 It's almost Halloween, but welcome to this episode of Security Matters Hawaii. We're back in the Think Tech Hawaii studios. I've been on the road a little bit. Sorry I missed you guys, but I've got a great guest for you today and a great episode. Jerry Wilkins is with us today. He is the principal of Active Risk Survival. What he's going to share with you I think is relevant to the entire industry. 99% of you do not know what we're going to talk about today. I assure you that. Jerry Aloha, thanks for taking some time to join us today on this busy Halloween week. How are you doing, sir? I'm doing great. Thanks for having me. Great. I really appreciate it. Just so our audience can get to know you a little bit for those who don't know you, why don't you share a little bit of your history background as much as you care to share and then we'll get on to the episode. Well my background includes 35 plus years in this industry, including some law enforcement background. About seven years ago, I decided to join a volunteer organization. I've been very active in volunteer service when I was younger, but I had kids and my primary goal when I had kids was to be a good dad, but I chose the Coast Guard Auxiliary as an organization I wanted to join. There were some things I wanted to be able to do in the Auxiliary. One was doing search and rescue and what they refer to as mom's patrols, marine observation missions, which required that I take some training. The first training I had to take was IS-100, which is offered by FEMA for free. It's three hours, but it was incident command. When I took the training, I actually took it because I wanted to get the certificate so I could move on and start doing some of the fun stuff, but I literally woke up in the middle of the next night and realized that I didn't know anything about what I'd just learned. So I went back and retook it. I couldn't test it because I'd already tested out, but I recognized that there's this amazing critical incident response protocol out there that our industry has completely overlooked. Well I'm the kind of guy that, you know, I can't do a little bit of anything, so I took 200 and 300 and 400 and 700 and 800, basically have a two-page document of all the different trainings that I've taken. As I started looking at that, I looked at one of the biggest threats that we see in today's world and that's active shooter. Even though they're extremely low probability for most people, the consequences are so significant that we have to think about active shooter. What if? What would we do if? So I decided to take some active shooter training and on December 2, 2015, and we'll get back to that date in just a second, I was standing in the BWI airport getting ready to board an airplane and fly to Oklahoma City to take Alice instructor training and the reason why December 2, 2015 is an important date is that is the date of San Bernardino. So I was standing in the airport watching an event. I think it still holds a record for most rounds fired active shooter event while I'm preparing to go take training to keep people alive during these events. When I got to the Alice training and Alice started explaining the acronym, alert, lockdown, inform, counter evacuate, mass notification immediately jumped in my head when they said alert. When they said lockdown, I don't know any access control panel that doesn't have the ability to lock down. And then the one that was most critical when we come back to the eye inform and you recognize that we have all of this critical information available to us through our access control, through our video surveillance, I literally stood up in the middle of the class and the instructor looked at me and said, are you okay? Yeah, I'm just I'm processing. You've got to let me sit back down and kind of rethink this. But I started to recognize that in the Alice program, which is excellent when they talk about alert, lockdown, inform, they don't necessarily apply the technology that's there. So I thought, you know, maybe I need to learn a little bit more about this. So I obviously took run high fight, which is available again for free on the FEMA website, the independent study website. It's one hour. I took the avoid, deny, defend instructor training through Texas University of Texas. So through the alert program, through the crash program, I started to get a more clear picture and I started researching and I specifically researched San Bernardino at great extent and unfortunately found audio clips from law enforcement where they were asking someone if anyone can make a PA announcement, wow, have them come to you. Wow. So the public address equipment was in place. Has anybody found that access control card yet? So you had small cadre diamond formations pushing through this building, trying to, in essence, breach fire doors that were behind mag locks that were operated by access control. So you were in essence putting these brave law enforcement officers in the fatal funnel in order to breach that door when in fact they could have simply swiped the card down the quarters and made their tactical entry. The reality is, if you read the after action report on San Bernardino, video is mentioned twice. It's mentioned once in that there was video surveillance on the command post for protection of the incident command post and just as kind of an afterthought, someone mentioned that they actually observed the black car or the black SUV drive back by the front door. The reality is the law enforcement guys that made entry that day were extremely brave, but the shooters were gone. So roughly 30 minutes, the folks that had been wounded, injured, whatever you want to refer to it as, were not able to get medical assistance because they didn't know the shooters were gone. When in fact, when the first entry team made entry, there was no threat. It would have in essence been classified as a cold zone. Yeah. So, you know, I went on from that and I thought, well, gosh, I bet I need to better understand what law enforcement does. So I got certified as a solo engagement SWAT operator. When I look at what medics can do, if they can get on scene quick enough and get on target quick enough, the number of lives that can be saved. You know, the statistics tell us that 