Schneier on Security
A blog covering security and security technology.
« Is the U.S. Government Recording and Saving All Domestic Telephone Calls? |
| Reidentifying Anonymous Data »
May 8, 2013
Evacuation Alerts at the Airport
Last week, an employee error caused the monitors at LAX to display a building evacuation order:
At a little before 9:47 p.m., the message read: "An emergency has been declared in the terminal. Please evacuate." An airport police source said officers responded to the scene at the Tom Bradley International Terminal, believing the system had been hacked. But an airport spokeswoman said it was an honest mistake.
I think the real news has nothing to do with how susceptible those systems are to hacking. It's this line:
Castles said there were no reports of passengers evacuating the terminal and the problem was fixed within about 10 minutes.
So now we know: building evacuation announcements on computer screens are ineffective.
She said airport officials are looking into ways to ensure a similar problem does not occur again.
That probably means that they're going to make sure an erroneous evacuation message doesn't appear on the computer screens again, not that everyone doesn't ignore the evacuation message when there is an actual emergency.
Posted on May 8, 2013 at 6:32 AM
• 35 Comments
To receive these entries once a month by e-mail, sign up for the Crypto-Gram Newsletter.
Not just on computer screens. I've been in London Gatwick when the fire alarm went off. There was a repeated audio announcement to the effect of "Please evacuate the building", and hundreds of people stood around looking at each other. I didn't see anyone else start following the signs to the emergency exits. (I think it must have been a false alarm, because when I found one by a gate the person on the gate had no idea that the alarm had gone off).
Well, maybe it's not quite as bad as your post suggests. Presumably if there is a genuine evacuation then there are also audio alerts saying "oi, hop it". Maybe the take-away message for the airport is that it should completely disable the display of evacuation orders on the monitors, since they don't actually do anything.
I would have thought that making all monitors go blank (so people were under no illusion that the airport was "still working") and giving an audio message would be more effective.
Or (especially if worried about deaf customers), maybe the to-do item is to ensure that evacuation orders on the monitors are displayed if and only if audio messages sound. Bonus points for signs to nearest exit, I guess.
That's simply on par with a lot of other things people usually ignore: fire alarms, "do not cross here" signs, "that file may be infected" message from the AV. And the list is long.
If people were to follow the instruction, there would be some degree of inconvenience. And the only thing this proves is that people put their convenience above their own safety.
Quite simple, people behaving rationally using Bayesian statistics:
P(Emergency | Alarm goes off)
P(Alarm goes off | Emergency) * P(Emergency) / P(Alarm goes off)
P(Alarm goes off | Emergency) ~ 1
So, P(Emergency | Alarm goes off)
Btw, in a real emergency, there will be much more signs than just "Alarm goes off" and there will be ample time to evacuate after these other signs have been seen.
Must remember not to use angle bracket
P(Emergency) much, much less than P(Alarm goes off)
P(Emergency | Alarm goes off) much, much less than 1
In the event of a real and serious emergency it is quite possible that some of the warning systems, such as the audio channel, might not work.
It is prudent for the airport operator to broadcast a warning on as many channels as they can.
It is prudent for passengers to take heed if they see a warning message on any of those channels.
What probably happened here was that the tannoy continued to give out routine announcements and so the passengers concluded that the video display was in error.
If I'd been there then I would have been leaving the building very quickly, but then I'm not normal.
This is just a test, if there had been a real emergency, there would have been panic and chaos.
The number of false positives alarms in airports is so big that nobody takes them seriously anymore, and for good reason.
When there is an urgent TSA message broadcast every 5 min to the entire terminal to hang on to your luggage and report suspected terrorists how would you expect anyone to react to airport warning messages?
They are all to be ignored.
Yeah, how likely is it that a computerized announcement system has a bug, compared to a real emergency that shows NO other evidence? (no smoke, no flames, no loud explosions, no screams, no security people running around, no giant suckered tentacles covering the terminal windows)
Haven't we all seen displays at airports/businesses that show a "Blue screen of death" or similar, until someone gets around to rebooting them?
Wait, giant suckered tentacles covering the terminal windows are an emergency? I thought they were the calamari platter at SLC.
One generally doesn't take extraordinary action without confirmation that it's necessary. Evacuation is extraordinary. In a place with many channels of communication (displays, alarms, recorded announcements, actual humans in uniform) an automated alarm on just a single channel is almost certainly a mistake. If it was a real alarm it would appear on multiple channels, including said humans in uniform.
Put in more techie terms, you have redundant sensors, only one of which is reporting a problem. What's more likely, that the one sensor is wrong or that all the rest are?
I was in the departure lounge at Knock airport a week ago when the fire bell went off. Nobody, including myself, evacuated. I didn't because: high probability of false alarm; no visible sign of smoke or flames; no airport employees evacuating or encouraging others to evacuate; the possible great inconvenience of trying to get back to the departure lounge after leaving via unorthodox route and thus missing flight. I did however take careful note of fire exit locations, including ones that I could tell led quickly outdoors.
