“It was glaringly obvious to me that the IT community and police on campus operated in two separate worlds and almost never interacted until after an event,” said van Gelder, who works in
Virginia Tech’s Office of the Vice President for Information Technology. “We did not work together in a proactive way at all. This is not to point fingers at anyone. In talking to colleagues at other campuses, I found it true elsewhere as well. There is a cultural divide between IT people, police and emergency responders. We all noticed it in the wake of the shooting and decided to address it going forward.”
In 2009, van Gelder became executive director of the newly created Office of Converged Technologies for Security, Safety and Resilience, which advocates for campus safety needs to the IT organization. The office also coordinates strategic initiatives that involve the intersection of IT security, physical security, campus safety and regional resilience.
Although IT offices dedicated to campus security are rare, teams made up of IT staff, campus safety and emergency management officials are becoming more commonplace. As more campus security solutions — from video surveillance to access-control systems to emergency notification systems — involve the campus network, IT leaders are by necessity gaining more expertise about security systems. University officials also are finding that improving communication between physical security staff and IT employees is critical.
Campus emergency managers must continually work on the relationship with technology staff, said Valerie Lucus-McEwen, who recently left her position as emergency and business continuity manager at the University of California, Davis (UC Davis) to teach emergency management courses at California State University, Long Beach. “Technology is becoming a bigger part of our lives on every level, and if you don’t work well with those people and communicate, you can’t move forward in a lot of areas,” she said. “For instance, you have to work with them on social media communications over Twitter and Facebook, and on IT security issues such as hacking.”
Lucus-McEwen said she gradually developed a stronger relationship with IT staffers as they helped her office with emergency notification systems and business continuity software development. Several years ago, an IT team custom-designed the notification system so that UC Davis’ internal campus directories fed the emergency notification system. “That was unusual at the time,” she noted. “Now everybody is doing it.”
Commercial business continuity software systems don’t lend themselves to a university setting, Lucus-McEwen said, so UC Davis IT staff customized an open source system called UC Ready, a continuity planning tool that was developed at UC Berkeley and has been picked up by the Kuali Foundation and shared with many universities.
“IT executives now sit on both the UC Davis Emergency Operations Center team, which involves a more technical level,” she said, “and on the Emergency Management Advisory Council, which deals with policy issues.”
Progress on Communication
IT officials on other campuses describe progress on collaboration between emergency
management, information security and campus safety officials. A few years ago, Arizona State University (ASU) began an initiative to better integrate policies and procedures around its Emergency Operations Center and incident management, said Tina Thorstenson, ASU’s chief information security officer.
Besides data security initiatives, the ASU IT strategic plan includes access control systems, business continuity planning and incident management. To meet the needs of emergency
management and campus security, there’s a dedicated person on the IT staff who works for the police department and gets training as if he worked within the police department itself. He oversees the access control systems’ infrastructure and stays up-to-date on security technology developments, said Thorstenson.
Although no one at ASU holds an emergency management title, a tightly knit group that includes police, public affairs and IT security is responsible for emergency preparedness and response. “We have a group that gets together every two months to work on emergency response initiatives and training,” said Thorstenson, who recently conducted a tabletop exercise around data center disaster recovery. “It’s important to get people in a room together regularly before an emergency happens.”
Thorstenson believes that if you build relationships with people, you can cut to the chase quickly. “Because of those relationships, I get responses to e-mails within hours from the key decision-makers on emergency response. That culture needs to be built up, and ASU is strong on that.”
A New Role for IT
Richard Siedzik, director of computer and telecommunications services at Bryant University in Smithfield, R.I., said his team has defined a new role for IT. “We’ve leveraged our IT infrastructure to converge our public safety systems,” he said. In 2006, Bryant deployed a Cisco IP Interoperability and Collaboration System to enable direct radio communications between Bryant’s public safety, campus management and residence-life departments. “We put video surveillance on the network, and our IT team is actually in charge of our access control system,” Siedzik said. “We write customized screens for our command and control center to allow them to monitor all these systems on one screen.” Using the system, Bryant also created a virtual public safety network to allow regional police and fire agencies to collaborate with one another and with campus police to improve incident management and overall response time.