80% of all gunshot victims bleed to death. So I took rescue task force operator school and got certified as a rescue task force operator. Not that you want me in a gunfight or that you want me as your medic. There's guys that are a lot better at it than me. But I wanted to understand where we as an industry, and when I say we as an industry where the security industry fits into this puzzle. And unfortunately, I find we don't. I have not found a single incidence yet of an active shooter event where there wasn't technology in place. But unfortunately, I've only found one where the technology was properly leveraged because it was not a repeat was not part of the emergency response plan, the emergency operations plan, the emergency action plan. So whether you want to call it an EOP ERP or EAP, the technology that that we sell on a daily basis is not factored in. Yeah, not part of the solution of where I got to where I am now. I've researched all these events. Parkland is the absolute heartbreaker. In the Parkland event, there was video, there was access control, there was mass notification. Shooter was in and out in seven minutes. It's all on video. But it was roughly 58 minutes before the building was downgraded from a hot zone and it went directly from hot to cold. So for roughly 51 minutes, you were in a cold environment, but no EMS was allowed into the building. And then just for our experience massive hemorrhaging, you bled it out. Yeah, maybe elaborate for our audience a little bit about the there's some change going on there to enter what's called a warm zone and to train some guys to go in with into what's probably a hot zone. But you know, maybe they're further back to deliver treatment. Talk a little bit about some of that. What you what you've seen in a trend. There's I know that's changing a little bit. Well, we're DOJ has just released a whole bunch of grant money to get more EMS personnel qualified to actually become rescue task force operators. And what that means is when we look at hot, warm and cold zones, a hot zone is where there's direct gunfire, right? Medics are not going into that environment unless they're also cross sworn as law enforcement. When we look at warm zones, there's the potential for violence, but no immediate gunfire in that area. Now, it's potential to reignite, but these operators, these rescue task force operators have been trained to embed in a tactical stack and a gunfighter stack and actually move with that stack and get dropped at locations to provide medicine for injured people. Yeah, they can also, of course, provide medicine to the first responders. And then finally, there's a cold zone where it's been identified that there is no, no risk, no known risk to folks entering. So EMS then, whether trained or not, can go in and start putting their tourniquets, their chest seals, their, you know, whatever, to save lives. So you're seeing a number of agencies. I've been told I have not been able to confirm this, but I've been told in the Parkland shooting, I know for a fact that EMS was staged within 200 yards of what they refer to as the Alpha Door, the main entry door to the facility. I've been told that there were guys that had rescue task force training in there, but, and they were begging to go in, but they were not allowed to go in. Wow. Law enforcement had control of the scene and law enforcement controlled the designation hot or cold, and they opted to keep it a hot zone. So any aid that the kids got was from actually the other than the original responding agency, Dragon Children Out and putting them on stretchers once they got them into an area that was classified as safe. And that's just, that's unacceptable. There were 15 high definition cameras in that facility. There is video of the entire event. So there was absolute situational awareness to the first responders that they didn't know they had. Yeah. And they didn't know they had it because it was not part of the emergency operations plan. Yeah. And before we get off, because I do want to talk about that technology gap a little bit, but since 2015, do you do you think we've learned enough from these events that now we've got a better handle on how to train folks in a facility to plan for their operations to integrate the technology? Do you think we're still, we still got a really broad gap there? We're still light years away from that. Okay. You know, there's a question that I ask every end user, if I'm invited out to talk to someone, I ask a very simple question in my mind, but it's how do you currently resource type your electronic countermeasures as part of your critical incident, all hazard response plan? Yeah. Now, if you break that question down, it's very simple resource type. Well, if we look to FEMA and DHS for a definition of resource type, it says clearly categorized by capability, electronic countermeasures. Well, let's face it. Anybody in this industry knows what access is, knows what video is, knows what IDS is, knows what math. I mean, we know all this stuff, but the last part of the question is what kills you as part of your critical incident, all hazard response plan. Yeah. And the reality is, if you pulled 100 EOPs from anywhere from Fortune 50 to Fortune 5000 companies, and you looked at their EOP, if you found two that actually spell out the workflow, in other words, this is what we're going to do. These are the steps we're going to take. And that workflow included technology. I'd be shocked if you found two that have really done it. Yeah, it seems like the table tops always talk about duties, responsibilities. You see the people, but there's no integration of their actions with the technology and no plan to put on people arriving on site or whatever it may be. There's no, I even see where there's no, there's no one who's, who's the chief communicator, for example. Like that's not spelled out what that means. They might call them that, but how they're going to communicate and what they're going to communicate. And with what is never, it's just not part of it. Well, if you look at the very basics of incident command, when you talk about chief communicator, are we talking about liaison within? Or are we talking about who is going to be our point of contact to media? You see that stepped on