Security at the World Bank.
Yet while the organization sees its mission as helping the citizens of the world, its high-profile activities and its location in the U.S. capital can make it a target of public protests, demonstrations, and possibly even international terrorism. In addition, the bank is vulnerable to the same problems as any other organization, including street crime, assaults, vandalism, and internal theft.
To guard against these risks, the World Bank has installed a $9 million integrated electronic security system that includes electronic access control and alarms, CCTV surveillance, and emergency intercoms. The system is controlled from a security operation center, where officers can view and tape camera images, monitor all access control transactions, and respond to alarms within seconds.
The World Bank is housed in a campus-style setting surrounded by several U.S. government facilities in downtown Washington. It occupies ten buildings - five of which it owns and another five that are fully or partially leased. In all, the bank has more than 7 million square feet of office and parking space. The site accommodates a work force of 12,000 employees plus 300,000 annual visitors, including heads of state.
The bank's main complex is a thirteen-story building that covers a full city block and includes five below-grade floors, mostly devoted to parking and supporting services. The bank's nine other office facilities are located within three blocks of the main complex.
Until 1994, the World Bank used a hodgepodge of electronic systems that had evolved piecemeal over the years. Except for parking garages and some sensitive areas in each building, there was no electronic access control. CCTV cameras were used, but each building had its own separate system - some were monitored by the bank's monitoring station and others were standalone systems. In addition, there were three different alarm systems used on the campus, requiring management to train the bank's security officers on each technology.
In the late 1980s, management decided to rehabilitate the organization's aging facilities and, as part of the project, upgrade the security system. The goal was to install a new access control system and standardize all security technology so that each component could be managed from one computer terminal. It was important for one software package to control all electronic security components, explains Gordon McIntosh, the security plans and policy officer at the World Bank. Not only would a single interface improve efficiency, but it would also simplify training. Officers would have to learn just one system as opposed to three or four. At the same time, management wanted to maintain an open atmosphere that allowed employees to move freely through the buildings without too many obstacles. (The first components were installed in 1994 and other parts of the system have been phased in over the last four years.)
The access control system now relies on a combination of optical turnstiles, card readers, ID badges, metal detectors, CCTV cameras, and intercoms. The operation is controlled via the central monitoring station.
Central monitoring. The electronic security system is controlled and monitored from the security operation center located in the bank's main complex. The 1,000-square-foot room is staffed by at least two officers at any given time and contains a three-wing console where officers work.
All electronic components are integrated with one security management software program, the C*CURE System 1 Plus from Sensormatic Electronics Corporation, which resides on a Digital Equipment Corporation MicroVax computer (located in a secure equipment room). The operation center console contains a PC, which is connected to the MicroVax computer. Officers can control all systems from this PC, which displays all access control transactions and alarms, including a description of any alarm condition and its location.
The station includes about twenty CCTV monitors, most of which are used to view sequenced images from around the campus. Several monitors are dedicated to real-time images after a camera responds to an alarm. There is also a playback monitor that can be used to view previously recorded images, for an investigation, for example.
A radio system keeps the operation center in constant contact with patrolling officers. Alarms, access control data, and CCTV images are sent over a dedicated, security fiber optics network. A separate computer is used to access the Internet, the bank's intranet system, and the Reuters News Service, to which the bank subscribes for news that may affect the organization.
Access to the monitoring station is controlled with the same proximity card system used throughout the campus. An intercom and CCTV camera watch the front door so that officers can see and talk to anyone who attempts to gain access. Electrical power is backed up with both the buildingwide generator and the central station's battery-powered uninterrupted power supply system.
Backup. As a backup, the World Bank maintains a second operation center in another building on campus. This alternative monitoring station contains a second MicroVax computer running the security management software. It also has several CCTV monitors and a backup intercom system.
During regular operations, all access control and alarm transactions are routed to this backup computer so that it always has the most up-to-date information. The backup computer "polls" the main computer every few seconds to ensure that it is operating. Within seconds of a computer failure, total system functionality automatically switches to the backup computer, assuring virtually no system interruption. The backup system is tested periodically.
The backup computer has come in handy several times, usually when the main computer experiences a system failure. On one recent occasion, security officers moved out of the main operations center and into the backup center after a small fire in the building caused the main station to fill up with smoke. No equipment was damaged, and security operations never stopped.
Satellite stations. In addition to the central station, each bank-owned building has its own monitoring capabilities, usually located in the main lobby area. These satellite stations are staffed by a security officer and receptionist, and they have a CCTV monitor and a PC with a split screen; one side displays access control transactions, and the other reports alarm locations.
