A Site Survey characterizes a defined location (for instance a home, neighborhood, or business), looking closely at factors that are generally under your direct control. Boundaries, barriers, access and egress, routine activities and profiles, everything that constitutes a potential vulnerability or an element of security, is inventoried and assessed.
The Site Survey is a foundational element in Security Analysis. It describes your home, neighborhood, business, church or school as a potential target for the various threats that you will define in your Threat Assessment. It will identify present gaps or weaknesses in your security, and allow you to test future security upgrades, plans, and procedures against those threats, through Vulnerability Analysis.
The methodology outlined here is an exercise in deductive thinking. You can certainly modify it, or adopt another method, as you see fit. The purpose is what's important, and the purpose is to keep you honest by encouraging a critical, objective thought process. There are two traps to avoid: inductive reasoning and normalcy bias. Both are very common and dangerous patterns of thought.
Inductive reasoning is based on predetermined conclusions; you tend to seek evidence or develop arguments to support those conclusions, ignoring or minimizing evidence which may point elsewhere. You may, for instance, have been content in the past with the security of your doors and windows because you live in a low crime area with little history of break-ins and burglary. If conditions have changed, and burglaries and break-ins have increased in your area, you might be well-advised to reassess the physical security of your home and consider upgrades despite their inconvenience or expense. Doing so would be an example of deductive, not inductive reasoning.
Normalcy bias is a related but more passive state of mind that causes people to discount both the possibility of a thing occurring, and its possible consequences, because it has never occurred before and therefore lies outside the bounds of the normal, expected, and recognizable. People with a normalcy bias have difficulty both before and during a crisis reacting to something they have not experienced before, and tend to interpret warnings or indicators in the most optimistic way possible. The refusal to anticipate trouble or recognize it for what it is ("This can't be happening!"), could prove decisive.
State Your Mission or Purpose
The foundation of a site survey is a statement that describes your purpose and priorities; your "mission." In the broadest sense, the mission is protecting life, property, and freedom of action in the face of real or potential threats. A site survey helps you to appreciate what things you can confidently protect, what actions you can take to better protect them, and when and how you might be obliged to sacrifice some interests in order to secure those that are more important.
Define the Conditions
The next step is to establish Conditions, to narrow the scope of the survey and make it more manageable. An Area Study, if you have already undertaken one, calls for a similar scoping and may help you in this; you will only have to drill down for more detail and specificity for your particular site. Note external factors that you cannot control, such as weather, road conditions, power supply, communications and connectivity; and consider the effects of these under "normal" conditions as well as off-normal. What defines off-normal will be further defined and developed in your Threat Assessment, so you may circle back to this later. You will also consider time factors: your site's characterization may differ substantially between daylight and dark, work days and weekends, working and non-working hours. For instance, depending on all these factors, a manufacturing, service, or retail facility might be occupied or vacant, day shift or night shift, operating or shut down. A house of worship will look very different during weekly services than with minimal staff during the week, or during classes, meetings, and community outreach events in the evening.
There are so many variables that you will probably have to engage in some careful qualitative screening to pick the most significantly different cases for full development. If you're careful about it, you can select a set of "worst case" conditions and focus your improvements and upgrades on those, knowing that they will improve your posture under less severe conditions as well.
Establish a Collection Plan
This is a methodical approach to collecting the information cataloged below. Assumptions are of less value than verified, objective assessments. A collection plan guides you and your team members to fill gaps in your knowledge, and to test and validate your assumptions. It might include:
- A site tour with all or part of your site survey team, recruiting other knowledgeable personnel as needed for guides.
- Architectural diagrams, site plans, and imagery obtained from private, governmental, and online sources.
- Interviews of key personnel (who may include those with the longest association with the site, business, activity, or community).
- Review of any previous site or security surveys.
- Review of any prior security incidents or near misses.
- Documentation of major assumptions, distinguishing them from confirmed fact; the collection plan should seek to confirm or discard assumptions, replacing them with fact.
Characterize the Site
With Missions and Conditions at least tentatively defined, and Collection Plan in place, you can begin to develop the information that will characterize your site. Your goal is to describe the site "as is," including upgrades in progress only if they are certain to be implemented in in the near term. Assess your situation as it really is, not as you would like it to be; this assessment should include, but does not need to be limited to the following:
- Type: Is it a family residence, a building, a neighborhood, a business, a house of worship, or a school, or another type of property or operation?
- Size: Establish an outer boundary for your site, that separates it from what your Area Study will describe as your Area of Operations (AO). In many cases this is as simple as a property line, because your responsibilities, rights, and freedom of action are quite different on private property than in public or common areas.
