SECURING XLVI HOW 'S PUBLIC SAFETY TEAM STAYED AHEAD OF THE GAME The people of Indianapolis are no strangers to large sporting events. 's largest city, which is also the state capital, has run its annual Indy 500 auto race since 1911 and has served as the venue for numerous sports championships over the last several decades, including seven NCAA men's college basketball 'Final Fours' since 1980 and three games of the 2000 National Basketball Association finals. And in 2012, for the first time, Indianapolis secured the right to host the 's Super Bowl game — along with the considerable public safety and security responsibilities that came with it.

Even with their broad prior experience and expertise, public safety officials in the city and surrounding Marion County faced some unique challenges in preparing for Super Bowl XLVI, which took place on February 5 at Stadium in . Such a high-profile event with large concentrations of people and activities — and thus an increased threat profile — meant more federal government involvement than previous events held in the city. In fact, Super Bowl XLVI was assigned the highest-level Special Event Assessment Rating (SEAR) by the U.S. Department of Homeland Security (DHS) and Federal Bureau of Investigation (FBI), leading to pre-deployment of federal assets and other assistance (see Figure 1).

Figure 1: The Super Bowl XLVI security operation in and around (pictured above, left) involved a broad array of personnel and equipment, and was coordinated between dozens of local, state and federal agencies. (Photos courtesy of U.S. Dept. of Homeland Security [left] and AP [right]).

Federal partners included the FBI, Intelligence Community agencies, the Transportation Security Administration (TSA), Immigration and Customs Enforcement (ICE) and some 30 other agencies. A TSA official acted as Federal Coordinating Officer (FCO), whose job was to ensure unified federal support and appropriate national-level situational awareness; an ICE official was Deputy FCO. This massive federal presence augmented a large state and local contingent that included the Indiana State Police, Indianapolis Metropolitan Police Department (IMPD), Indianapolis Fire Department (IFD) and the Speedway (Indiana) Fire Department. Even the NFL hired a cadre of security officers to work at the stadium and surrounding venues.

LAYING THE ORGANIZATIONAL GROUNDWORK Under the authority of Indianapolis Public Safety Director Frank Straub, the designated Incident Commander for Super Bowl XLVI was Indianapolis Chief of Homeland Security Gary Coons, a former city investigator. His mission: to protect 800,000 residents; 150,000 visiting spectators, teams and VIPs; over 200 critical assets; and 300-plus Super Bowl-related events over a 10-day period culminating in the Patriots-Giants game on February 5 — not just from potential terrorist attacks but also from crimes, gang violence, fires, accidents, natural hazards and other disruptions — all of it coordinated with multiple government partners.

To meet this complex challenge, Chief Coons set up a computerized and networked command center known as the Public Safety Compound (see Figure 2); mobilized approximately 3,000 law-enforcement, fire and emergency-medical personnel to patrol a one-square-mile area around the stadium; deployed plainclothes field intelligence and hazardous materials teams; and pre-positioned hundreds of security cameras, specialized vehicles and other monitoring equipment. As Straub told the local media beforehand, "this will be the most technologically secure Super Bowl in the history of the [game]."

Figure 2: The Public Safety Compound, a cluster of tents set up inside a municipal warehouse located 1.5 miles from Lucas Oil Stadium, was the nerve center for the Super Bowl XLVI security operation. It provided a detailed and continuously updated picture of the security environment for commanders and multiple partner agencies.

In the field, the Indy team concentrated its personnel and pre-positioned its equipment within a 44- block Area of Operation (AO) that included Lucas Oil Stadium; the Indiana Convention Center, which housed the mammoth NFL Experience complex; and a section of Georgia Avenue that was transformed into Super Bowl Village, where all manner of parties, concerts, recreational activities and other attractions took place.

Chief Coons used Haystax’s risk-management software platform to provide rapid field intelligence reporting and enhanced command situational awareness. By leveraging Haystax’s cloud architecture he was able to connect stakeholders within his command team, his deployed forces and his federal and NFL partners in an Indianapolis Public Safety 'ecosystem'. Each team member, based on his or her role, jurisdiction and need to know, could enter information about suspicious activities or emerging incidents and/or stay current with constantly updated information from a variety of sources. Using the in-built analytics in the Haystax platform, the command team synthesized dynamic information coming in from field intelligence reports, incident logs, police and fire calls for service and even social networks, to

create a prioritized picture of rapidly unfolding events. Chief Coons, working within his overall command strategy, was able to share situational awareness views with field elements and partner agencies — in command centers, at forward-deployed command posts and on the move through mobile applications – creating a common operating picture of the AO and decreasing response times to incidents.

RAPID PREP, RAPID DEPLOYMENT Within a limited time window, the Indianapolis Public Safety Team needed to build an understanding of its threat and risk environment, create a Haystax deployment strategy, integrate dynamic feeds of data and train its core set of users.