“We feel that public safety is everyone’s responsibility and IT is an enabler. Looking forward, we want to do more with mobile technology and how we communicate with students if there is an incident on campus,” Siedzik said. “We want to give students the ability to text public safety people if they need to.”
Customized Continuity Software
Campus emergency managers say the in-house development of business continuity planning tools can be very beneficial. John Tommaney, director of emergency management at Boston College, said the tool created by the college’s IT staff lets departments create online “living documents” rather than pieces of paper kept in desk drawers. “I can manipulate and update it easily,” he said. “And I can aggregate information across departments. I can create lists of critical reporting functions by department if we need to relocate, and create a contact list and feed all that into our emergency notification system.”
IT leaders also were instrumental in choosing and supporting Boston College’s mass notification system. “They evaluated all the tools on the market, and my office and public affairs were the customers explaining the features we needed,” he said. Campus police now internally test the system weekly, and Tommaney’s office tests the system monthly with IT. Full tests with the whole campus are conducted twice per year.
Tommaney also works with IT leaders, especially Joe Harrington, director of network services, on disaster recovery strategy for IT.
“By looking at the academic and administrative department continuity plans, we can see which key applications to prioritize bringing up first,” Tommaney said.
Harrington said they’ve worked on simulating a disaster involving the data center and how to recover. “Now we know we can get 45 servers and 26 applications restored in two days,” he said
Harrington also sits on a cross-cutting emergency management executive team of advisers that helps with what-if scenarios. “If there ever were an event,” Tommaney said, “they are the ones who would be engaged.”
In addition, Harrington works closely with campus safety officials on product selection and implementation involving alarm monitors, access systems and security cameras. Those systems are not all integrated, but they all run over the IP network, so he must consider bandwidth and storage issues. “We are especially brought together on new capital projects, because new buildings and building improvements involve security considerations up front.”
In some cases, a university IT team is asked to unify disparate security solutions. After outsourcing security solutions for several years, executives at the Illinois Institute of Technology (IIT) in Chicago noticed a disconnect between that vendor and the campus IT team, recalled Nima Nemaei, manager of technology services for auxiliary services at IIT. “They would install things without it being clear what the impact on the network was,” he said. That company had chosen several stand-alone systems and then contracted out for service, repair and maintenance, which could take longer than the school wanted.
In 2007, the IIT administration asked an IT team to work closely with campus safety to do some “house cleaning” on these systems so the campus wouldn’t have to rely so much on contractors. “We redesigned the whole security setup,” Nemaei said. The team has integrated multiple systems, including Odyssey PCS campus card system, Odyssey HMS housing management software, CS Access access-control, NiceVision video monitoring and HID proximity card readers.
The integration allows staff to manage access control, alarm management and video surveillance from a single screen, making it easy to spot and acknowledge security incidents quickly, he added.
Nemaei has a team of four people in IT who are now also trained in the details of security technology. “This group is running the IT part of campus security,” he said. “We also report regularly to an emergency management team on new technology developments.”
For instance, the next step is partnering with Chicago’s 911 call center to give it access to the university’s campus cameras. “We want to have an umbrella of security in case of an incident,” Nemaei said. “They will be able to dispatch police, fire or EMTs without even having to be called.”
Crossing the Divide
Virginia Tech has entered into a public-private partnership with IT solutions and services provider L-3 Stratis and decision support solutions developer ERIS Technologies to develop an integrated security and incident management center of excellence at its campus in Blacksburg. The idea is to develop a platform that integrates applications for campus security, incident management and response, facility management, energy monitoring and cyber-security. “A dashboard will feed data to each responder based on their profile,” van Gelder said. “So they will get the data they need to see but are not overloaded with data.”
However, one of the first collaborative projects van Gelder worked on in her new job was much more basic: getting mobile data terminals for police cars. “That is not very sophisticated, but it is extremely important,” she said. Now the police department has created a technology subcommittee and has come up with 12 new ideas on its own. “So we have crossed that divide,” she said. “We have them thinking proactively. None of this would have stopped what happened, but we are working on improvements and we communicate proactively now.”
David Raths is a freelance writer and also a regular contributor to Government Technology magazine.