These systems only allow the officer to monitor cameras and alarms in his or her individual building. Although the security operation center is responsible for running the system and responding to all incidents, the satellite stations were set up so that officers in each building would know what is happening in their buildings and could respond more quickly to incidents. (Typically, seventy-five of the bank's 240 unarmed officers are on duty in the five bank-owned buildings during the day.)
The satellite stations also provide other benefits. For example, if an employee's access card does not work, he or she can either report to the lobby or use the building's intercom system to communicate with the satellite station. The officer on duty can use the PC to check the employee's access status and assist that person.
Turnstiles. Optical turnstiles from Omega Optical Turnstiles of Walnut Creek, California, are located in all lobby entrances to bank-owned buildings. There are eight lobbies in all - one each in four of the buildings and four lobbies in the main complex. These turnstiles were chosen because they have an infrared beam rather than a physical barrier.
Employees must pass their card over a reader, then wait for the red light on the turnstile's panel to turn green before proceeding forward. A local alarm sounds, and an alarm signal is transmitted to the central station if someone whose ID badge has been rejected by the reader passes through the beam. The security officer stationed in the lobby responds to such alarms.
"Bank management went with the optical turnstiles partly for aesthetic reasons," Mcintosh says. "It was decided that the lobby entrances should have a clean and open atmosphere, and the optical turnstiles provided that more than turnstiles with arms or some type of physical barrier."
Card readers. There are more than 250 card readers located throughout the World Bank's Washington facilities. The readers control access into the bank's office suites in leased buildings as well as into sensitive areas in bank-owned buildings, such as executive suites, computer rooms, and the security operation center. Readers are also placed on some exterior doors of bank-owned buildings. Exterior doors that are not equipped with readers are locked at all times and are equipped with door contacts. If these doors are forced or propped open, an alarm signal is sent to the security operation center.
Each reader and turnstile is wired to one of the 100 apc (advanced processing controller) panels located throughout the ten buildings. Each panel can control up to eight doors. The panels are wired to the MicroVax through the bank's fiber optic network. The host computer downloads information into each panel's memory so that if the host fails, the system will still function to limit access to authorized personnel. The apCs also store information about each request for access to upload to the computer once it is functioning again.
Both the turnstiles and the card readers use proximity technology, which is embedded in the photo ID cards. Proximity technology was chosen because the parking garages had used a proximity card access control system in the past, making employees familiar with the system. While more expensive than magnetic stripe, proximity technology is also more convenient for users. In addition, because proximity cards are not swiped, they tend to be more durable.
Bank management wanted an access control system that could be used to restrict access to certain areas of the building, such as executive suites, the computer center, and the security operations center, and to set access times to specific areas for each cardholder. For example, access to the bank's human resource center is unrestricted to all employees between 9 a.m. and 4 p.m., Monday through Friday. However, only department employees can access the area during off hours so that they have time to catch up on their duties without interference.
The software also documents all access control transactions and records them on the MicroVax computer's hard drive. Each day, these transactions are copied to a magnetic disk and archived in the operations center for future reference, if needed. The archived information has been used for investigations conducted by the bank's office of professional ethics. At the time of this writing, in fact, the office was looking into the theft of several notebook computers, using the access control system to develop a list of suspects who entered rooms where the computers were last seen.
The access control system has the capability to produce time and attendance reports, but the bank has decided not to use that feature. "There was some initial concern among employees that the access control system would be used by management to track their comings and goings," McIntosh says. "Management made assurances that this was a better way to process people in and out of the buildings, control access within sensitive areas, and reduce security costs. But we will only use the information from our access control system for investigative purposes in criminal activities or at the direction of our office of professional ethics."
ID badges. Each employee wears an identification badge containing the employee's photograph, name, signature, and the World Bank's logo. The cards are made at the badging office, which is located in the bank's main complex. About 10,000 identification cards are produced each year with the badging office's three video badging stations.
Badges are also issued to contract workers, including food service personnel, janitors, overseas consultants, and experts who are hired for various international projects. These passes typically limit where and when a cardholder may access bank offices. They are programmed to expire after a certain period, depending on how long the contract worker is assigned to work at the World Bank. Contractors are asked to return their badges after their access privileges expire.
Contract employees are escorted to the badging station by security on their first day. To verify that the temporary employee should receive a badge, security checks a daily report of new workers from the human resource department. The same report includes the names of employees who are no longer on staff so that access privileges can be terminated.