To build a deeper understanding of the environment, aid in planning and provide and share context for operational decision-making, the Indy team used the Haystax platform to compile critical information about the AO. In the space of about four weeks, team members were able to use Haystax’s Assets, Events and Assessments apps to compile comprehensive and detailed information on critical- infrastructure assets in the AO as well as Super Bowl-related events taking place over the operational period, and share this information with their partners.

Critical asset data included site assessments and information provided by local intelligence authorities (see Figure 3). The team started with 20 of the top sites and kept adding new ones until it had comprehensive data on some 160 assets related directly or indirectly to the Super Bowl, including the stadium, airports and railway stations, hospitals, hotels and restaurants, convention facilities and water and electric utilities. In addition, a total of 23 field assessments and 25 vulnerability/consequence risk assessments were entered into the system.

Figure 3: The Haystax mobile assessment application (screen shot, left) gave users in the field the ability to create security and vulnerability assessments of critical infrastructure assets using hand-held mobile devices. An extensive database of Super Bowl-related assets was assembled in advance (screen shot, right). Clicking on a particular entry called up additional information on that asset, including a site description, key contact names and numbers, risk details and events taking place at that location.

Besides critical assets, the core database also featured a lengthy list of scheduled events provided in advance by the NFL, including dates, times and locations. These were events sanctioned by the league, such as press conferences, the NFL Commissioner's Ball and parties sponsored by magazines like Sports Illustrated. In addition, the Indy team independently gathered data on events not sanctioned by the NFL — for example tailgate parties and nightclub appearances by celebrities. All told, more than 340 sanctioned and non-sanctioned events were keyed in, cataloged, prioritized and classified by level of risk. (See Figure 4 for a sampling of these events.)

Figure 4: Sample of NFL-Sanctioned and Unsanctioned Events Sanctioned Unsanctioned 27 Jan: NFL Experience opens to general 28 Jan: Super Kids Fest benefit public 29 Jan: AFC, NFC team arrivals 30 Jan: The Dan Patrick Show filming 31 Jan: Super Bowl Media Day 31 Jan: Bacardi Super Bowl Party 01 Feb: Super Bowl Fan Jam 01 Feb: NBC Late Night with Jimmy Fallon live broadcast 03 Feb: NFL Man of the Year press conference 02 Feb: Third Annual Celebrity Bowling Bash 03 Feb: NFL Friday Night Party 03 Feb: Aces & Angels Salute to the Troops 05 Feb: NFL Tailgate Party 04 Feb: 9th Annual Leather & Laces Party 05 Feb: NFL Halftime Show 04 Feb: Athletes in Action 2012 Super Bowl Breakfast 06 Feb: AFC, NFC team departures 05 Feb: Rolling Stone Rock & Roll Fan Tailgate Party

During Super Bowl festivities a number of unanticipated or short-notice 'flash' events were also added to the database. The ability to insert these dynamic events 'on the fly' meant they could be displayed immediately on-screen alongside scheduled events and nearby critical assets. All command elements and support personnel, even those unfamiliar with the city and its layout, could instantly understand these incidents in their broader context and make more informed response decisions as a result.

With analysis of events and infrastructure providing the threat and risk context, dynamic information could be analyzed against that context to provide prioritization of emerging information. The Haystax system allowed users to link to a variety of additional dynamic data sources. Computer-aided dispatch (CAD) feeds from IMPD and IFD were integrated, allowing incident commanders to view incoming 911 emergency calls. Other dynamic data was sourced from local news media reports and from social media like . When integrated with the Haystax platform, all feeds were routed through its analytics so that the information could be prioritized and presented to decision-makers for action.

Because the Haystax system was new to the Indy team, training and orientation sessions had to be provided for roughly 150 law enforcement, security and intelligence personnel who were part of the Super Bowl deployment. Most training was carried out over three days in late January, and focused on two distinct groups of users: 1) incident-command and operations-center personnel who would be using the cloud-based web apps; and 2) field personnel who would be downloading and using two specialized Haystax mobile apps. (Training was also provided to so-called 'scribes', who would be entering incident data into the system in real time.)

SECURITY OPERATIONS DURING SUPER BOWL WEEK Indy public safety personnel first logged in to the Haystax system on January 26, after which it remained in steady use until February 6, the day after Super Bowl XLVI. The system generated a common operating picture not just for on-site commanders and personnel but for a number of other users at

linked operations centers around the area, including classified environments located inside the city's new $18-million Regional Operations Center (ROC) and an operations center at the Indianapolis International Airport.

A number of forward-deployed elements could also view the information, including those at the stadium and various NFL-affiliated organizations, a media center at the JW Marriott Hotel, the two football teams' hotels and the NFL's temporary local headquarters. Federal users included staff at the National Operations Center (NOC) in Washington DC. There was even an NFL executive monitoring operations from league headquarters in Manhattan. (See Figure 5 for a list of those using or accessing the system).

