Security Guidance for Museums, Zoos, Libraries

The Smithsonian Institution—the world's largest museum and research complex—includes 19 museums and galleries and the National Zoo.  The Smithsonian welcomed more than 28.6 million visitors in 2011.  Of those, 6.6 million were to the Museum of Natural History, which houses the Hope Diamond, a security concern unto itself.  In addition to the 25 locations for the DC Public Library system, there are numerous university libraries and law libraries throughout the city that receive hundreds of visitors on a daily basis.

Potential Indicators of Terrorist Activity 
Terrorists have a wide variety of weapons and tactics available to achieve their objectives. Specific threats of most concern to museums, libraries, zoos, planetariums, and aquariums include those that involve:
• Improvised explosive devices
• Arson
• Small arms attack
• Chemical, biological, or radiological agents
Terrorist activity indicators are observable anomalies or  incidents that may precede a terrorist attack. Indicators of an imminent attack requiring immediate action may include the following:
• Persons in crowded areas (e.g., common areas, food courts) wearing unusually bulky clothing that might conceal suicide explosives or hide weapons (e.g., automatic rifle)
• Unattended vehicles illegally parked near buildings or places where large numbers of patrons gather
• Unattended packages (e.g., backpacks, briefcases, boxes) that might contain explosives
• Unauthorized access to heating, ventilation, and airconditioning (HVAC) areas; indications of
unusual substances near air intakes
Indicators of potential surveillance by terrorists include:
• Persons using or carrying video/camera/observation equipment over an extended period
• Persons having maps, photos, or diagrams with facilities highlighted
• Persons parking, standing, or loitering in the same area over a multiple-day period with no apparent reasonable explanation for doing so
• Persons questioning employees off-site about practices pertaining to the facility
• Employees changing working behavior or working more irregular hours
• Persons observed or reported to be observing facility receipts or deliveries
• A noted pattern or series of false alarms requiring a response by law enforcement or emergency services
• Unfamiliar cleaning crews or other contract workers
• An increase in the number of incidences when buildings are left unsecured
• An increase in threats from unidentified sources
• Sudden losses or thefts of guard force equipment
Common Vulnerabilities 
The following are key common vulnerabilities of museums, libraries, zoos, planetariums, and aquariums:
• Easy accessibility of facilities to large numbers of public   patrons
• Accessibility of items having unique value and/or significance
• Presence of dangerous animals in zoos

Protective Measures 

Protective measures include equipment, personnel, and procedures designed to protect a facility against threats and to mitigate the effects of an attack. Protective measures for public institutions include: 

• Planning and Preparedness 

− Develop comprehensive security and emergency response plans and conduct regular exercises of the plans. 

− Maintain a constant awareness of the current threat condition and available intelligence information. 

− Establish liaisons and regular communications with local law enforcement and emergency responders. 

• Personnel 

− Conduct background checks on all employees. 

− Incorporate security awareness and appropriate response procedures for addressing security situations into training programs. 

− Maintain an adequately sized, equipped, and trained security force. 

− Check training rosters to ensure that personnel have received proper training on the Homeland Security Advisory System and specific preplanned measures. 

• Access Control 

− Provide appropriate signs to restrict access to nonpublic areas. 

− Identify and control access by all employees, vendors, delivery personnel, and contractors. 

− Install electronic access control systems and intrusion detection systems in sensitive areas. 

− Identify key areas in or next to buildings and prohibit parking in these areas. 

− Issue photo identification badges to all employees and require that badges be displayed at the facility. 

• Barriers 

− Provide adequate locks, gates, doors, and other barriers for designated security areas. 

− Inspect barriers routinely for signs of intrusion. 

− Install barriers at HVAC systems, hatches, and power substations and routinely patrol these areas. 

• Communication and Notification 

− Install, maintain, and regularly test the facility security and emergency communications system. 

− Communicate threat level information to employees. 

− Take any threat (phone, fax, e-mail) seriously. 

− Encourage employees and the public to report any suspicious activity that might constitute a threat. 

• Monitoring, Surveillance, Inspection 

− Install closed-circuit television (CCTV) systems, intruder alarms, and lighting to cover key areas. 

− Train security personnel to watch for repeated visitors or outsiders who have no apparent business in nonpublic areas, unusual activities, and abandoned packages and to monitor utility supplies and routine work activities scheduled on or near assets.
− Regularly inspect lockers, mail room areas, trash bins, parking lots, garages, and all designated security areas under access control.
− Consider using night vision/infrared CCTVs to monitor areas requiring dim lighting (e.g., theatres, shows, and zoo/aquarium dark habitat facilities).
• Infrastructure Interdependencies
− Provide adequate security and backup for critical utility services (e.g., electricity, natural gas, water,
telecommunications).
− Locate fuel and utility supply facilities at a safe distance from buildings and high-traffic areas.
• Cyber Security
− Implement and review hardware, software, and communications security for computer-based
operational systems.
− Eliminate any information that might provide security information to adversaries from the Web site.
• Incident Response 
− Develop and maintain an up-to-date emergency response plan.
− Review unified incident command procedure for responding to an event with local law enforcement and emergency responders and government agencies.
• Report Suspicious Activity 
− If you observe suspicious activity, you should call an emergency at once.