I remember all the times that the fire alarm went off when I was in school. It was always a drill, and there was always an actual adult authority figure telling us where to go and what to do.
It does not surprise me that, seeing just a message on a monitor, the vast majority of people assume that it is a drill, and wait for an adult authority figure to tell them what to do next rather than run for the exits. That's how we've been taught to behave since we were tiny sprouts, after all. If there were actual signs of fire, smoke, or terrorist attack that strategy would be immediately discarded, but it's a strategy that has served us well for untold hundreds of evacuation drills over our lives, so why change it just because it's an airport and not a school or office building?
Deaf people use airports too.
They were lucky someone didn't mistakenly evacuate through a door onto the tarmac. Then they would have had a "real" incident on their hands. This would have led to mandatory evacuation of the terminal, searches for bombs or what have you, and the arrest of the hapless traveler following instructions.
"on the tannoy".
Is it the British Invasion again this week, Bruce? :-)
> It is prudent for the airport operator to broadcast a warning on as many channels as they can.
And indeed, this is consonant with the current understood best practices in the emergency management community: the more warnings that end-users get, though disjoint channels, the higher confidence and priority they give to the warning; it's a built in false-alarm filter.
So when you have a real alert, you give it to *everyone*; EAS, NWS, local radio and TV, newspapers (in this age of Twitter); put it on your own FB and twitter feeds. When people see it twice, they snap to attention; when they see it a third time, *then* they start running.
dermouse *@ McGill*? You're around here these days? :-)
@dragonfrog: Er, yes. See the last paragraph of my post.
Some of these comments seem very complacent to me. Particularly @Winter: "Btw, in a real emergency, there will be much more signs than just "Alarm goes off" and there will be ample time to evacuate after these other signs have been seen."
Fires can spread very quickly and in some circumstances, seconds can really count.
@Eugeniu Patrascu: You said it best -- there are so many false alarms these days, and they're all around us. ESPECIALLY at airports. Between the near-incessant pre-recorded security warnings to all of the overly-alarmed doors which seem to go off if a fly lands on them.
Now we have the gov't forcing alerts onto mobile phones in the USA. Not to be heartless, but when I'm in the middle of sleeping at 3am, I don't want to be awakened by an Amber Alert.
More importantly, I question all of these evacuations/lockdowns which are so strongly favoured by government types these days. In my book, evacuations should almost NEVER happen. They're disruptive, but more importantly, they're dangerous. If people panic, bad things happen. Even worse in the airport scenario, I'm taking people from a controlled (can't call it secure with the TSA in charge) indoor environment and am dumping everyone out onto the uncontrolled outdoor environment. Large masses of people standing out in front of the airport like sitting ducks.
One of my clients is a conference/entertainment venue. I was originally brought in after a contractor left the job unfinished. I ended up working on some of the life-safety systems of the building, modifying them to meet the venue's needs. Some of these modifications are in direct violation of fire/life-safety codes, but after much deliberation and debate, including researching why these provisions exist in the code, we feel safer with the changes. As I've now been working with the venue for over 12 years, I believe even more strongly that "EVACUATE!!!!" is the WRONG answer for most incidents, especially when you've got 10,000+ people to take care of. If anything, isolate and contain rather than evacuate is the right answer, at least for low-rise buildings, such as airports. Thinking over all of the bad things which have happened to airport buildings in recent years (tornadoes, bombings, earthquakes, tsunamis), the buildings were only affected in small areas. As such, it makes no sense to do the terminal dumps we so frequently see the TSA doing.
Case in point: This particular venue's refrigeration/chiller systems run on ammonia gas. As it stands now, if there's an ammonia leak, the fire alarm goes off with the "EVACUATE!!!!!" message (which, by code, can't be shut off except by the fire department when they finally show up). BUT one major set of exit doors is right next to the chiller plant's exhaust ducts, so if there was an ammonia leak, we'd be sending a few thousand people straight into the path of it. As a result, during events, we've got the systems set to notify the security office first and give the security office 10 seconds to respond/cancel the signal before it sounds the alarm throughout the whole building. If multiple sensors are triggered, it'll sound immediately. Similarly, I've also installed a microphone & mute button in the security office so that proper instructions can be given. I can't count the number of times we've had the fire alarm go off due to someone leaving a shower running. Should I try to evacuate 10,000+ people, including many elderly, every time? Absolutely not. People becoming complacent is far more dangerous.
The default evacuation message for applications like this should refer to Zombies, so that people know not to panic about mistaken announcements.
But yes, Captain Obvious, the constant TSA announcements aren't effective at getting people to pay attention to baggage; their intent is to maintain a culture of fear and dependence.
I have heard loud sirens and heard those same words several times over the PA system at LAX, and nobody even pays the slightest attention. The first time, I was actually a bit concerned. Now I ignore it like everybody else.
This happened to me a while ago IN MY OWN HOUSE!
