In March 2020, thieves pulled off a smash-and-grab job in the dead of the night, stealing Vincent van Goghs’s masterpiece, The Parsonage Garden at Nuenen in Spring 1884, from Netherland’s Singer Laren museum, exploiting the museum’s recent closure to help contain the spread of COVID-19. Around 3:15 a.m., the thieves smashed a glass door at the entrance, triggered an alarm system, and successfully stole the painting before law enforcement arrived.

Much like Singer Laren, other museums, galleries, libraries and cultural institutions in charge of protecting valuable and cultural assets remain temporarily closed due to the outbreak of the coronavirus pandemic. In fact, 90% of the world’s museums or more than 85,000 in number, have temporarily closed their doors to protect the health and safety of staff and visitors, and nearly 13% of museums worldwide may never reopen after the COVID-19 shutdown, according to research by UNESCO and the International Council of Museums (ICOM).

The burglary and theft at Singer Laren garnered attention of museum directors and security staff, particularly as the lack of crowds and physical security presence potentially compromised by staffing issues during the virus outbreak may present an invitation to opportunistic thieves, as reported by the Washington Post. And, while these facilities continue to maintain 24-hour security operations with increased monitoring of all facilities and property, thieves may think these facilities are in a weakened condition, increasing the threat level.

To maintain a unified security and safety operation during closure, many museums and cultural heritage institutions have relied on tried-and-true security and risk management practices, and repurposed their time and energy to reassess, monitor and explore additional risk-mitigation measures to safely reopen and welcome the public back through their doors.

Risk Assessments for Long-Term Protection

It’s no secret that the COVID-19 pandemic has wreaked havoc on the arts and culture community. Self-isolation measures placed during COVID represent a major challenge for arts and museum security professionals who must continue to ensure the security of facilities, assets and art collections. Tried-and-true safety and security measures have proven highly valuable during this time, says Kevin Wilkes, Chief Security Officer for the Pittsburgh Cultural Trust.

As one of the city’s largest property owners in the Pittsburgh downtown area, the Trust is responsible for more than one million square feet of property and is a major economic driver of business in the Cultural District with an estimated annual economic impact of $303 million serving as an anchor institution for other dining, parking, retail, residential and entertainment businesses.

At the Trust, Wilkes is responsible for the development of all security and safety policies, programs and procedures designed to protect the Trust, its staff, patrons, guests and property and liability exposure. He manages the 24-hour, 365-days-a-year security presence in all Trust facilities and grounds by utilizing personnel and video surveillance.

Wilkes also leads a team comprised of the Vice President of Operations, Chief Information Officer, facility managers, technology security personnel, risk management personnel and external security contractors, to develop and manage all security and safety policies, programs and procedures for the 14-block campus located within Downtown Pittsburgh. The Trust campus supports nine performing arts locations, five visual arts/gallery locations, and a host of outdoor public art spaces.

The Trust hosts approximately two million visitors annually to its various performing and visual arts exhibitions and artistic festivals. “Our risks run the gambit from incidents of mass attack, property crime, street crime, acts of workplace violence, employee dishonesty, weather-related risks, civil unrest, theft, vandalism, crowd control and management, suspicious activity/threats, and more,” says Wilkes. “Our Cultural District neighborhood is really a city within a city and our community is impacted by all those risks you would expect to see in such a diverse and dynamic setting.”

Securing a large footprint is no easy task, and can be extremely challenging for a local non-profit to manage. “However, the protection of our art galleries and public art displays is of paramount importance to the Trust, even during the pandemic,” Wilkes explains. “The protection of these spaces factors in heavily with our security mission of implementing protective measures to help assure the comfort and enjoyment of guests as they experience our visual art locations and outdoor public art area.”

And while indoor art galleries at the Trust remain shuttered due to COVID-19, outdoor public art locations are open, free to the public, and are readily accessible for all to enjoy. Like most organizations, the Trust utilizes a myriad of protection practices to safeguard its people, guests, events, and properties – all of which help Wilkes and his security team to form a comprehensive strategy of layered defense which uses a well-balanced mixture of both hard and soft protection practices.

According to Wilkes, these practices begin with a thorough security risk assessment to build protection methodologies and foundation upon, and then a periodic reassessment of practices on an ongoing basis to help “right-size” the security platform to ensure the security team meets their objectives or rethink their strategy and possibly redeploy resources elsewhere where better needed.

