Designing for Protective Security Week 1

UCL Institute, University College (UCL) Centre for the Protection of National Infrastructure (CPNI) • Aim: to provide students with a developed understanding of the theory and practice of designing for protective security. • Themes: • Reviewing key theories that explain the role Designing for of design in security Protective • Frameworks for assessing & responding to physical risks and threats Security • Principles of personnel security • CPNI practice examples • Future security threats and the role of new technologies Course structure

• Introduction • Design theories and problem profiling • Principles and Frameworks for assessing and responding to protective security risks and threats • Personnel Security Principles and Tools • Physical Security Principles and Tools • Practice example 1: Infrastructure Protection • Practice example 2: Protecting Crowded Places • Practice example 3: C-hostile state activity • Horizon Scanning for future threats • Poster session Understand Understand the role of protective security design;

Describe theories, frameworks and concepts relevant to designing for Describe security, risk assessment and threat mitigation; Outcomes- Understand Understand the contributions physical and personnel security provide to by the end protective security; you will be Apply theories, frameworks and concepts to different protective security Apply scenarios; able to- Appraise the relevance and likely effectiveness of different tools for Appraise protective security in different contexts;

Demonstrate an understanding of the principles of horizon scanning and the Demonstrate role of new technologies in future security risks and risk mitigation Method Weighting Length

Scenario assessment: students will 50% 1,500 word essay. be given a detailed hypothetical situation (e.g. a description of a piece of infrastructure). Students will then assess the potential threats Course risks and offer protective security assessment recommendations. Protective Security Measure poster: 50% 400 word poster. Students will choose one protective security measure/technology. They will undertake a SWOT analysis on the features of the measure and illustrate this in the form of a poster. • 1999- BBC Crimewatch presenter Jill Dando was The Jill Dando Institute @ murdered UCL • Co-presenter Nick Ross set up an appeal to set up Institute • Institute was established at UCL in 2001.

• The first university institute in the world devoted to reducing crime and other risks to personal and national security though . CPNI assesses risk to national security and reduces vulnerability and impact by:

• Maintaining good knowledge of the UK’s Critical National Infrastructure and its vulnerabilities

• Understanding the threat landscape and adversary modus operandi

What does • Developing strong partnerships with sister agencies, CPNI do? government, police and industry • Providing Expert Advice on risks and mitigations based on analysis, experience and a research and development programme;

• Taking an holistic approach: understanding the linkages between physical, personnel and cyber security

OFFICIAL © Crown Copyright National infrastructure sectors Delivering essential services to the UK

Communications Space Emergency Services Energy Chemicals Finance Food Government Health Transport Water Defence OFFICIAL Civil Nuclear © Crown Copyright Protecting the CNI: our approach

Our approach to security is:

• Impact driven • Vulnerability focused • Threat informed

We look at things in an integrated/holistic manner • Physical security • Personnel security • Information security - delivered by NCSC ( National Cyber Security Centre) • Technical security – delivered by NACE (National Authority for Counter Eavesdropping)

OFFICIAL © Crown Copyright How does design affect security? A volume crime example… Vehicle Theft patterns in London, 1923-1996 Car models at greatest risk for theft in the United States, 1983-85

Top-ranked cars for Top-ranked cars for Top-ranked cars for stripping temporary use permanent retention • Volkswagen • Buick Riviera • Mercedes Cabriolet • Toyota Celica 380SEL/500SEL • Volkswagen Supra • Porsche 911 Coupe Scirocco • Pontiac Firebird • Porsche 944 Coupe • Saab 900 • Mazda RX-7 • Mercedes 190 D/E • Volkswagen Jetta • Cadillac Eldorado • Nissan 300 ZX • Mercedes 190D/E Source: Clarke and Harris (1992) Auto theft and security levers Mandatory minimum standard immobilisers in Australia Security Devices Fitted Security Protection Factor against Theft

15.3

11.8

5.6

5.0 Source: Testing the Security Hypothesis 4.0 in Car Crime (Farrell et al , 2.7 2010)

1.2

None 1.0

= car alarm = electronic immobiliser =central locking How does design affect security? A protective security example… CPNI Hostile Vehicle Mitigation example Not just what is vulnerable but where… Which do you think is safer? Parking location theft variations per 100,000 cars per 24 hours (BCS, 1997)

• Home garage 2 • Home carport/drive 40 • Home street 117 • Work street 118 • Work car park 37 • Work other 62 • Public car park 454 Considering design upfront- a volume crime example for bike theft… Flyparking- design leading to vulnerability • securing of bicycles to street furniture not intended for that purpose

