Within hours of the shooting tragedy on the Virginia Tech campus in 2007, Brenda van Gelder was already thinking about how her IT organization could help improve campus security.
“It was glaringly obvious to me that the IT community and police on campus operated in two separate worlds and almost never interacted until after an event,” said van Gelder, who works in
Virginia Tech’s Office of the Vice President for Information Technology. “We did not work together in a proactive way at all. This is not to point fingers at anyone. In talking to colleagues at other campuses, I found it true elsewhere as well. There is a cultural divide between IT people, police and emergency responders. We all noticed it in the wake of the shooting and decided to address it going forward.”
In 2009, van Gelder became executive director of the newly created Office of Converged Technologies for Security, Safety and Resilience, which advocates for campus safety needs to the IT organization. The office also coordinates strategic initiatives that involve the intersection of IT security, physical security, campus safety and regional resilience.
Although IT offices dedicated to campus security are rare, teams made up of IT staff, campus safety and emergency management officials are becoming more commonplace. As more campus security solutions — from video surveillance to access-control systems to emergency notification systems — involve the campus network, IT leaders are by necessity gaining more expertise about security systems. University officials also are finding that improving communication between physical security staff and IT employees is critical.
Campus emergency managers must continually work on the relationship with technology staff, said Valerie Lucus-McEwen, who recently left her position as emergency and business continuity manager at the University of California, Davis (UC Davis) to teach emergency management courses at California State University, Long Beach. “Technology is becoming a bigger part of our lives on every level, and if you don’t work well with those people and communicate, you can’t move forward in a lot of areas,” she said. “For instance, you have to work with them on social media communications over Twitter and Facebook, and on IT security issues such as hacking.”
Lucus-McEwen said she gradually developed a stronger relationship with IT staffers as they helped her office with emergency notification systems and business continuity software development. Several years ago, an IT team custom-designed the notification system so that UC Davis’ internal campus directories fed the emergency notification system. “That was unusual at the time,” she noted. “Now everybody is doing it.”
Commercial business continuity software systems don’t lend themselves to a university setting, Lucus-McEwen said, so UC Davis IT staff customized an open source system called UC Ready, a continuity planning tool that was developed at UC Berkeley and has been picked up by the Kuali Foundation and shared with many universities.
“IT executives now sit on both the UC Davis Emergency Operations Center team, which involves a more technical level,” she said, “and on the Emergency Management Advisory Council, which deals with policy issues.”
Progress on Communication
IT officials on other campuses describe progress on collaboration between emergency
management, information security and campus safety officials. A few years ago, Arizona State University (ASU) began an initiative to better integrate policies and procedures around its Emergency Operations Center and incident management, said Tina Thorstenson, ASU’s chief information security officer.
Besides data security initiatives, the ASU IT strategic plan includes access control systems, business continuity planning and incident management. To meet the needs of emergency
management and campus security, there’s a dedicated person on the IT staff who works for the police department and gets training as if he worked within the police department itself. He oversees the access control systems’ infrastructure and stays up-to-date on security technology developments, said Thorstenson.
Although no one at ASU holds an emergency management title, a tightly knit group that includes police, public affairs and IT security is responsible for emergency preparedness and response. “We have a group that gets together every two months to work on emergency response initiatives and training,” said Thorstenson, who recently conducted a tabletop exercise around data center disaster recovery. “It’s important to get people in a room together regularly before an emergency happens.”
Thorstenson believes that if you build relationships with people, you can cut to the chase quickly. “Because of those relationships, I get responses to e-mails within hours from the key decision-makers on emergency response. That culture needs to be built up, and ASU is strong on that.”
A New Role for IT
Richard Siedzik, director of computer and telecommunications services at Bryant University in Smithfield, R.I., said his team has defined a new role for IT. “We’ve leveraged our IT infrastructure to converge our public safety systems,” he said. In 2006, Bryant deployed a Cisco IP Interoperability and Collaboration System to enable direct radio communications between Bryant’s public safety, campus management and residence-life departments. “We put video surveillance on the network, and our IT team is actually in charge of our access control system,” Siedzik said. “We write customized screens for our command and control center to allow them to monitor all these systems on one screen.” Using the system, Bryant also created a virtual public safety network to allow regional police and fire agencies to collaborate with one another and with campus police to improve incident management and overall response time.
“We feel that public safety is everyone’s responsibility and IT is an enabler. Looking forward, we want to do more with mobile technology and how we communicate with students if there is an incident on campus,” Siedzik said. “We want to give students the ability to text public safety people if they need to.”
Customized Continuity Software
Campus emergency managers say the in-house development of business continuity planning tools can be very beneficial. John Tommaney, director of emergency management at Boston College, said the tool created by the college’s IT staff lets departments create online “living documents” rather than pieces of paper kept in desk drawers. “I can manipulate and update it easily,” he said. “And I can aggregate information across departments. I can create lists of critical reporting functions by department if we need to relocate, and create a contact list and feed all that into our emergency notification system.”