every day, yet incident command clearly defines how to utilize a public information officer, how to utilize a JIC, a joint information command, if necessary. And it just, it never seems to get done. Anytime you see, right, anytime you see a, and we'll go back to Parkland for a minute, the high sheriff, step in front of the microphone, you've seen a mistake made because he's not the public information officer. You know, a public information officer is never giving opinions. A public information officer is giving known information only and they don't say, I can't comment on that because that's, I mean, when I took the Coast Guard public affairs training, I was fortunate enough, they sent me for three days out to Alameda, California. You just don't say no comment. That's, that's not what you said. As bad as it gets. I've done, I've said through some of those, some of those publicity briefings and when they, when you get trained how to communicate and what you're supposed to say. We're going to take a short break about one minute and we'll be right back with Jerry Wilkins, hang around. Aloha, my name is Victoria and I'm a host at the Adventures in Small Business. This is a collaboration between US Small Business Administration, Hawaii District Office and its partners where we showcase the stories of local entrepreneurs and small businesses, talk about how to start a business, talk about great tips for small business owners. Please join us every Thursday, 11 a.m. at Think Tech, Hawaii. Can you say mahalo? Aloha, my name is Duretian. You are watching Think Tech, Hawaii. I will be hosting a show here every other Wednesday at 1 p.m. And we will be talking to a lot of experts and guests around sustainability, social justice, the future here in Hawaii, progressive politics and a whole lot more. So please tune in and thank you for watching Think Tech, Hawaii. Hey, Aloha and welcome back to Think Tech, Hawaii Studios. This is Security Matters Hawaii. I'm your host, Andrew Lanning, and we're talking with Jerry Wilkins. I want to get right back to it. Jerry, you were, you were, you're bringing up an episode at Parkland where people were doing things wrong, although the training is very clear about what to do. How often do you see them just not using information that's available? Well, it's almost easier to say how often do you see them using the technology that's there or the information that's there? Because it's almost, unfortunately, right. In my research, I don't see it. If you look at the Virginia Beach shooting that just occurred back in August, law enforcement performed amazingly well. I mean, they had one officer. You actually hear him sprinting from their headquarters, which is only a couple hundred yards away from where the building, the number 12 building was. No disregard or no regard for his safety whatsoever. He had an active shooter event. He'd been trained to enter the building, engage the hostel. He did exactly that. When you look at what EMS did, they were spot on. They set up a command post, started working through their protocols, which is kind of unique, but it's unique to the fire service because all the fire service does it. Yet when they get the shooter hemmed up, they can't get to him because he's behind a locked access control door. Yeah. Was the access control part of the critical incident response plan? No. So for roughly 38 minutes, you had injured victims that were being drug out of the building through what was, I guess, internally classified as a cold corridor, which is amazing. I mean, that's spot on with what's supposed to be done when in fact a simple swipe of the card and they could have eliminated that threat downgraded everything to cold and had just a surge of medics come in and start putting medicine on people. Yeah. Yeah. And this this bleed time, we're talking about typically minutes, right? We need we need to get a compress. We need to get compression on that wound. If it's a your cavity wound of some type, I guess even in a leg, it can hit an artery or something, which I know arterial bleeding is really fast. What what? Well, arterial bleeding is really the problem. Yeah, okay. Hemorrhole brachial, in other words, leg arm. But a 10 to $30 tourniquet solves that problem. Okay. Now, when we talk about chest bleeding, if they're bleeding directly into the thoracic cavity, that's a problem. But what we see so often with these high velocity rounds is through and through shots. And what happens is the hole becomes away for air to get in. So every time the diaphragm goes up and then goes back down air gets into the chest cavity. And then you end up with something called a tension pneumothorax, which is simple $3 chest seal put on there so that air is not entering that chest cavity can be the difference between life and death until they can get to, you know, they talk about the golden hour. Yeah. Typically, if you can get someone who is alive to a medical trauma center within an hour, it's unlikely that that person's going to die unless they're already clinically dead when when you start working on. Sure. You know, if you've got exposed brain brain matter when you look at salt or look at start a couple different triage methods, you're going to move on. Sure. You save the ones you can. Let's talk about how to do that. Let's talk about a little bit of that guidance. So I know I'm I know I've heard you you're talking about NFPA 3000. We've got about, you know, six or so minutes left. So let's let's try to walk through the a bit of the why I know you teach this in your Academy. Take us through some of the some of the requirements that you think drive the why we should be training our industry on this information. Well, for any of the folks listening that have seen any of Simon Simon Sinek's work, he talks about the Golden Circle, the how, the what and the why. Well, we sell the what and the how for the most part. Yeah, it's a five megapixel camera that's deployed on a internal network, a production network, a security network, whatever it's V land, it's whatever. It's the what and the how. Yeah, when we think about the customers, why we rarely get to that? Well, what is the customers? Why? Well, they want to mitigate risk. What is risk? Well, it's the fear of being sued. It's the fear