- Complexity: For instance, is a church, school, or business a single structure, or a multiple-building campus? Is your site one or more floors in a multi-story building? Are access and egress dependent on routes that cross public use areas or other private property?
- Identify Areas within the site, such as distinct physical regions, subdivisions, or compartments within the site. These might include parking lots, landscaped or natural open areas between buildings, or areas that are difficult to observe or control.
- Describe Specific Targets: This anticipates the threat assessment process to some degree, but is an integral part of your site survey. These targets might include especially valuable or attractive physical assets, inventory or supplies; or people, such as children in a school, or high-profile individuals like office-holders or managers with personnel security needs. Targets can be thought of as subsets or microcosms of the larger site. Target parameters include:
- Type: physical assets, people, data, etc.
- Location: static (for instance a room or fixed piece of equipment), or mobile, such as people who move about within the boundaries of the site.
- Target Consequence Value: a qualitative measure of the impact that loss or compromise would have on you, or the site.
- Target Attractiveness: a qualitative evaluation of how valuable the target would be to an adversary, under the conditions you have previously defined. This will vary depending upon the threat, but there will be some common factors. For instance, privately owned vehicles and their contents in an unsecured parking area can be very attractive because of the opportunity they present for break-in, theft, vandalism, or assault of persons. Other, more valuable targets may be less attractive because they are harder to access, or harder for a thief to transport or dispose of. Harder targets include physical assets that are less attractive because they are large, heavy, resistant to damage, or secured behind a series of locks or barriers; or people who are themselves armed and capable of self-defense, or are protected by others.
- Threat Objectives: these of course will vary with the definition of potential threats, but they should be addressed here as well. For example, the children of politicians or celebrities might constitute a target, but kidnapping may be a far more likely threat objective than homicide. If the target is a business's computers, threat objectives might include theft of physical components, data theft, or sabotage. Company executives might be targets for murder, kidnapping, robbery, or intimidation. A politically or ideologically motivated threat might have the objective or damaging or destroying structures or property, or harming persons, for essentially terroristic reasons. Measures effective against some threat objectives can be useless or irrelevant against others.
- Identify Pathways: These are physical avenues, routes, or portals that connect specific locations or areas to others within the site; for instance, roads, trails, gates, doors, windows, roofs, tunnels, stairways, elevators.
- Identify Protection Layers: These are elements that an adversary must bypass or overcome. There are two basic categories, physical and human.
- Physical protection layers: Barriers and obstacles include gates, doors, emergency exits, fences, surfaces (walls, roofs, floors, and windows), and access control systems (keyed or electronic locks, CCTV). These may deny access but more often they will only delay a determined, resourceful adversary. An informed estimate of how much delay they provide can be very important, as it provides time for detection and response – Observation and Orientation, in the Boyd model. Delay before detection is of limited value, but an adversary's efforts to defeat delay elements (such as cutting fences, breaching doors, or breaking windows) may increase your chance of detecting him. If an adversary anticipates an effective response (citizen, private security or law enforcement), then sufficient delay will deter him, forcing him to choose another target or a different strategy.
- Human protection layers may include any of these:
- Observation by occupants, considering their level of training, alertness, observational skills, means of communication, and the risk of complacency and normalcy bias.
- Response forces, such as private security, law enforcement, or private citizens, considering the capabilities and response time of each.
- Communication and notification systems.
- Locations (and the associated planning and rehearsals) for protecting personnel by lockdown or shelter-in-place.
- Escape/evacuation routes and areas: where do people go, who decides and on what criteria, how do they get there, and how is accountability established?
- Guard posts or fighting positions that provide cover, fields of view/fields of fire, mutual support and communication for defenders.
- Rally points: locations where defenders can link up if plans, command, control, or communications fail, or if locales or positions are lost or cannot be reached.
Organization and Presentation of the Site Survey
Organize all this information using one or more schematic diagrams, supplemented by narrative descriptions and evaluations, photographs and elevations. These graphical products will be useful for planning and operations, far beyond their initial use in the Site Survey. Graphics should clearly illustrate features and characteristics, as well as the interface between the site and its surrounding area – for instance, showing routes of access and egress, and the nature and efficacy of any fencing or other perimeter features around the boundary of the site.
In Summary
A Site Survey, depending on the site's size and characteristics, may be short and simple, or large and complex. Without it, and the related and broader-scope Area Study, you really cannot assess threats or devise security upgrades and solutions in any useful way. As Sun Tzu said thousands of years ago in his Art of War,
"Know the enemy and know yourself; in a hundred battles you will never be in peril.
"When you are ignorant of the enemy but know yourself, your chances of winning or losing are equal.
"If ignorant both of your enemy and of yourself, you are certain in every battle to be in peril."