In the Fall 1995 issue of Hospitality Upgrade, then called the Hospitality & Automation Update, I penned the cover story, “How Secure Is Your Hotel?”

 

Fast forward to 2018: Because of a lunatic in Las Vegas on the night of October 1, it is once again a question that is being asked at hotels and hotel companies across the country and around the globe. 

 

Security is a big topic in every issue of HU and virtually every other news medium of late, but they are mostly focused on IT security, PCI and hackers. It is time once again to return to the original definition of security – the protection of your guests, your staff and your physical assets.

 

All the hullabaloo of the press during a big news event aside, ignoring, at least for now, the call for metal detectors and baggage scanners at the front doors, let’s look at the issue like professionals. Let’s ask the question, How Secure Should Your Hotel Be?

 

The first steps in any security scenario, from presidential travel to shoplifting at the local drugstore, is to assess risks, threats and vulnerabilities. And, unfortunately, in today’s environment, these variables also need to be parsed into two subcategories – actual and legal.

 

And speaking of legal, this would be a good time for me to eliminate my liability in this article: Legal Disclaimer: I am not a lawyer. I don’t even play one on TV. I did however take hotel law with Dr. Norman Cournoyer at UMass, and the very first thing he taught us was when you have a legal question, ask a lawyer. (However, he wasn’t amused when I brought my brother, the lawyer, to the final exam arguing that I was just following his advice as I was confident that there would be a lot of legal questions on the exam.) 

 

You should talk to a lawyer (or at least your corporate head of security, who has undoubtedly spoken to counsel) before you do anything or decide not to do anything. Some actions taken, done wrong, or not done at all will affect your liability in the event of an incident. Hotels have a “duty of care” in many jurisdictions. Guests have an expectation of privacy as well – consult with someone who knows. In the end, however, my cop friends have a saying – it’s better to be judged by 12 than carried by six.

 

While not a lawyer, I am, however, a part-time cop. I’ve spent several years advising and designing security systems and protocols for the likes of The National Oceanic and Atmospheric Administration (NOAA), the Federal Trade Commission (FTC), The Royal Embassy of Saudi Arabia and the Tysons Corner Center mall. I even worked on a sub-system for the National Security Agency (NSA – I could tell you about it, but then I’d have to kill you), and advised the National Center for Missing and Exploited Children (NCMEC) on technologies to prevent infant abduction. Each had very, very different threats, risks and vulnerabilities. 

 

The embassy, for instance, was in downtown Washington, D.C. The ambassador had three armed security forces (Saudi government, U.S. Dept. of State security, and a private group of ex-British Special Air Service/SAS officers) and he received about 150 death threats a year. The embassy only had one quasi-public entrance, one employee entrance and an underground garage. The Tysons Corner Center mall, on the other hand, is in suburban D.C. It has some cars stolen and lipstick and sweaters shoplifted, has dozens of ways in, and out, and must also be a welcoming place for shoppers. However, in our evolving world, the mall recognized the need to offer some deterrence and monitoring for potential assaults in the parking structures, and other issues. The embassy had a virtually unlimited budget; the mall, not so much. But both needed to come to a solution that resolved their specific needs and issues while dealing with their realities both in terms of budget and visitor expectations. What we needed to do for each was to assess the threats, risks and vulnerabilities, and then develop a workable solution to address them. So do you.

 

Let’s define what we are talking about:

 

A threat refers to anything that has the potential to cause serious harm. A threat is something that may or may not happen, but has the potential to cause serious damage. In a hotel this could range from a guest slipping in a bathroom or a staff member stealing from a room, or being assaulted in one, to the Las Vegas shooter. All of these possible threats have varying degrees of likelihood.

 

A vulnerability is a weakness or gap in protection efforts. Hotels have a special problem here. Hotels are, by nature and definition, “a place of public accommodation.” This puts certain requirements on you regarding access and, perhaps just as importantly, creates certain expectations in the minds of your visitors and guests that need to be met if you want to stay in business. This aspect of hotel operations can make a hotel more vulnerable to certain types of incidents just because you have to let almost anyone in. The saying, “perception is reality” very much applies in hotels. Hotels can create additional vulnerabilities by doing things such as not lighting parking lots or locking secondary entry doors at night.