of people being killed. You know, it's it's all different types of things that we rarely get to when we have that conversation. You know, when I talk to people and ask them about the simplest risk formula, which is R equals T times V over C times I risk outcome equals threat active shooter vulnerability failure to plan impact number of people that gets killed over C and the C is countermeasures. That's not my formula. That is the standard simplest risk formula. So what are countermeasures? Well, videos countermeasure access controls countermeasure. Mass notification is a countermeasure. Policies are a countermeasure. Procedures are a countermeasure. And under that subgroup of policies and procedures is training. You know, I ask people all the time that says, Yes, we would use our technology if we had a critical incident. Okay, when was the last time you drilled against that incident? Yeah, we did it a month ago. Great. Show me the hot wash. Show me your after action and show me in your hot wash, the impact that the technology had. Yeah, if it's not spelled out as part of the way you dealt with that incident, it's not part of your EOP periods and incentives. So where do we look for guidance? You know, so far we talked about a lot of bad news. Well, when we look at NFPA 3000 came out May 1st, 2018, it's an Asher program, active shooter hospital event response plan. That they say is a great way to plan for respond to and recover from an active shooter event. But here's the kicker. It goes on to say it's defensible, adaptable and implementable. And key word being defensible. When you look at the lawsuits that are coming out now, whether it's the Walmart in El Paso, the Aurora Illinois shooting on where the employee went in and killed the four HR people. Who knows what'll come out of Virginia Beach. Parkland, there's 22 parents that have put together another lawsuit. That lawsuit had originally been thrown out. But the Federal Commission came out with a report that said schools are not only responsible for teaching and keeping students safe, but they're also for leading responsible for leading them in times of emergency. So if we're not looking at things like NFPA, if we have a late night retail establishment and we're not looking at guidance that OSHA has produced called OSHA 3153. If we're in health care and we're not looking at the guidance OSHA put out called 3148. If we're in education and we're not utilizing pass partner alliance for safer schools. We can't say we've met industry best practice. And so therefore we're not defensible. That is correct. Yeah, right there with you. And you know, one of the funny things when you look at NFPA 3000 and we talk about that a great deal in our in our trading. It's 42 pages long. It's not war and peace. Yeah, yeah. You know, it's something that the average person can read in a night and reread the second night and absorb. But one of the real problems with NFPA 3000 is it calls out terminal or it actually has a statement shall utilize NIMS and ICS protocols. And that's the national incident management system, right? An incident command structure. If you ask folks in our industry, what is NIMS? What is ICS? They're like me seven years ago. They don't have a clue yet. It's this amazingly well developed resource management plan. And when we think of resources, that's people, that's infrastructure, that's technology, that's policies and procedures. It just gets left. That's like our countermeasure coordination document. And it's given to you. It's spelled out how you do. You just need to adapt it for your own organization. And it's free. And it's free. You know, people say, well, I forgot that. Yeah, free 99. Put together, right. How do you put together an emergency operations plan? Well, there's a document online through DHS called the CPG 101 comprehensive planning guide. Yeah. And it's the paint by numbers. This is the way I develop a comprehensive emergency operations plan. Well, how do I do a threat assessment? Well, if you purchase the NFPA document, which is a whopping fifty two dollars, it comes with three survey forms to help you develop a correctly done threat assessment. And then if you pull out the CPG 201, which is Thera threat and hazard identification and risk assessment and start applying what you learn there, it's not hard to develop this. And, you know, one of the common responses I get, oh, we'd use our technology. No, you won't. Yeah. You will not rise to the occasion. You will fall to your level of training period. So don't think you're going to pull a rabbit out of your hat when you go right up boom, as the FBI would say. Yeah, especially in, you know, in times of duress, right? In times of duress, that's the last time you want to come up with a plan. You're going to you're going to react as you've been trained 100 percent. We know that military taught me that we got about a minute left, Jerry. So take us home. You know, my my my take home speech here is very simple. You're investing time, capital dollars in technology. Invest a little bit of time in bringing your integrator, bringing your consultant, bringing whoever you're utilizing to help you develop this security plan and make sure that you're developing a comprehensive, all hazard response plan, whether it's tornado, whether it's the evacuation or the drill that went off incorrectly in Hawaii. I guess it was last year. What is your plan going to be if a tornado is rolling in or if a severe thunderstorm? If you don't have a plan, again, you don't rise to the occasion, you fall to your level of training. And of course, the other thing is if you train till you get it right, you'll fail under pressure. These these these concepts that you produce must be simple. They must be executable when you're in the worst frame of mind you could be in. Yeah, and they need to be understood by everybody and practiced often and modified as needed. Jerry, I really appreciate your time. I appreciate you sharing your knowledge with us today. You guys want to learn more, check out the Academy Active Risk Survival. He's got an Academy goes on so often. Check it out online. Get signed up, get your people trained, save some lives. That's what it's all about. Appreciate you joining us today. Aloha, everybody. Take care.