Schneier on Security
A blog covering security and security technology.
« An Economic Analysis of Airport Security Screening |
| iJacking »
March 31, 2006
Cubicle Farms are a Terrorism Risk
The British security service MI5 is warning business leaders that their offices are probably badly designed against terrorist bombs. The common modern office consists of large rooms without internal walls, which puts employees at greater risk in the event of terrorist bombs.
From The Scotsman:
The trend towards open-plan offices without internal walls could put employees at increased risk in the event of a terrorist bomb, MI5 has warned business leaders. The advice comes as the Security Service steps up its advice to companies on how to prepare for an attack. MI5 has produced a 40-page leaflet, "Protecting Against Terrorism", which will be distributed to large businesses and public-sector bodies across Britain. Among the guidance in the pamphlet is that bosses should consider the security implications of getting rid of internal walls.
Open-plan offices are increasingly popular as businesses seek to improve communication and cooperation between employees. But MI5 points out that there are potential risks, too. "If you are converting your building to open-plan accommodation, remember that the removal of internal walls reduces protection against blast and fragments," the leaflet says.
All businesses should make contingency plans for keeping staff safe in the event of a bomb attack, the Security Service advises. Instead of automatically evacuating staff, companies are recommended to gather workers in a designated "protected space" until the location of the bomb can be confirmed. "Since glass and other fragments may kill or maim at a considerable distance from the centre of a large explosion, moving staff into protected spaces is often safer than evacuating them on to the streets," the leaflet cautions. Interior rooms with reinforced concrete or masonry walls often make suitable protected spaces, as they tend to remain intact in the event of an explosion outside the building, employers are told. But open-plan offices often lack such places, and can have other effects on emergency planning: "If corridors no longer exist then you may also lose your evacuation routes, assembly or protected spaces, while the new layout will probably affect your bomb threat contingency procedures." Companies converting to open-plan are told to ensure that there is no significant reduction in staff protection, "for instance by improving glazing protection."
Posted on March 31, 2006 at 5:14 AM
• 30 Comments
To receive these entries once a month by e-mail, sign up for the Crypto-Gram Newsletter.
Fascinating. I work in Belfast, and it's interesting to see that almost all offices have been built or converted to open-plan. Even though talking to colleagues will always reveal a few who were only saved from blast damage during the "Troubles" by internal walls.
MI5 are definately not cyberterorists
Mmmh... and if the bomb is IN the "protected space"? That could be pretty ugly.
"Open-plan offices are increasingly popular as businesses seek to improve communication and cooperation between employees. "
What a load! They are cheaper to build and maintain. Nobody can get much done when they have the background noise of 30 people on the phone or talking over the walls.
A friend of mine is a structural engineer, who was called in after the Bunsfield explosion (at an oil storage depot north of London). He told me that he had not seen such devastation. Complete windows were blown 40 feet across offices. The loss of life if those offices had been occupied would have been significant.
It makes the point of the vulnerability of people in large open plan offices.
"Mmmh... and if the bomb is IN the "protected space"? That could be pretty ugly."
And, experience would suggest, much much less common than the external threat.
I bet that in the interim, management will make sure they are in the protected, enclosed spaces. The peons will have to take their chances, while the critical managment infrastructure upgrades their offices to bomb-proof keeps with bulletproof glass.
I hate cubicle farms, too, but let's calculate the odds of anyone changing their office layout based on this report. You might want to use an ultra high-precision calculator to keep the number distinguishable from zero.
Anyone using the trendy "risk management" approach to security will quickly determine that the risk of a bombing is small enough that they needn't spend money on walls and extra office space. That assessment may not be wrong--we could as easily say that buildings under 5 stories tall are less likely targets for bombing, but we shouldn't expect everyone in a high-rise to relocate to a square mile of three-story walkups.
Open offices are detrimental to productivity. Communication should usually be kept within small teams, whose members are interested in it. For this purpose, office rooms for 4 or 5 people are ideal.
The only reason for building open offices is the inherent difficulty of determining the cost of lost productivity. Determining office expenses is much easier.
In short, open offices are one example of management by Excel, not by intellect.
Working in IT I have to dodge users exploding enough let alone any bloody terrorists!
I'll be safe in my comms room!
the odds are companies will not address this report by abandonning cubicles, but asking for better walls for cubicles.
Is there a company out there that created bullet-proof cubicles?