 

Risk is the potential for loss, damage or destruction of an asset, or harm to a person, as a result of a threat exploiting a vulnerability. Risk is the intersection of assets/people, threats and vulnerabilities. Put another way, what are the odds of something happening, like a guest getting mugged in a dark parking lot in an inner city. The odds are pretty good. A lunatic taking multiple assault-style weapons to a guestroom and raining fire on a crowd of concert-goers is far less likely, but obviously possible.
 

To further complicate the issue, there is no one-size-fits-all for hotels. Case in point, despite being less than 10 miles apart, the mall and the embassy are very different places with very different needs, expectations and resources. A hotel’s needs will vary by class (chain-scale in the vernacular of STR Global), size, clientele and location, among others – each to some degree independent of the others. For example, in 2008 a Marriott was bombed in Islamabad, Pakistan. While probably not a foreseeable incident, it was certainly more likely to happen there than at a hotel in Bethesda, Md. And, while I have no direct knowledge, my confidence in Marriott’s management tells me that the security posture in Islamabad was then – and it is now – heightened over the protocols in Bethesda.

 

As a place of public accommodation, there's a duty of care attached to your establishment. In case you were hoping to look up what duty of care is, don’t bother. It’s based on the reasonable man theory in many cases: The reasonable man provides reasonable care. Some courts have even held that the “nicer” the hotel, the higher the duty of care.

 

Assessing risk can be the hardest part. It contains a huge number of unknowns and can change day by day. It requires you to stay on top of what is happening in your neighborhood, city, globally and the industry, because one of the first things a plaintiff’s attorney will try and argue is the doctrine of foreseeability (Schubert v Hotel Astor, 1939) – “a hotelkeeper and his employees must foresee certain situations that could become dangerous” or, that you “knew, or should have known” about a certain risk or danger, because if you knew and did nothing you are far more culpable (and the award will be larger). It’s not just that there were two muggings in your parking lot so you should have known and made it safer; it could be there was a mugging at a hotel two miles north and another at a hotel one mile west, which would be argued is a pattern that you should have prepared for.

 

If you are hoping to lay this off on your staff or, better yet, contract a security company, ask your lawyer if the doctrine of respondeat superior (Latin: "let the master answer”) applies. This doctrine says a party is responsible for (has vicarious liability for) the acts of its agents.
 

This is why the hotel security directors in many cities have formed little gatherings, often with local police invited, to discuss crime patterns and risk changes in their areas. They do this to stay informed and to be able to adjust their protective posture to try and stay ahead of the problem (so when your director says it’s his or her turn to host, offer to buy the coffee and donuts). 

 

Unlike Tom Cruise’s quote in “A Few Good Men,” where he says it doesn’t matter what he believes, only what he can prove, in this case, it only matters what each side can make a jury believe.

 

That was a long road to why, so what should you do? There is no one size fits all, but there are some basic things that are pretty much universally applicable. 

 

Peter’s Top 10 Recommendations:

 

1. When something happens that might require a police or fire response, call 911 immediately, and have a protocol for your staff to follow (evacuation, meet responders with keys, directions, updated information, etc.). I promise you two things: 

 

a.Cops and firefighters would much rather respond to the occasional false alarm than see a body count rise because “Gee, we didn’t want to bother them until we were sure,” or, “Gosh, this would look terrible in the press.” Cops used to assemble the SWAT team on an active shooter call before going in to challenge the shooter until they learned a person dies every six seconds in an active shooter scenario. Now the first cop to arrive goes after the shooter and the rest join them as they come. TIME IS NOT YOUR FRIEND IN AN EMERGENCY. 

 

b.Worried about negative PR? Consider how you would talk your way through explaining the extra dead customers because you didn’t make the call. The negative impacts on your business from not calling will be far greater than anything you might gain by waiting until you were sure.

 

2. Install electronic guestroom door locks with key codes that change with every guest and have been tested against compromise. If using keyless entry, make sure it has a protocol that uses the same security and has been tested for hacks. See Jeremy Rock’s excellent article on door locks from a few years ago that still applies today, http://www.hospitalityupgrade.com/_magazine/MagazineArticles/How-Secure-is-Your-Hotel.asp.

 

3. In many instances, it is a good idea to install closed-circuit video cameras to monitor access points, including employee entrances, with activity recorded. These can be set to record only when motion is detected so that you consume less storage space and it’s easier to review in the event of an incident. Personally, I like to put a low-key camera facing each entry to get a full face shot of everyone entering before they are even aware of cameras. 