During the COVID-19 closure, Doug Beaver, CPP, Executive Director of Protection Services for the National Museum of Women in the Arts, has also relied on a wide spectrum of security functions including, but not limited to, security guard force management, risk and vulnerability assessments, and business continuity planning.

Located in the heart of Washington, D.C. and just blocks away from the White House, the National Museum of Women in the Arts frequently hosts high-profile events that dignitaries and high government officials, including the President and the Vice President of the U.S., attend. For these high-profile events, Beaver works closely with the U.S. Secret Service and coordinates with law enforcement advance protection teams in developing security plans for top quality concerts, films, staged readings and other performing arts events, visiting dignitaries, executive level government officials, heads of state, entertainers and world leaders.

Beaver oversees all aspects of the physical and technical security programs associated with a nearly 6,000-object collection and an 18,500-volume library and research center at the National Museum of Women in the Arts. His responsibilities include developing and implementing department policies, administering technical security systems, safety training programs, standard operating procedures, employee security awareness programs, disaster preparedness and emergency response plans.

The pandemic, Beaver says, introduced unexpected challenges relating to the sustainability of the entire cultural arts industry. “Establishing and deploying mitigating measures for COVID-19, is eerily similar to that of a bioterrorism response, and presents similar challenges. The SARS-CoV-2 has really heightened our nation's biological weapon profiles, spotlighted our vulnerabilities and placed the U.S. squarely on the international stage, which could have a profound effect down the road on our national security – it’s a serious concern that we all should be cognizant of.”

To keep up with this world of uncertainty, Beaver has leveraged his expertise in risk assessments to educate and inform C-suite decision-makers. Though they can be somewhat complicated, he uses a qualitative approach, boiling it down to three core elements: risk identification, risk analysis and risk evaluation. This methodology allows him to quickly prioritize and rank any security and safety risks, which is a necessity for mitigation. “The risk assessment ensures the security team can effectively carry out the important mission of protecting people, assets and information with professional expertise,” Beaver says.

According to Andy Davis, Owner and Managing Director of Trident Manor Limited, the risk assessment process for cultural institutions should be comprehensive. Having been involved in the audit, review and design of museums and other cultural venues for several years, he always encourages organizations in charge of the exhibition, conservation and management of cultural heritage to “consider the broader context.”

“Consider: What's happening socially around the building and around the venue? What's happening socially in the region? Are there any protests? Has there been any direct impact or threats against the museum or the venue? Have you suffered any losses or any damage? Have you collected and analyzed publicly available information and data for intelligence purposes? Taking all these aspects into account helps you build a picture and understand what is really taking place around your venue,” Davis says.

In turn, this helps with directing the organization’s risk tolerance and approach to risk management activities. Every museum or cultural heritage institution is unique, faces different threats, has different short-term objectives and different resources available. “Understand that there is no one size fits all,” Davis explains.

Davis recommends a structured approach to assessing the threats that exist and the risks they pose. “Identity the threats that exist, from crime, to civil disturbances and warfare, natural catastrophes, industrial disasters, and any other threats which may result in loss, theft, or damage to the artifacts on display.”

Once all threats are understood, an evaluation of the risk each poses to the venue or facility can be undertaken. The nature of the threat is very much influenced by the attractiveness, value and portability of the collection, although the institution’s surroundings and any history of crime will also play a part. An institution that has suffered a burglary or robbery with the loss of some masterpieces from a collection that has other similar works should consider the potential threat from adversarial sources as being high, Davis explains.

“Our history and culture is preserved in museums,” Davis says. “Now, more than ever, operational security practices need to dovetail with physical and technical solutions to protect heritage and cultural institutions from attacks, particularly as the illicit trafficking of cultural property has been closely linked to organized crime and terrorism financing.”

Violence and Social Unrest

Of particular concern over the last year for museums and cultural institutions has been rising extremism, continuing fallout from the pandemic, racial injustice and political issues – all which can drive an increase in violent threats toward institutions of all kinds, especially high-value and cultural targets.

