How SU Got The Word Out
- By Steven Titch
- Apr 01, 2009
College campuses are spearheading a widespread shift to the use of mass notification systems for emergency response. As a result, both security and IT professionals are learning more about how mass notification systems can best be applied in emergency situations, and how public communications infrastructure, especially wireless networks, needs to be reengineered to handle a surge in outbound traffic.
Integrated mass notification systems, which use e-mail, landline and wireless phone and text messaging to alert large groups and issue instructions in an emergency, have been traditionally low-scale. Although some applications involved employee safety, such as when oil platforms needed to be evacuated because of an oncoming storm, systems were employed mostly in non-emergency situations and messaging wasn’t extremely time-sensitive.
Most corporate mass notification systems were designed to reach only hundreds of people and did little to strain local public communications systems.
The shootings at Virginia Tech changed all that, said Maz Ghorban, vice president of support services for Mir3 Inc., San Diego, one of the leading international suppliers of mass notification systems. Suddenly, colleges and universities began seeking mass notification systems specifically designed for emergency response. Systems needed to be multimodal, i.e., capable of issuing advisories via e-mail, voice and text, and be reliable, reaching tens of thousands of individuals in a small area within minutes.
Shots Fired
Mir3’s inEnterprise mass notification system was successful in notifying 27,600 Syracuse University students, faculty and staff members within five minutes to seek shelter after a drive-by shooting occurred near the campus. After 45 minutes, the system sent a second notification, alerting recipients there was no longer a threat.
For Ghorban, the incident confirmed the effectiveness of large-scale mass notification. For public safety and information technology officials at Syracuse University, it was validation of a major security initiative that pre-dated the April 2007 Virginia Tech shooting.
“The university was working on this a year and a half before Virginia Tech,” said Tony Callisto, chief of SU’s Department of Public Safety. With campus safety a growing concern in general, DPS worked closely with the university’s Department of Information Technology and Services in preliminary testing of several mass notification systems. “Once Virginia Tech happened it was obvious to us we needed to move these projects forward,” he said. A September 2007 incident, in which a masked gunman was thwarted at St. John’s University in Queens, N.Y., further accelerated the school’s efforts..
The Syracuse emergency was touched off by a drive-by shooting at about 11:30 on Nov., 2008, near an intersection five blocks north of the main campus and within three blocks of a number of campus buildings, offices and residences. After being alerted by the Syracuse Police Department, SU DPS put the mass notification system, dubbed Orange Alert for the school’s color, into action. Once police apprehended the suspects, school officials sent an all-clear message.
The system succeeded in reaching more than 27,600 individuals. Although the Daily Orange, SU’s student newspaper, reported a small number of people did not receive notice, most of them were in close proximity to those who did.
Collaboration With It
The success of the system is a direct result of the collaboration between SU’s DPS and ITS departments. In the past, when dealing with an emergency, said Rod Kurdziel, director of telecommunications for SU ITS, “the campus security professional’s first thought was not to pick up the phone and call the people who manage the IT infrastructure.” Today, he said, it is now part of the emergency response process. “An IT professional is expected to be in the command center when an incident happens,” Kurdziel said.
The reason the mass notification system is so effective is because it uses the PeopleSoft database maintained by ITS, Kurdziel explained. The PeopleSoft database, by default, contains student, faculty and employee phone and e-mail addresses. Further, individuals at any time can update their contact information and are encouraged to do so. Incoming students and their parents are introduced to the Orange Alert system at freshman orientation, Callisto said.
Kurdziel’s department made provisions for the addition of cell phone numbers because text messaging has become so important to the process. Meanwhile, the Mir3 inEnterprise system automatically updates itself daily from the PeopleSoft database.
There is no more than a 24-hour lag in any update. Mir3 manages the messaging servers out of a principal data center in Denver, although this facility is supported by data centers in San Diego, Washington, D.C., and Chicago. This ensures that when 27,000 calls and messages go out, bandwidth loads can be balanced, Ghorban said.
That Mir3’s operations are far off-site was a selling point, said Kurdziel. “We did not want a premises-based system in the event a disaster took out all our facilities.”
Lessons Learned
Working with a system this large also had its lessons. First, the value of wireless text messaging in emergency situations continues to be more appreciated. The Mir3 system, as with other mass notification systems, can only send out 500 voice calls per minute. That adds up to an hour to run through a roster of 30,000 phones. Text messages can be delivered much faster, and wireless systems will continue to transmit them until they are received by the device.
The only problem is that, as a general rule, wireless systems are designed to throttle down throughput when there is a sudden spike in message traffic as a defense against a denial of service attack. Kurdziel and Callisto worked with the major cellphone companies to ensure they knew about the mass notification system and reengineered their area base stations to accommodate an uptick in texting.
Ultimately, Kurdziel would like to see the notification system expanded into other areas, including public address systems and digital signage. That way, even if messages fail to get through on personal devices, there can still be alternate ways to reach the population.
“Text messaging, e-mail and phones are not enough,” he said. “You need to consider other things. You need to have as many areas as you can to get the message out.”
This article originally appeared in the April 2009 issue of Network-Centric Security.
About the Author
Steven Titch is editor of Network-Centric Security magazine.