Figure 5: Key Elements Using or Accessing the Haystax System Incident Command Elements Forward-Deployed Elements Public Safety Compound (in municipal warehouse) Lucas Oil Stadium Joint Operations Center (at Indy ROC) Super Bowl Village Intelligence Operations Center (at Indy ROC) NFL local headquarters (Westin Hotel) Tactical Operations Center NFL Experience (Indiana Convention Center) Joint Information Center Giants lodging (Indianapolis Marriott Downtown Hotel) Marion County Emergency Operations Center Patriots lodging (University Place Hotel) Indianapolis International Airport Operations Center Media Center (JW Marriott Hotel) ESPN Zone (Pan American Plaza) Federal Elements VACIS (GM Stamping Plant) DHS National Operations Center (NOC) DHS Protective Security Advisor Mobile Elements Federal Coordinating Officer (FCO) Field Intelligence Teams (FITs) Deputy Federal Coordinating Officer (DFCO) Hazardous Incident Teams (HITs) Incident Command team

MOBILITY AND FIELD INTELLIGENCE One of the hallmarks of the Super Bowl XLVI security operation was the large amount of dynamic data originating from field personnel equipped with smartphones and other mobile devices. Indeed, the ability of field teams to collect and transmit data from various locations for immediate analysis was unprecedented. According to Public Safety Director Straub, "we're using technology here that's never been used in any major event."

The deployed mobile units included nine Field Intelligence Teams (FITs), each composed of two to three plainclothes officers, plus 11 uniformed Hazardous Incident Teams (HITs), consisting of an explosives technician, a bomb-sniffing dog and a hazardous-materials specialist from IFD.

An Apple iPhone™ was distributed to each of the 20 FIT/HIT teams. Configured with Haystax's Mobile Indicator reporting app (see Figure 6), field personnel used the phones to transmit suspicious activity reports (SARs), incident reports and regular status check-ins every half hour via dedicated FIT and HIT 'channels'. The field reports contained photos , an incident type (selected from a dropdown menu) and written descriptions of activities and packages. Inbound field reports were scored and prioritized immediately upon receipt and presented with geo-location information on-screen at the Public Safety Compound. Over the course of 10 days, more than 540 submissions came in from the FIT/HIT teams. If a field report surpassed pre-determined risk prioritization thresholds the system would trigger automatic alerts and email notifications and route those to interested parties.

Figure 6: Mobile teams would regularly check in and submit field reports using iPhone apps specially configured for FIT and HIT standard operating procedures (photo, left). Field reports would then show up on monitor screens in the Public Safety Compound and other networked locations (screen shot, right).

COMMAND SITUATIONAL AWARENESS — ANYWHERE AND ANY TIME Once it was fully operational, the Public Safety Compound became the hub of a risk management ecosystem that gave incident commanders an unprecedented level of real-time situational awareness, thanks to a detailed picture of critical assets, scheduled events and emerging threat situations formed by integrating data entered in advance with a constant stream of status and incident reports from mobile units in the field, information on resource availability and personnel locations and numerous third-party updates such as emergency dispatch calls, local news reports and social media posts.

Inside the compound, Chief Coons — with a Deputy Chief over law enforcement operations and intelligence and a Deputy Chief over tactical rescue and hazardous materials, along with other officials — monitored the security environment using Haystax threat and risk monitoring tools, which showed information displayed in timeline, triage (priority) and geospatial (map) formats. They also monitored a master incident log that fused incident reports from all sources into a central tracking log (see Figure 7.)

Figure 7: The four primary 'command views' of the operating environment included: Timeline Monitor (left rear), a way of merging all pre- entered events with the latest incidents in a daily calendar format broken into 24 hourly segments. Feed Monitor (right rear), containing a Triage View, which scored and prioritized a variety of feeds — such as 'See-Something/Say-Something' submissions; social media and news reports; and FIT/HIT field reports, SARs and reports of unanticipated 'flash' events — in a way that would highlight in large bold lettering the highest- priority incidents based on threat scores. Geo Monitor (left front), a map-based view used mainly for viewing incidents, field reports, CAD data and Twitter data set against the backdrop of critical infrastructure and events. Incident Logging (right front), a way of tracking and clearing incidents, from initiation through closure, throughout the entire Super Bowl process.

On these displays the command team could see details of all field intelligence reports, calls for service, incident reports and Twitter chatter throughout the Super Bowl period. As Chief Coons put it: "I was able to watch every dimension of an incident up to and including its clearing." This detailed situational awareness allowed Indy team members to adapt their operations to the changing environment, decrease response times and better coordinate the massive resources at their disposal. And because all dynamic information was analytically prioritized in the Haystax system before being displayed, they were better able to direct their resources and attention towards the most important activities.