 

a.Recorded activity should be stored in a secure location for 30 to 60 days. Discuss the length of time with your lawyer and local cops, but whatever you decide, stick to it.

 

b.Put up a sign that says the cameras are recording, but not monitored. It has been argued successfully that someone who was mugged felt safe and therefore let his guard down because a camera was seen and he assumed someone was watching and would run out to help if anything happened.

 

Don’t skimp here. This is not a job for Cousin Vinnie or the handyman who put the ring motion light on your garage. Hire someone who knows commercial security. It’s worth it. They’ll understand what I said about a camera facing a door. They'll know that at certain times of day, the sun beating through that door might distort the picture, and how to deal with it.

 

And speaking of the ring motion light, lighting is also very important. Bad guys like dark spaces, especially in parking lots, garages, etc. It would be a good idea to have a lighting audit too. The nice thing is that you can combine this audit with an energy audit and look to move to modern, controlled LED lighting. The LED providers claim a 40 percent to 70 percent cost savings in energy costs from the upgrade, so you get a two-fer (see sidebar).

 

4. After certain hours, doors other than the front door should only be accessible by guests with active keycards to manage traffic into the property. 

 

After a certain number of hours, check each guestroom, even if there is a do not disturb sign on the door. (Hilton just announced a change in policy to do this.) The hotel is your asset and you have every right to inspect it regularly. Create a policy and process and follow it. I’d suggest adding a note to the DND sign that says that you will be checking every day, call the room before breaching the sign, and have security or a manager participate. You never know what you will find. It might be suitcases full of firearms in Las Vegas, or like when I was front office manager in the ‘80s, a body hanging in the closet.

 

5. If someone tries to rob the front desk, instruct your clerks to give them the money. No tricks, no arguments, no heroes – it’s only money. If you have your CCTV cameras on the doors and other key spots, you can give the cops the robber’s picture.  

 

I’m sure you’ve heard the saying, “the best way to stop a bad guy with a gun, is a good guy with a gun.” This saying is, for the most part, post-digestive male bovine effluence. I’m a certified Reserve Law Enforcement Officer (LEO, or cop, as we are often known) and we are trained that if we aren’t on duty, even if we are armed, unless a life is in immediate jeopardy, call 911 and just be a good witness. Don’t try and jump in and stop the crime.  We don’t have our radios, or bullet-proof vests, or handcuffs, and dispatch doesn’t know where we are. 

 

Shooting at people, especially armed people is not like in the westerns. Your pulse and breathing quickens, your vision narrows, your muscles tense, and accuracy suffers. No one wants a shootout in a hotel lobby, even if one shooter is a trained cop, let alone between two amateurs. 

 

Give the bad guys the money and call the cops, and your insurance company.

 

6. Unfortunately, assault of hotel employees by guests is apparently on the rise. Several cities now require panic buttons for floor staff. California introduced such a bill on Jan. 3, 2018 (see sidebar on communications technologies). No employee should ever be in a guestroom with the door closed. Housekeepers should not enter occupied guestrooms, and they should pull their carts in front of the doors to control access.

 

7. Get to know your local cops and firefighters. If anything ever happens, it’s better if they understand how the property is laid out. When I worked at a Ramada in New Jersey, we told the cops to stop by for coffee any time and invited the fire department to participate in our sprinkler tests and alarm drills. You will get a professional response regardless, but being able to go to the correct door without stopping in the lobby because they know the place can speed things along during an emergency.

 

8. All men are created equal. All groups are not. Particularly in this age of hyper-partisanship. It would not be a bad idea to have your sales staff get a little background on groups booking space and be prepared to work with security to prepare for (and bill for) additional security requirements. Some groups have pleasant sounding names despite their nefarious purpose, and would likely elicit protests that could lead to trouble. Doubt me? Call the mayor of Charlotte. 

 

9. Communications. You are operating in a structure or campus where you have responsibility for the life and safety of visitors, guests and employees that can be randomly spread throughout. Many will be unfamiliar with the physical layout, behind locked doors, potentially being woken from a deep sleep. How do you inform and direct them in the event of an emergency?

 

10. Plan Ahead. The worst time to figure out what to do in an emergency, is during an emergency. When one strikes, will you be there to handle it? Even if you work a 60-hour week, you’re only on property 1/3 of the time. You’re planning not just for yourself, but to provide your staff with a plan of action should the need arise; a map they can easily follow to get them through the immediate crisis until help arrives.