In the wee hours of the night my smoke detector went off. The "correct" thing to do is to roll out of bed onto the floor, and then GTFO keeping as low as possible to avoid the smoke. What actually happened was I sat bolt upright in bed and then stood up to see what was wrong with the detector. My house actually being on fire never occurred to me.
I also learned that night that the screaming smoke detector will NOT wake up a 12-year-old.
In addition to several other remarks made on the human psyche, most people tend to not act or react on any message that is overly broad.
"An emergency has been declared in the terminal. Please evacuate."
1) Which emergency ? I don't see any.
2) Evacuate ? What exactly is it I am supposed to do ? Where do I go ?
Displaying a blinking pink elephant would probably have had exactly the same effect.
Good point on the overly broad message.
There's a bomb in a bagpack located under the first chair on the right hand side of the second row at gate 15...save yourselves!...
..will surely overcome the reptillian fight or flight mechanism in favor of the latter.
Just leave a note on that chair in braille (blind people use the airport too)
@Clueless Noob: I wish someone would invent a smoke detector whose low battery alarm WOULDN'T go off unless it was light inside the room. I can't count the number of times I've been awakened at 3am due to a smoke detector with a low battery. Similarly, I'm not sure why the cheap ionization smoke alarms are allowed in residential buildings. I've never had a photoelectric smoke detector go off randomly. Falsely? yes, but smoke machines make smoke, and I'm not going to fault the detector for that. Same for when the contractors were cutting concrete last week. I can see why the sensor would think that was smoke. But the ionization units do seem to have a very high false alarm rate.
@Dirk Praet: Your point is a very valid one, which is why I intentionally go against modern life-safety codes which assume that blindly evacuating the building is the best option every time. I've also found people tend to listen to real human announcements vs. automated recordings. Yes, the live person at the microphone may not have a professional voice or annunciate well, but the meaning gets through, particularly if there's an urgency in the person's voice due to the circumstances.
It's much like the tornado warning sirens/weather radios. I have a weather radio feed into the PBX at my office, so the phones beep and their screens show the nature of the alarm. (SEVERE THUNDER or TORNADO) What's the first thing people here do when the tornado sirens go off? Why, go outside and look for the tornado of course!
I like the blinking pink elephant idea. Something non-threatening. :) A few of my friends are severe weather buffs and we've jokingly started calling large hurricanes "Fluffies", usually as a response to how over-hyped the US media. It's hard to find something called Fluffy threatening.
So, children, if you're ready, tonight's story is an old classic. It's called 'The Government that Cried Wolf.' See if you can guess how it ends.
At my last uni I taught a Monday only class. It was policy to go on "lockdown" in safe spaces whenever a tornado warning was issued, which in my last year seemed to be 6 Mondays out of the spring semester. It got to the point that when the alarm sounded the students left en-mass for the carparks if they had cars or for the nearest pubs if they did not, on order to avoid being imprisoned until the "all-clear".
Like several above, when in an airport I know that I am in close proximity to "secure" areas that where I will be in grave trouble should I be found to be trespassing. I am will not be to be the first person to push the crash-bar on the alarmed door, not without something more than a text on a video-screen,
Personally, I'm grateful for the fact that most herdman beings are moth-drawn to cities, airports, large-scale sporting and entertainment events, etc.
It renders at least a portion of the planet relatively safe, much quieter and generally enjoyable. By all means, continue to clump.
It seems humans are good at filtering false alarms.
After all the important thing is the possibility to escape safely when necessary.
Sometimes a special signal is good, this post about Sydney traffic signs is quite interesting:
We used to have a lot of fire drills at my old work building but they would never tell us beforehand, or they would only tell our managers. I always thought this was very stupid because it made a lot less people believe the alarm. It would have been better to have never had fire drills so that more than 50% of the people would evacuate in case of a fire. This is something I would expect someone with no training at all to think about.
Some time ago I was sitting at one of the gates at JFK, when the fire alarm went off.
It was a very strange situation, strobes flashing, alarms beeping, and no one reacting in any way. The alarm was on for at least 10 minutes, but there was no airport security around, TSA did not do anything, and no announcement.
I spent the time thinking about the Innovation department store fire in Belgium, the fire spread so rapidly that many people in a restaurant died in their chairs, because they did not even have enough time to get up when the smoke wave rolled in.
I could have left the terminal through the emergency exit, but that probably would have gotten me arrested immediately.
I assume it would have cost me a lot of money to defend myself in court, and the prosecution would have argued that all the reasonable persons did not leave, and that my behavior, leaving a potentially burning building, was highly disruptive to the airport operation.
Strange world, when you have to be afraid to run away.
Here is an interesting video: Why Seconds Count:
Smoke appeared at 1:20, at 2:30 everyone in the room would have been dead. A photoelectric smoke detector would have gone off some time after 1:20, ionization smoke detectors react to the finer particles created by the earlier flames, but they take a bit longer to go off. In any case, there is very little time to escape.
Schneier.com is a personal website. Opinions expressed are not necessarily those of Co3 Systems, Inc..