The purpose of this article is to present some basic concepts of how to build situational and security awareness with employees to reduce the risk of security incidents and criminal activity. This is done by illustrating a simple three-step process:

1. Present a system of awareness levels, developed to illustrate the different levels at which people may be engaged in what is going on around them. Employees need to understand this system of awareness levels to develop a sense of self-awareness.
2. Next, employees are trained to establish baselines in their environments.
3. Lastly, employees are trained to detect irregularities and anomalies in the environment and take “real time” action, such as removing oneself from a situation or making a report about something suspicious.

Beyond the Catchphrase: What “See Something, Say Something” Requires

In essence, the three steps above help to bring to life the common phrase “See Something, Say Something.” It is a catch phrase used by the US Department of Homeland Security since the 9/11 attacks. From the “See Something” perspective, employees must be taught: what exactly am I looking for? How do I know if I’m paying attention to the right things? “See Something, Say Something” was generally initiated to help identify terrorists in the preplanning stages of an attack, but when you break it down, it can effectively be applied to a variety of day-to-day situations to help reduce criminal attacks, workplace violence or active shooter events.

Employees who can demonstrate situational awareness using the concepts above will also be more likely to:

• Avoid complacency.
• Observe with all senses.
• Be aware of unusual changes in surroundings.
• Notice unusual or suspicious behavior.
• Know whom to call if something is not right.
• Get assistance and not try to “handle it” themselves.
• Prevent serious security incidents.

Step One: Teaching Self-Awareness

What does “taking it to the next level” mean? Let us turn our attention to the concept of situational awareness and hear what some of the experts have to say. This military and policing concept can be applied in the private sector to your employees. For the average employee, there are a few key points to emphasize that will gain incremental improvements in security awareness, while recognizing that people typically operate on five distinct levels of awareness.

Cooper’s Color Code of Awareness

The late Jeff Cooper’s “Color Code” has been embraced and taught by competent instructors for many years. Some of you may be familiar with the concepts, but a review of these awareness levels is worthwhile in the context of situational awareness. Cooper broke down alertness levels into five degrees of preparation and awareness, shown below.

Level	Description
White	Unprepared and unready to take action.
Yellow	Prepared, alert and relaxed. Good situational awareness.
Orange	Alert to probable danger. Ready to take action.
Red	Action mode. Focused on the emergency at hand.
Black	Panic. Breakdown of physical and mental performance.

Unfortunately, far too many people operate in the white dimension, “unprepared and unready to take action.” What are some of the common behaviors we exhibit that undermine our ability to observe what is happening around us?

Habits That Undermine Awareness

• Smart phones. If we are completely preoccupied with what is happening on our phones, we are not paying attention to what is happening around us. This is far too common.
• Headphones. Listening to music in headphones while walking in public places.
• Not following your gut instinct. So many people ignore the clues that are right in front of them, maybe because they want to believe in the greater good of mankind. Of course, just like there are weather conditions that predict a pending hurricane, there are often clues which tell you a violent incident is about to occur. This is also referred to as “normalcy bias,” the act of ignoring prospective threats because it seems unlikely that a dangerous situation might occur.

Therefore, the first objective in any security and situational awareness training program is to teach people the difference between the white and yellow dimensions, then to encourage them to develop a sense of self-awareness to stay out of that dangerous “unprepared and unready to take action” mode.

Simple Drills to Build Alertness

To help employees develop basic alertness skills, they can be challenged to practice a few drills that are often referenced in the situational awareness discussion, which include:

• Identify all the exits when you enter a space.
• Count the number of people in a restaurant, subway or train car.
• Look at the people around you and attempt to figure out their stories. Imagine what they do for a living, their mood, what they are focused on, and what they are preparing to do, based merely on observations.
• In a parking lot, look for and count the number of cars with people sitting in them, either upon entering or exiting a destination.

Educating employees to actively engage their environment will train them to be aware of factors in their surroundings almost subconsciously, once they learn to regularly operate in the “yellow” state of awareness.

Once that self-awareness is established and people are actively engaged with their surroundings, you can focus on teaching more advanced situational awareness skills that apply to a wide array of work environments (e.g., healthcare, corporate, K-12, critical infrastructure).

Step Two: Teaching Observation and Baselines

To borrow from another military training concept and apply it in civilian life, the OODA Loop is a learning system and decision-making process developed by John Boyd, an Air Force fighter pilot and military strategist. Its four steps are Observe, Orient, Decide, and Act. For this article, we are only going to focus on the first two: observing, and then orienting, which in plain terms means analyzing what you observe against a baseline of what is normal.

Observation, which requires conscious thought and practice, is a very deliberate action that employees need to be taught and reminded about. This secondary skill should convey the importance of developing mental “baselines” for people and environments. Having a baseline is an essential foundation for detecting anomalies, which are important to trigger action or reporting of suspicious activity. The “environmental baseline” is what employees have experienced in similar environments and situations. They should be trained to determine what counts as normal sounds, behaviors and sights, so they have a frame of reference to better identify unusual behavior or anomalies.