Daily visitors are issued temporary paper passes that are not embedded with access control technology. Before a pass is issued to a visitor, however, the receptionist or security officer stationed at each lobby checks a computer log to ensure that the visitor is scheduled to be in the building that day. If the person is not on the list, the receptionist calls the employee who is expecting the visitor and verifies that the guest should be granted access.
Metal detectors. Visitors are required to pass through Garrett CS5000 metal detectors, from Garrett Metal Detectors Inc. of Garland, Texas, at each entrance. At times of heightened security, such as public demonstrations outside the bank headquarters or when international tensions rise, all persons, including employees, may be screened. (This is only done at bank-owned buildings.) The bank also has x-ray equipment, from AS&E of Billerica, Massachusetts, which can be used to inspect all bags and parcels entering the buildings. McIntosh says the x-ray equipment is typically used on a random basis, except during periods of heightened security, when it is used continuously.
CCTV. An extensive CCTV system protects the five bank-owned buildings. No cameras are used in the bank's leased space, although some of the buildings where these offices are located have their own separate CCTV systems. The World Bank did not install surveillance in leased offices for cost reasons. In addition, the bank views leased space as temporary and plans to move all of its operations into its own buildings by the year 2000.
The surveillance system consists of more than 350 black-and-white and color cameras, including both fixed-mount and pan-tilt-zoom cameras. Multiplexers and matrix switchers located at the central station control the cameras and recording.
McIntosh says that management felt it was important to carefully monitor the bank's immediate exterior areas, so cameras are mounted to cover virtually the entire perimeter of bank-owned buildings, including all doors. Internally, cameras have been positioned in each lobby, in executive suites, and in the parking garages. They also oversee a computer storage room where employees can store their laptop computers, and cash handling areas, including five on-site cafeterias and a bank-operated bookstore and information center.
Cameras are wired to a panel on each floor with a coaxial cable. The panels then transmit images from the cameras to the security operations center via a fiber optic network, which is connected to the MicroVax computer. With this setup, security can use the security management software to control and program the cameras - for example, defining alarm conditions that would trigger real-time recording.
During normal conditions, images are sequenced through the twenty monitors at the central station and images are not recorded. However, when someone forces open a door, attempts to enter a sensitive area with an unauthorized ID card, or activates one of the emergency intercoms, the security management software interprets this as an alarm condition. A camera will automatically pan to the area and begin transmitting images in real-time to a dedicated monitor. In addition, the system activates the VCR and begins recording the images. All recordings are archived and saved for four months.
Cameras can also be manually set to operate in real-time and record images during other incidents, such as public protests in front of the World Bank. "Every once in a while, we get a group that gets a permit and comes here and shouts things and waves signs," Mcintosh says. "We will record an event like that." The recordings are used for investigative purposes should there be violence or other suspicious incidents committed during the protest.
Intercoms. The World Bank has installed about 1,000 intercoms throughout its facilities. The intercoms are located in elevators, parking garages, two underground tunnels used to connect various facilities, and other remote sites. The intercoms are wired via telephone lines to the front lobby of each building as well as to the central station.
Intercoms are integrated with the security management software so that when someone activates the intercom, the nearest camera pans to the area and begins transmitting real-time images, allowing the officer at the lobby guard station to both see and talk to the person. The officer must acknowledge the "alarm" within several seconds or the audio and camera images roll over to the security operation center.
Three voice recording units located at the central station are used to record intercom conversations. The tapes are archived and stored and can be used in an investigation or as evidence.
In addition, duress buttons are located within each cash-handling area, top executive suites, the ethics office, and offices of other managers whose duties may lead to confrontations with other employees. All duress alarms are monitored in the security operation center.
Other entities. The World Bank's main complex is also home to several outside businesses that require security. In most cases, these businesses have their own electronic security systems, but they have been tied into the central station when possible so that bank security is aware of all events occurring in its facilities.
The World Bank faces many of the same security challenges encountered by any large organization in a major metropolitan area. In addition, its activities worldwide and its location in the nation's capital make it a potential terrorist target. The new access controls give the security team a system they can bank on as a starting point in the never-ending task of monitoring day-to-day activities and assessing ongoing risks.
Steve Hall is vice president of North America commercial/industrial operations for Sensormatic Electronics Corporation, Boca Raton, Florida. The bank's new system was designed and installed with the help of consultants from Security Technologies Group, Inc.