someone is trying to access critical areas at different locations," says Barani. "Then we bring in the identity management portion of it and see if the person we observe through the CCTV is actually the one using the card. If it's not, we have a law enforcement situation. If it is someone with access and they are trying to probe certain areas, we also know how to respond."

The access card example is a simple scenario, but the situational awareness system would also be critical in the event of a large-scale or, as Barani refers to it, a Mumbai-style attack: a scenario involving several attackers trying to harm people and buildings.

"In a dynamic situation with multiple attackers and responding agencies, we need to know where the good guys are, where the bad guys are, and what they are doing. With this system, we have immediate access to information like where attackers are located through multiple access control and CCTV systems. We'll have access to information from the BMS system and HVAC system to tell fire department representatives that this is status of the fire, these are the points of alarm, and this is the area where the fire suppression system has deployed, these are the floor plans of where the fire is, this is the floor above and below, this is the status of the stair pressurization, this is what the elevator system is doing, here's what the evacuation looks like in lobby."

The system also provides information from a CBRN system and sensors that can collect information in the event of a chemical, biological or radiological threat or attack.

"We worked with NYPD to determine which agents they were most concerned about and developed a systems design based on that. Based on the makeup of the agent and the prevailing winds, we can determine strategies like sheltering in place, evacuating buildings, and informing our neighbors in the area of ongoing response protocols."

Despite the convergence of information, each property will still operate its own distinct security and building management operation. Each will act autonomously, with a security command and operations center that includes guards and monitoring.

Stakeholders will be provided access to the situational awareness platform information. Police and fire officials will, too.

Bringing together the various entities involved—agencies, fire and police, private stakeholders—has been no small feat, says Barani.

"The biggest challenge is education," he says. "As far as I know, this has never been done before, never attempted on a scale this big. It would be easier if it were just the Port Authority involved, but there are commercial stakeholders at the site. There are the city agencies, NYPD and FDNY. There are stakeholders outside the site that have just as much at stake if we get attacked. The toughest part is educating these stakeholders and getting this information out to the point where they see this will benefit everyone, as a group with common security needs for lower Manhattan."

But the cooperation is there, he says. And he is pleased with the progress he has made. The situational awareness platform, he notes proudly, is being talked about elsewhere, including among Port Authority officials, who are contemplating taking it agencywide.

"We are developing actionable information so that first responders can respond with as much information of the situation as can be generated from diverse systems at multiple locations through the development of scenario-based rules, and that's the key. For example, we have over 4,000 cameras here. To actively monitor that would be impossible. The basis of the [Situational Awareness Platform], why it's so powerful, is that we can reach out through the API and retrieve the information we need based on rules that we develop for that specific situation. We don't have to monitor every single camera on the site, every alarm.

"We have to get the information in, correlate and fuse it and disseminate it in a coordinated fashion. With this system, we are able to do that.