 

Going Overboard? Baggage Scanners and Metal Detectors

 

Baggage scanners would likely cost about $5,000 to $20,000 each depending on size and quality. Walk-through metal detectors, $750-$2,000. But that is pocket change compared to what it costs to staff and maintain them. Staffing alone at $15 per hour with 20 percent benefits is almost $160,000 per year assuming one staff member is manning the systems. Hotels operate around the clock, so the technologies have to be in place 24/7. And how many times a day would only one scanner or metal detector be sufficient for your guest traffic? And then there is the guest experience. I’m not seeing a lot of five-star reviews for the TSA.

 

And really, what’s the risk? Assuming there are 5 million hotel rooms in the U.S. at 65 percent occupancy, 1.2 days average length of stay and 1.3 guests per room, that’s 1.25 billion guests. Even if 1 million of them are bad – that’s only a 0.078 percent chance of a bad guy – it’s hardly a problem that justifies 55,000 hotels spending plus or minus $150K to solve.

There are systems designed to notice and bring attention to potential abnormal activity. NEC’s NeoFace^® facial recognition systems have been in use for many years by law enforcement, public safety and federal agencies that are tasked with securing our borders. These same technologies are now being made available to the enterprise, including hospitality and retail. "Hoteliers and hotel chains are taking advantage of this and are now using biometrics for a higher level of physical security at properties around the globe,” said Mike Gray, senior vertical practice manager – hospitality at NEC.

 

Recommendation to the Industry

Set standards. If your actions will be judged based on the reasonable man test, it would be good to have an established standard for what is “reasonable” for hoteliers to follow. That standard can be established by hospitality professionals with an understanding of the environments and issues, or by every random jury you might come in front of. In the United States, I suspect the FBI, FEMA and Homeland Security would even be willing to help. I’d prefer the former if I were your defense lawyer (assuming you followed the industry established standards).

 

As you read the sidebars, I’ve tried to add a "bright side” on how you can monetize these technologies and use them to your benefit so they won’t just be a weight on the P&L.

 

1. Panic Buttons and Communications Tech

 

It would appear that the concern for assaults on employees is on the rise as well as a call for panic buttons to be deployed. According to Fortune magazine, “A California court in October ruled that a hotel worker could sue her employer under state law after she was allegedly raped by a trespasser on the property. Workers’ advocates have been pushing hotels to equip housekeepers with ‘panic buttons’ to protect them from guests. And management’s responsibility is likely to be an issue in collective bargaining next year, when contracts covering roughly half the unionized hotel workers across the country are up for renegotiation.

 

“In Seattle, hotel workers now carry electronic whistles, on-demand RTLS panic buttons that alert security, or iPads with new emergency alert functions. Voters in the city approved legislation last year requiring that hotels provide such devices for workers and keep track of guests who have been accused of abuse. Chicago’s City Council in October voted unanimously to require similar devices.”

 

It’s already policy in New York’s union hotels as well as Chicago and Seattle, and California is considering similar requirements statewide. You can expect this issue to continue to grow, and solutions to continue to develop. On the bright side, some panic button systems only report location when activated, protecting the privacy of the staff.

 

One company called RF Technologies (RFT™) provides a discreet panic button shaped like a key fob, which staff can wear on a keyring, belt clip or lanyard. A press of the button alerts security and reports real-time location down to room-level accuracy. “We find that staff reports much more confidence in their personal security,” said Marina Willis of RFT. Help Alert® also includes a mass 

notification feature so security can distinguish between individual and large-scale threats. Once security pushes a mass notification where they can track every active panic button in real time to further direct security efforts.

 

A word of advice, if you are going to install panic buttons, make sure you plan for how you are going to respond when you get an alert. Sending a 90-pound housekeeper with limited English proficiency is likely not your best choice.

 

2. Mass Communications and Business Continuity Comms 

 

Since effective communications is essential in any emergency, it would be handy to have a system that can broadcast messages to everyone, or groups of people to distribute information and directions.

 

Employees might be the greatest benefactor from mass communication technology. "More than 80 percent of hotel employees don't have email addresses or computers but most have smartphones, making real-time employee messaging apps the ideal way to deliver emergency and general daily updates," said Corey McCarthy, vice president global marketing, Beekeeper.

 

On the bright side, you may be able to use this tech to send selective marketing messages to guests, or communicate with the staff around schedule changes, etc.