• Flyparking as an indicator – insufficient and/or inadequate parking Understanding cyclist locking practice

8500 obs – 12% found to be ‘secure’. Knowing doesn’t equal doing

• Stickers work by raising cyclists’ awareness of how to lock their bicycles securely

• awareness of crime risks does not = changes in behaviour

• cyclists must choose to act upon crime prevention guidance and eliciting a positive response to intervention will not be guaranteed

• manipulate the bicycle parking stand itself to encourage (or even ensure) better locking practices and therefore reduce the discretionary element of publicity interventions Intervention 2 – prototype stands

• Seven prototype stands seeking to improve locking practice – specifically through removing the top bar component to encourage (make it easier for) cyclists to lock wheel and frame.

• Different mechanism – change behaviour through design.

Bike Stand Trial Results

0.8 Sheffield before 0.7 Sheffield after 0.6 New

0.5

0.4

0.3

0.2 Fraction of all locking events 0.1

0.0 good ok bad Rating Considering design up front.. A protective security example The power of communications in a security strategy Some basic theories on the distribution of risks…

• These can be applied to both crime and protective security Random or Patterned? • Crime and security threats are non-random. Why? • Their distribution in time and space reflects the distribution of criminogenic situations. • What influences this distribution? Opportunities… • Routine Activity Theory • Crime occurs when three minimal elements come together in time and space: • A likely offender • A suitable target • Absence of capable guardian • Crime is patterned by daily routines that bring these three elements into alignment Source: Cohen, L.E., and Felson, M. (1979) Social change and crime rates: A routine activities approach. American Sociological Review, 44, 588-608. The crime triangle Differentiating protectors:

Capable guardian • Protects targets • Police, security guards, family members, neighbours, co-workers, CCTVs Capable handler • Exerts influence over offender • Parents, siblings, teachers, friends, parole officers Capable manager • Looks after locations • Bus conductor, teacher, mall manager, usher, pool attendant, bar tenders, train station managers, home owners Place Managers

• In addition to their primary function, some employees also perform a surveillance role. • These ‘place managers’ include shop assistants, hotel doormen, car park attendants and bus conductors.

• There are many examples of crime reduction: • Less vandalism has been found on buses with conductors and on council housing estates with resident caretakers. • Public telephones sited in pubs or railway stations where they receive some oversight from workers also suffer fewer attacks. • Apartment blocks with doormen are less vulnerable to burglary.

Source: Eck and Wartell (1997) Government Strategies for place management CONTEST

• Prevent • Pursue • Protect • Prepare The Significance of Grey Spaces • Areas where there is no clear control of protective security How do offenders choose targets? • Through their knowledge of places (crime pattern theory) • Crime generators • Places where large numbers of non-offenders are attracted providing crime opportunities • Shopping centres, train stations, sporting events • Crime attractors • Places where offenders are attracted providing crime opportunities • Prostitution districts, drug districts, • Crime enablers • Places where there are few crime controllers • No parking attendants, unsupervised playgrounds How does this apply to security?

• Crime generators- good targets for disruption. • Attractors and enablers- less regulated places are good targets. • How/where do people look? • Security examples- e.g. impact bridges How do offenders choose targets?

• Rational Choice theory (Cornish and Clarke 1986)- basic assumptions: • Behaviour determined by its consequences • Individuals seek to benefit themselves • Individuals are active decision makers • Behaviour occurs when perceived benefits outweigh perceived costs • Effort • Risk • Rewards Of course ‘rationality’ is bounded • Simon’s Bounded rationality • Decision making never perfectly rational

• Decisions limited by systematic biases, cognitive abilities, amount of relevant information, amount of time etc

• Satisficing decisions – alternatives examined one by one until satisfactory alternative reached • Assuming situated decision making, we can protect targets by: • Increasing the effort involved in committing a crime Situational • Increasing the risks associated with undertaking crime Crime • Reducing the rewards of committing crime Prevention • Reducing the provocations which can cause people to undertake crime • Removing the excuses which allow people to commit crime Ron Clarke’s 25 Situational Prevention Techniques #ProjectServator

• Today we covered: • Introductions • Module aims and object • Module assessment • How design can affect security • Why we might consider design upfront • The basics of some theories on the distribution of risk Summary • Routine Activity Theory • Crime Pattern Theory • Rational Choice Theory • The principles of situational crime prevention