The Decision is not Rational
Cubes didn't come to be universal for a rational reason. They appeal to managers because they make it possible to look out over a vast sea of minions toiling away. They especially appeal to the ego of those who believe their subordinates would never work if they weren't being watched.
I fully approve of an irrational argument that might scare the suits away from cubes.
If there is a company that produces bullet proof cubicles, I hope there isn't a company that buys them. Large sheets of the fabrics used in body armor are expensive. For example, I saw a company that makes "ballistic blankets" to protect people being removed from a hostile area for about $3000/each.
Sheets of steel to produce the same effect are expensive and heavy. Also, it would only provide some protection against shrapnel, but none against the concussion of the blast or other effects. For example, a blast in my office would likely blow out the ceiling tiles and florescent light above my desk. Hardened cubicles would not do anything about falling objects, which would certainly be an effect of a blast.
Also, the idea of a bullet proof wall that most people could look and reach over is laughable against another equally rare and equally probable event - workplace shootings.
From the business perspective, security is an expense with no potential future profit. Anything done to change the open office structure would be a preventative security expense. Only if there were a high probability of an event and a substantial liability for failing to take preventative action would there be any business case for spending the money. Given how common cube farms are, I suspect we would need to see hundreds or thousands of deliberate attacks against cube farms before the cost could be justified.
While I might be all for fewer cubicle farms, this sort of advice should only apply when building in a high-risk area. Outside high risk areas, an exploding bomb near an office building any time in it's lifetime is rather unlikely.
Better to solve the problem of "terrorism" closer to the source, rather than choose to live in millions of concrete cells.
You have to be kidding me.
I'm suprised that MI5 even took the time to investigate (assuming they did) and then to publish results of such a study.
No I'm not. In fact, this is exactly the sort of thing a large group of dolts (such as a society) would expect them to do: "make them safer". This is the response? Publishing leaflets on what managers should do in terms of office design in order to protect against a specific (and VERY remote) threat?
Some one mentioned one of the other, much more frequent occurence of workplace shootings (and it's not even that frequent). These are not things we should worry about or fear, let alone a consideration around which we should design offices.
I don't much like the idea of cubes, but instead of all this aimless research of fear, you know what they should do with the time and money instead?
Hire a good security guard or train interested employees to be EMTs/First Responders.
Here in the U.S., paranoia about rampaging college students in the 60s led to a trend in architecture on college campuses that can still be seen: dorms modelled after prisons, with narrow halls, confusing layouts and odd angles designed to hinder groupes of people moving in unison. Few to no common areas as well.
Depressing as hell to live in, I can say first hand.
Are we now going to see a wave of this sort of crap for corporations, modified for the fear of the day?
If you can make something a terrorism risk, then you can make money from that risk. Looks like business as usual...
Not to mention the fact that common groups of staff are all clustered together. Something happens and you loose a whole team of network, telecom, server, etc.. gurus.
Where does that leave you??
I think there is more of a threat of someone with kids coming into work and spreading some virus taking out a whole team of people for a short period of time.
"Publishing leaflets on what managers should do in terms of office design in order to protect against a specific (and VERY remote) threat?"
You seem to be missing the fact that London (where MI5 is based) has significant experience of the results of terrorist bombings. It may come as a surprise to many, but the risk of terrorist bombing did not suddenly appear on September 11, 2001, that was merely the US' first real exposure to the threat.
The UK has decades of experience of US-funded Irish bombers and the events were far from rare.
"Some one mentioned one of the other, much more frequent occurence of workplace shootings (and it's not even that frequent). "
Again, you are taking a US-centric view of the threat. Workplace shootings are extremely rare in the UK, where this report came from and, if you work in London, it is arguable that the terrorist bomb threat is the more realistic.
@Jim, "I hate cubicle farms"
Golf proves that hate doesn't work.
"You might want to use an ultra high-precision calculator to keep the number distinguishable from zero."
That sounds mindless. You might want to use your head for something other than a hat rack too.
I never knew how dangerous life is. Think about it. Next time I go shopping a supermarket, I'll ask the manager what he's doing against terrorist threats and why there is so much open space in his market. I guess I'll feel much safer in an old-fashioned small corner shop.
Does anybody have that report as a PDF? We're in the middle of changing up our office space and I think if we move away from the open-plan I can get a window seat!