Officials like Public Safety Director Straub, Chief Coons and the FCO were also free to move about the city without sacrificing their situational awareness, thanks to the availability of Apple iPad™ tablets equipped with the Haystax Mobile Command app (see Figure 8). As its name implies, the app provided executive and field commanders with the same prioritized geospatial situational awareness they could get in their command centers. While in the field, at the stadium, off shift or at home, commanders could continuously monitor data on critical assets and events, CAD 911 calls, FIT/HIT reports and monitored social media feeds. Each commander could configure the app to filter on different feeds and analytic scoring based on individual information needs and command style.

Figure 8: Mobile commanders equipped with Apple iPads and the Mobile Command app could view key assets and event locations, as well as dynamic data like CAD calls and field intelligence reports, updated in real time. Filters allowed them to control the amount of data on-screen.

ANATOMY OF AN INCIDENT RESPONSE: TWO CASE STUDIES The real-time responsiveness of the Indy system and the decision-making power it gave to commanders and field operations personnel alike can be illustrated by two specific incident examples.

CASE STUDY 1 — PROPANE TANK On Wednesday morning, February 1, a citizen reported seeing an unattended propane tank on a sidewalk in front of the Indiana state capitol building. The following timeline shows the sequence of steps that the Indy public safety team took in response (see Figure 9, screen images 1 and 2).

10:30 — Suspicious package reported by passerby 10:37 — HIT Team 4 responds, takes photo, submits suspicious package report (Image 1) 10:43 — HIT Team 4/ICE EOD team X-rays tank, submits image of X-ray (Image 2) 10:44 — Incident commanders able to evaluate text description and imagery of tank 10:45 — HIT team removes tank for later disposal

Figure 9 Image 1 Figure 9 Image 2

With high confidence that the tank had not been converted into an improvised explosive device, the Indy team was able to wrap up the incident quickly and with minimal disruption to people in the area.

CASE STUDY 2 — PROTEST MARCH In a second incident that directly impacted security in the AO, several groups opposed to a newly signed 'Right-To-Work' bill organized a march from the state capitol to Lucas Oil Stadium on January 28. The Indy public safety team, aware of the disruption a growing protest could cause, began analyzing all information feeds at its disposal. Commanders were kept abreast of protesters' movements through Haystax mobile intelligence devices, which allowed them to position resources and assets along the protest route in such a way as to best accommodate the protesters, while minimizing any disruptions to the fans participating in Super Bowl activities.

In order to enhance their situational awareness, officials gathered and analytically prioritized multiple data feeds throughout the course of the protest to better understand crowd sentiment. Specific incidents were captured and managed, so that Public Safety Compound personnel could monitor their status from inception through resolution. This information assisted in the decision-making and response-analysis scenarios being reviewed in the Compound. In addition, officials were then able to use the information for after-action reporting and analysis.

POST-GAME WRAP-UP The last big event of any Super Bowl is the departure of the winning and losing teams, after which the host city breathes a big sigh of relief — and begins the process of evaluating the operation.

From January 26 to February 6, there were 192 Haystax system users altogether. They included at least 91 IMPD, IFD, state and local users as well as 27-plus federal users, including staff at the DHS NOC. Among these individuals there were approximately 1,850 total logins, including 218 logins by 78 individual users on Game Day.

During this time a massive amount of dynamic data flowed into the Haystax system to complement the already-large core data that had been entered in advance. For example, the asset catalog had to be expanded several times as new incidents and events came to light in the days leading up to the game — so that by Sunday night it had grown from 160 assets to 210. In addition, the Indy team reported on,

analyzed, prioritized and tracked a total of 1,583 incidents during the Super Bowl period. And besides some 540-plus FIT/HIT submissions, the system also fielded 21,638 CAD items and monitored 65,549 tweets. (See Figure 10 for a summary of incidents and FIT/HIT reports on each day.)

Figure 10: Timeline showing incidents logged and field intelligence reports submitted over the Super Bowl XLVI period. Each day is divided into two 12- hour operational periods (OPs), which typically ran from 7am-7pm and from 7pm-7am.

More broadly, the presence of field intelligence teams equipped with Haystax mobile apps vastly improved the quality and quantity of real-time information available to incident commanders, and hence their decision-making capabilities. Their command situational awareness was also enhanced by extensive integration of static and dynamic data, and the ability to filter out non-critical information. Finally, social media played a valuable role as a kind of early indications and warning system that proved its worth during more than a few incident responses.

According to Chief Coons, the Haystax system “was an excellent real-time situational awareness, resource tracking and event monitoring tool. In addition, from an incident/event commander's perspective, the knowledge of resource commitment and availability, especially in such a large-scale event, was invaluable."

# # #