Building an Environmental Baseline

By establishing an understanding of the baseline through observation of daily routines, employees will quickly notice when something deviates from the pattern. Everybody has some understanding of the baseline around them, which will differ by environment and situation. Those skills can always be refined.

Questions to Define a Baseline

Another way to identify a baseline is to teach employees to ask themselves some basic questions¹:

• What’s going on here?
• What’s the general mood of the place?
• What are the legitimate actions 99% of people in the environment would be engaged in?
• What are the typical belongings we would expect to see people in the environment carrying?
• What is the typical behavior we would expect people in the space to exhibit?
• What is the identity we would expect to be associated with a legitimate user?
• What is the “story,” or the knowledge, that a legitimate person would be expected to have in the environment?
• What are the documents a legitimate user would possess?
• What is the appropriate attire that would be expected for the environment?

It would be a good exercise in a training session to have employees ask these questions and collectively contribute to the baseline in their assigned work environment. This will help them get a better grasp of the concept and prepare them for the next key skill: recognizing and responding to anomalies.

Step Three: Recognizing and Responding to Anomalies

Obviously, the “observe” step is what most people associate with the concept of situational awareness, but the reality is we also need the second step, “orient,” to truly achieve it. Orienting means analyzing what we observe. Analyzing what we observe puts those observations into context against a baseline of what is normal, so employees can recognize deviations and anomalies and make a game plan, such as reporting suspicious activity or removing oneself from a situation to create the time and distance necessary for a safe outcome.

Anomalies are things that either do not happen that should, or that happen and should not. Employees must be trained to recognize and respond to anomalies.

Then, to help analyze anomalies: “What would cause someone or something to stand out?” For example, most people are going to look relatively comfortable in most situations. Think about a bus or a subway ride: passengers generally appear relaxed while they stare out the window or read a book. If someone looks uncomfortable, that is an anomaly that warrants extra attention. It does not mean that the person is necessarily a threat, just something employees should be trained to monitor.

Patrick Van Horne, author and founder of The CP Journal, a behavioral analysis training company, says that a common display of uncomfortable behavior by individuals up to no good is when a person looks over their shoulder to see what’s behind them, or checks their surroundings constantly. This is also referred to as scanning, when a person is continually looking around in all directions. People who are comfortable generally do not “scan,” because they don’t feel any threat. So if you see someone looking over their shoulder a lot when they should just be standing there, that’s an anomaly that warrants additional attention, and potentially an upgrade from yellow (prepared and alert, with good situational awareness) to orange (alert to probable danger, ready to take action or make a report of suspicious activity).

On the flipside, someone acting comfortable when everyone else is uncomfortable would be an anomaly. One of the ways law enforcement was able to identify the Boston Marathon bombers was that they noticed in surveillance footage that the men looked relatively calm while everyone else was running around in a panic. The reason they looked calm was because they knew the explosion was going to happen and were not surprised by it, while everyone else was caught off guard.

Negative Anomalies (Something Missing)

Here are some negative anomalies (something missing) which should lead to action:

• A person not accompanied by someone you recognize in the workplace.
• A person not wearing appropriate identification in the workplace.
• A person with an appearance that is inconsistent with the workplace dress code.
• A person who seems lost or is asking for directions to specific areas.

Positive Anomalies (Something Extra)

Here are some positive anomalies (something extra) that can be included in employee training:

• Person loitering too long (particularly around employee entrances or parking lots).
• Person moving too quickly or running through an area where this is not normal behavior.
• A person repeatedly looking over his or her shoulder.
• A person leaving a bag, suitcase, or other object behind, or a suspicious object left unattended.
• Inappropriate clothing for the weather or setting (e.g., a heavy winter coat in the summer).
• Fumes, odors or liquids associated with a package or letter.
• Unattended vehicles in an area where vehicles are not supposed to be parked.
• Sensitive information left in an unauthorized area.

When anomalies are observed, employees must be trained to spring into action, either by removing themselves from a potentially dangerous situation or by filing an immediate report about something suspicious and out of the ordinary, so that the appropriate security or police agencies can intervene.

Summary

This article presented three steps to build situational and security awareness with employees to reduce the risk of security incidents and criminal activity. The steps are:

1. Teaching employees to develop a sense of self-awareness.
2. Establishing and training employees on people and facility “baselines” in any given environment.
3. Training employees to detect anomalies in the environment and take “real time” action, such as removing oneself from a situation or making a timely report about something suspicious.

In essence, without these extra steps, “See Something, Say Something” will be nothing more than a catchy phrase that underperforms.

---

¹ Some of this information was presented by Michael Rozen at ASIS International in 2019 in an excellent session.