Remember that a Ryder truck packed with explosives as at the Oklahoma Federal Building was parked in front at the curb ... maybe the safest cubes are the ones furthest away from the street and on the higher floors. Then again, look at what occurred at New York's twin towers on 9/11. Hmmm ... safety vs. a view? maybe not.
Unfortunately I have first hand experience from earlier London bombs...
Problem is not always as obvious or extreme as you might think. I suspect every case is different. IME it takes a LOT of explosive at close range to make modern glass-cladding burst into shards like in the movies. Those panes are large & toughened and keep their shape until they hit something (heavy object, solid wall, ground...)
I suspect small private offices might actually make it worse for the 'lucky' occupants by the window.
If your building has old single-glazed untoughened glass you now have another reason for fitting more energy-efficient glazing!
Most "Modern" interior office wall construction is drywall on stamped metal 2x4's. If you don't hit the metal 2x4 you can punch your fist through both sides with one blow, warning it will hurt. Most of the cubicle walls I have seen are more substantial than that. It is true that you could be hurt by debris falling on you however as long as the top of the cube was taller than the top of your head I think that the cubical wall would stop more shrapenel from a blast. It would be nicer if MI5 would recomend a minimum number of square feet per person to avoid presenting attractive targets and so people could work in peace but I don't expect bussiness to listen to me or MI5
Have the cubicle wall panels built with a 2" wide compartment in the middle that can be filled with water once in place (and drained to move). Water absorbs the energy of blast and slows shrapnel as well. Probably makes the room quieter, too (during normal operations, not necessarily an attack).
For that matter, the military "tent city" chow halls overseas should have plastic water barrels stacked at intervals throughout to minimize the damage of a grenade rolled in through the door.
Why bomb a secure building?
Why not instead call in a bomb and see where everyone evacuates, then next week call in another and place a bomb in the unprotected area outside where they evacuate?
before cubicles there was nothing but an open floor plan with rows and colunms of desks.You can call the bosses,owners greedy uncaring swine and they may be.However giving even every 4-5 workersan office costs money,The more the cost of business goes up the less is availiable for employees.Building a better castle just means the bad guy has to study it more to take advantage of your safety features.Mi5,Dhl etc,have to say something or some one might say theyre not doing their job.No one is or can be completly safe and I for one will not hide or live in constant fear of a bunch of murdering swine.
> before cubicles there was nothing but an open floor plan with rows and colunms of desks.
Not true. Totally "open plan" came after cubicles and was such a disaster it was never really as popular. Before cubicles were introduced in the mid-1960s, most office workers had offices. Shared between 3 or 4 people for the lowest ranks, private from junior management on up. The main exception was the "typing pool", a dozen or so workers (invariably young women) seated more or less as you describe.
> However giving even every 4-5 workersan office costs money
Assuming you are starting off without walls and have to build them then, yes it does, initially, but it is a one-off cost that you won't need to pay again for decades, or centuries in some cases. That extra cost is tiny compared to a typical company's wage and salary costs, so with even quite small productivity gains private offices pay for themselves quickly. And it has been shown repeatedly that a modicum of privacy does improve productivity. Just how much depends on two factors:
a) How bad the open environment was to begin with; and
b) How complicated is the task being performed.
In the extreme case of highly complex tasks (e.g preparing legal briefs, computer programming, engineering design, scientific or statistical research, etc.) real world productivity gains of multiple hundreds of percent have been reported.
The bizarre thing is that so many managers continue to believe that cube farms or open plan offices IMPROVE productivity despite numerous studies showing it to be a myth, and consequently are still SPENDING money to tear out perfectly good walls.
Employee productivity is not the only factor involved. Open offices are also more vulnerable to fire (even simple plasterboard/drywall will dramatically slow the spread of fire), burglary and petty theft, and corporate espionage. And last but not least, air conditioning is cheaper to install, but more expensive to run.
> The more the cost of business goes up the less is availiable for employees.
This is the sort of barse-ackwards thinking that gives many bosses a bad name. Employees are not just a cost to the business, they are the revenue generators.
> Mi5,Dhl etc,have to say something or some one might say theyre not doing their job.
Again barse-ackwards: if they didn't say something, they wouldn't be doing their jobs, since NSAC, one of the 5 main divisions of MI5, precisely has the job of providing this sort of information. What you do with it is up to you, but it's useful to have someone generating hard data to help make decisions.
Schneier.com is a personal website. Opinions expressed are not necessarily those of BT.