 

3. In-room TVs as a Tool

 

I’ll admit, this one is personal. After 17 years with LodgeNet, the last five of which (at least) spent trying to convince the company to develop this, someone finally has. vutyme by ADB Global is an interactive TV system that you can get through your local cable operator. 

 

Because each in-room set-top box is individually serialized, the company claims the ability to address each device independently, and because of how they handle and deliver content, the technology has the ability to display content over, or in place of, live TV. 

 

This delivers emergency alerts to the TV and gives specific instructions based on the room location and circumstances. For instance, if there is a fire on the 12th floor, the technology can tell floors 11 through 15 to evacuate immediately, tell guests which stairwell to use, and even tell guests in odd number rooms to exit their room to the left, and even numbers to exit to the right to get to the appropriate exit route.

 

On the bright side, the company offers all the standard iTV stuff like on-screen menus, concierge services, etc., so you can monetize the investment. If they could learn how to turn the TV on (which SONIFI (formerly LodgeNet) can), this would be perfect, but perfect shouldn’t be the enemy of good.

 

Sound Level Detection

 

A company appropriately named Quietyme makes a device that measures noise levels and reports these levels back to operators, allowing issues to be addressed in real time. The company has been providing these devices to hospitals for many years with good result.

 

The company claims that if one of these systems had been installed in the MGM Las Vegas, it would have been able to provide improved situational awareness, pinpointing the location instantaneously and speeding up police response to the scene. However, as previously noted, the probability of such an incident makes justifying such an investment questionable at best.

 

According to a 2012 article in Forbes, which cites a JD Powers study, noise is second only to poor internet connectivity on guests’ list of dissatisfiers. The article goes on to explain that while guests shared complaints about noise levels to J.D. Powers in this study, only about half of those said they reported the noise complaint to hotel management. Many guests will tough it out and in the morning decide it’s not worth reporting, while at the same time vowing to never stay at that hotel again.

 

On the bright side, these devices would allow hotels to pinpoint intoxicated patrons yelling down the hall at each other, loud parties, domestic disturbances and the like, and allow hotels to address what, according to JD Powers, is an oft unreported, but significant issue for guests. The report guests make is more likely to show up on review sites in the form of a bad review where it reduces the value of your hotel.

 

Energy Efficient LED Lighting and Controls

 

Bad guys like dark corners, so wise hoteliers are looking at their properties to make sure they are appropriately lit. Unfortunately, lots of good lights means high electric bills too. On the bright side, the newer LED lighting consumes significantly less power, controlled LED lighting uses less still and gives the power to turn lights on and off as needed. It makes sense to consider an upgrade while you are reviewing your lighting options.

 

As with many technologies, it's more complicated than most operators are prepared to deal with. I put my ZIP code into the website http://www.dsireusa.org/ and the search returned 30 possible rebates I might qualify for under various conditions. And this was just for my little house. Fortunately, AECOM, a Fortune 500 global leader in energy upgrades and construction management, has teamed with Quam Consultants and Chameleon Lighting to offer hospitality-specific programs to help. Depending on ownership’s view of capital and their balance sheet, the company has a source for off balance sheet “savings-sharing financing” which is bottom-line positive from day one.

 

Check with lighting providers, many of whom offer LED lighting systems for hotels, that can offer a level of energy cost saving (40 percent) and even offer a free energy audit.

 

Crisis Planning

 

An important component of the preparedness program is the crisis communications plan. A business must be able to respond promptly, accurately and confidently during an emergency in the hours and days that follow. It has to reach many different audiences with information specific to their interests and needs. Its image can be positively or negatively impacted by public perceptions the way it handled the incident.

 

This step of Ready Business provides direction for developing a crisis communications plan. 

 

Understanding potential audiences is key, as each audience wants to know: “How does it affect me?” Guidance for scripting messages that are specific to the interests of the audience is another element of the plan. The contact and information center tab at the following link explains how to use existing resources to gather and disseminate information during and following an incident.

 

For more information on this, see: https://www.ready.gov/business/implementation/crisis



Peter Klebanoff (peter.klebanoff@consultancyatpr.com) graduated UMass Hotel School and worked in operations for a dozen years before ‘going over to the dark side’ and selling technologies to hotels.  He now offers the extensive experience and knowledge he has accumulated to hotels and hotel-suppliers to help drive improved customer experiences and profitability. He has served on several non-profit boards and currently serves as a reserve police officer in South Dakota’s largest city.