“From a pandemic to a very heated national presidential election, to the sudden reawakening to the public of social injustice issues, and not to mention the rise of extremist nationalists inside our country, it was the perfect storm,” Wilkes says. “It created unique challenges that impacted organizations across the world. Museums and cultural heritage institutions were not exempt from that. These events alone, not to mention the always-present risk of possible attacks against places of mass gatherings is enough to cause any security professional to lose sleep. ”

The U.S. Capitol Riot on January 6, 2021 was particularly challenging for Beaver, as the National Museum of Women in the Arts is located in the epicenter of D.C. “We’re located just two blocks from the White House, which presents us with an ongoing heightened threat environment,” Beaver says. “That threat is exacerbated by the fact that we are the only museum of its kind in the world, one that recognizes and honors women artists.”

As a result, the museum has maintained an ongoing mindset of heightened awareness. “In terms of preparing for social unrest, one of the key factors is the early recognition of aberrant behavior through effective screening processes. It’s critically important to identify individuals exhibiting behavioral anomalies early that could ultimately present a threat to your institution and staff, your staff, visitors and its assets,” Beaver explains.

Beaver incorporates behavioral pattern recognition, a tactical tool for detection of suspicious and criminal behavior prior to an attack – a technique he perfected while working with an Israeli risk management firm – into his training programs for his physical security team comprised of current and former law enforcement officers and a civilian guard force of approximately 50 officers. He says, “I’ve trained our officers to recognize behavior that is uncommon in a museum setting, and because aberrant behavior is out of place, it more times than not, can lead to undesirable outcomes.”

Training should be ongoing for museum protection personnel, who should receive enhanced training in security, fire prevention, and first aid skills, Davis says.

Most importantly, safety and security training in a museum should apply to everyone. “Once a policy is established regarding access, perimeter, or other security measures particularly those implemented during the lockdown, no one, including the director, trustees, donors, staff, etc., should be exempt or excluded from rules or safeguards due to the rank, education, or job function,” he says.

All employees that have access to the building or the collection or who have contact with the public or visitors - including those who volunteer or are members of affiliated groups or boards - should understand the various threats that exist, Davis suggests. “In addition to understanding the threat, everyone should be trained on situational awareness. If a staff member sees something that is suspicious, he or she is able to alert security and help along the security process. It helps build multiple layers of operational effectiveness.”

Davis suggests the right balance is when the protection is in place, but is low profile and effective. “It has to combine physical protection measures, technical solutions, operational practices and overall, internal education programs about steps and measures that should be taken so visitors can have an enjoyable experience, while protecting the organization, its people, and its assets.”

Wilkes and Beaver also maintain an excellent working relationship and partnership with local law enforcement. These strategic partnerships helps security leaders take further reasonable steps to reduce the risk of a reasonably foreseeable type of loss from occurring – whether from vandalism, theft, extortion, ransom, fire or disaster.

In Pittsburgh, Wilkes explains, some protests became chaotic and out of control, leading to some property damage to one of the Trust’s buildings within the downtown area. His relationship with law enforcement enabled him to maximize the security around the properties in advance of any potential problems associated with civil unrest, helping limit and minimize property damage. “We continue to maintain a good partnership with local law enforcement, as well as rely on outside cyber intelligence, threat assessment and analysis to help us take preemptive measures before incidents can occur and take steps to prevent unnecessary risk,” he says.

Beaver says he has established working relationships with federal law enforcement as well, particularly with the local the Department of Homeland Security fusion center. Fusion centers share threat-related information between State, Local, Tribal and Territorial, federal and private sector partners. “They provide me with intelligence resources through social media and dark web monitoring to assist us in proactively mitigating any potential threats that they identify as relevant to our institution.”

Overall, says Wilkes, security leaders must rely on public safety partnerships, cyber intelligence/threat assessment practices, and community outreach components to safeguard people, guests, assets and properties. “These resources help us preemptively identify any developing concerns that need monitoring and possibly deploy an appropriate intervention response, to hopefully deescalate the situation before it impacts the Trust or our stakeholders.”

“An ounce of prevention is worth a pound of cure,” Wilkes adds. “In my book, prevention beats response any day of the week. A security solutions formula that I have always attempted to follow during my career has been Awareness + Readiness + Prevention = Risk Reduction. This has always been a recipe for success and one I consistently turn to and rely upon.”

Preparing for a Safe Return

For museum security leaders, reestablishing and strengthening the three main focus areas have been restoring health and safety, strengthening business continuity and crisis management strategies, and creating a plan that allows the return to full business operations.

Because cultural institutions and museums rely on repetitive visitation, a key challenge for security leaders in this space is balancing the necessary measures of security for high-value and irreplaceable cultural artifacts, while maintaining an unrestricted and welcoming environment where the public can view and interact with the art.

As many of these institutions prepare to reopen to the public with major limitations, providing an environment that allows for the best possible visitor experience while ensuring the wellbeing of staff and visitors in a socially distanced world is a major concern.

“You want the public to feel comfortable and safe, but we’re trying to ensure that our collections are secure from any type of damage or vandalism,” Beaver says. “A heavy dose of interpersonal skills and visitor relations, aligned with policies and procedures will be more critical than ever.”

Observation skills will continue to be important as well. “As visitors interact with the art hanging on the wall or with sculptures, the physical security team has to be aware of every single potential hazard to the artwork and ensure visitors are complying with government mandates and meet the museum or venue’s specific safety measures implemented, such as avoiding the formation of groups, regulating flows, enforcing social distancing, enforcing hygiene, and providing temperature screening at the entrance,” Beaver explains.

At the Trust, Wilkes and his security team are preparing for The Three Rivers Arts Festival, the first large-scale public event in over a year. In addition to utilizing security technology and external public safety partnerships, he says, they will be deploying a public safety tent for this event which serves as their Forward Operating Base (FOB) for the two-week festival.

“We anticipate the need to utilize more volunteers and security persons to provide guidance to our guests inside of the festival’s new reimagined footprint this year and to help remind guests about our COVID health safety protocols (masks, social distancing, hand washing, guest entry times, festival area capacity limits, etc.),” Wilkes explains. “We will also be using more housekeeping (Clean Team) personnel to ensure we are properly disinfecting all high-touch areas and surfaces. We will utilize outside hand sanitization stations and make sure we have a COVID-isolation area onsite which is medically supplied with equipment and EMS personnel for those persons who may suddenly find themselves feeling ill or experiencing COVID-like symptoms.”

Another challenge museum and cultural institutions must consider is encountering resistance to policies. “There has been an increase in verbal confrontations between security staff, museum staff and visitors who don’t want to comply with the rules, such as the wearing of face masks, social distancing. Security teams will need to be trained on visitor care and conflict management. Resistance to policies need to be met and addressed with clear policies and procedures,” Davis says.

Overall, in addition to complying with orders and guidance from federal, state and local officials and the medical community, Beaver recommends organizations address employees’ COVID-19 questions and concerns and reassure staff of the steps that are being taken to protect everyone’s health and well-being. “This will help prepare our security teams in navigating the many changes they will face, and communicate organizational leadership’s compassion and empathy during these challenging, difficult times.”

For Wilkes, Beaver, and other museum security leaders alike, the main priority is letting visitors know it is OK to have fun again in a safe and responsible fashion. “Our job is to be responsible event organizers and facilitators of a healthy and safe guest experience,” Wilkes says.

Sound Resources for Effective Risk Management at Cultural Institutions

The long-term success of any organization relies on many things, from continually assessing and updating operational and security processes, to utilizing physical security measures and practices. To help account for the unexpected in managing risk, resources security departments at arts, museum and cultural heritage facilities rely on include:

• Electronic access and card readers

• Doors, openings and locking mechanisms

• Electronic intrusion detection and property alarms

• Mechanical, electrical and plumbing systems

• Storage cabinet keys and combinations

• Emergency egress

• Perimeter fencing, barriers or walls

• Video surveillance

• Security messaging or emergency communications systems

• Enhanced lighting

• Various CPTED components

• Contract security providers

• Electronic guard tours

• Area crime analysis

• Event risk analysis

• Emergency readiness planning and tabletop exercises

• Security awareness training

• Guest services/ Front of House training

• External public safety partnerships

• External business and neighborhood partnerships

• Utilization of external event specific resources for cyber intelligence/threat assessment, K9, bike patrol, local law enforcement, etc.

These resources can help museums, galleries, libraries and archives increase the likelihood of achieving their mission, improve the safety outcomes and the identification of opportunities and threats, and further effectively allocate and use resources for managing risk.