Emergency Communications Management & The Clery Act Improvements in ECM/ENS Capabilities Recommended Implementation Strategies, Requirements, & Desirables Implications of the Clery Act Mobile “Killer Apps” Mark Katsouros, Director of Network Planning, Penn State mark1@psu.edu ACTI-CCM at EDUCAUSE Annual Conference 2012 www.educause.edu/acti 11/6/2012

Mark’s Background BS in Computer Science; post-graduate work in CS, EE, & telecom (all @ the University of Maryland, College Park) 22 years work experience @ UMCP in SW development, telecom, & technical management 5 years @ UIowa as TNS Director Almost 2 years @ PSU Extensive experience w/emergency management/notification (Designed, implemented, & supported UIowa’s Hawk Alert System; long history of providing IT support to campus police / 1st responders) ACTI-CCM at EDUCAUSE Annual Conference 2012 11/6/2012

Improvements in ECM/ENS Capabilities Within Last 2-3 years: (More-)Multi-modal (text, voice, email, RSS, social networking, etc.) GIS mapping Common Alerting Protocol (CAP) compliance Single dashboard, but variant messages (for each mode) ACTI-CCM at EDUCAUSE Annual Conference 2012 11/6/2012

Improvements in ECM/ENS Capabilities (cont’d.) More recently: Integrations, via CAP, Emergency Data eXchange Language (EDXL), RSS, etc. Sirens (Broadcast-capable) “Blue phones” Cisco VoIP phone broadcasting (via Singlewire) Digital signage Campus websites Campus-address-friendly support (for GIS mapping) ACTI-CCM at EDUCAUSE Annual Conference 2012 11/6/2012

Improvements in ECM/ENS Capabilities (cont’d.) More recently (cont’d): Single dashboard, single message templates (w/user-defined variable support) Tiered messaging (via prioritized group lists) Website integration ACTI-CCM at EDUCAUSE Annual Conference 2012 11/6/2012

Recommended Implementation Strategies, Requirements, & Desirables Emergency use only Pre-emergency-developed templates Text-to-speech (vs. recorded speech, but w/pre-recorded speech prefix) Opt-out (vs. opt-in) for all relevant modes Weekly testing (by individual users) ACTI-CCM at EDUCAUSE Annual Conference 2012 11/6/2012

Recommended implementation strategies (cont’d): Recommended Implementation Strategies, Requirements, & Desirables (cont’d.) Recommended implementation strategies (cont’d): Branding (so service name not tied to backend) Leveraging the enterprise directory to automatically create groups, ensuring things are up to date & eliminating an otherwise hideous maintenance burden ACTI-CCM at EDUCAUSE Annual Conference 2012 11/6/2012

Recommended implementation strategies (cont’d): Recommended Implementation Strategies, Requirements, & Desirables (cont’d.) Recommended implementation strategies (cont’d): Being cognizant of the methods by which hosted solutions prioritize message delivery. (Could affect frequency & ordering of critical messages.) Not adding parents to the notification contacts, as they could detrimentally affect your infrastructure during a crises, ultimately hindering notification delivery. ACTI-CCM at EDUCAUSE Annual Conference 2012 11/6/2012

Recommended implementation strategies (cont’d): Recommended Implementation Strategies, Requirements, & Desirables (cont’d.) Recommended implementation strategies (cont’d): Testing regularly by all users. (It’s the only way they’ll be prepared in a real crisis.) Training regularly in order to keep skills fresh, system changes adequately conveyed, & new users up to speed. (Suggest classes 2 to 3 times a year.) Designing, implementing, & operating in a partnership between executive campus leadership, campus police, UR, & IT! ACTI-CCM at EDUCAUSE Annual Conference 2012 11/6/2012

Recommended requirements: Recommended Implementation Strategies, Requirements, & Desirables (cont’d.) Recommended requirements: Multimodal notifications – Voice calls, text messages (SMS/SMPP), email, RSS, & social networking. Hosted (no local hardware). High calling capacity w/a geo-dispersed communications infrastructure. Web-accessible (for notification initiators). Electronic notification templates. Prerecorded, text-to-speech, & “blended” (combined) notification phrases. ACTI-CCM at EDUCAUSE Annual Conference 2012 11/6/2012

Recommended requirements (cont’d): Recommended Implementation Strategies, Requirements, & Desirables (cont’d.) Recommended requirements (cont’d): Ability to throttle calls based on NPA/NXX. GIS mapping. Customizable branding. Group support (campus, departments, buildings, etc). Customizable Caller ID. Backend data transfer automation (either real-time-transaction- or batch-based). Segmentation of system so as to be able to provide different notifying constituents w/separate contacts, templates, etc. ACTI-CCM at EDUCAUSE Annual Conference 2012 11/6/2012

Recommended desirables: Recommended Implementation Strategies, Requirements, & Desirables (cont’d.) Recommended desirables: Tiered logic Some of the following scenarios may be mutually exclusive, some may work in combination.  The main idea is to provide a level of intelligence to the notification logic that optimizes resource utilization while maximizing notification effectiveness.  This can best be done by recognizing both infrastructure constraints (i.e., enterprise landline trunks) & the diversity of individual circumstances/preferences (cell coverage issues, personal communication preferences, work schedules, etc). <Tiered logic scenarios on subsequent pages.> ACTI-CCM at EDUCAUSE Annual Conference 2012 11/6/2012

Recommended desirables (cont’d): Recommended Implementation Strategies, Requirements, & Desirables (cont’d.) Recommended desirables (cont’d): Scenario 1: Desk phones only for those who can’t be reached by cell (or IP broadcasting) – Because calling many campus (Centrex) phones in a small window of time can be problematic & stress local infrastructure (or, w/throttling, simply take an unreasonable amount of time to complete), there is a need to minimize the number of local phones being called. Mobile phones can obviously greatly offset the need to reach desk phones (especially given the mobility of our community), but the problem is that there are some significant pockets of low-to-no cell coverage on campus, such as in basements, or certain buildings in general. So, when we have both a mobile & desk/work phone number for a person, it would probably make the most sense to 1st attempt to contact the person’s cell, & only try the desk/work phone if no live delivery could be made via cell. This tiered logic would ensure that we’re utilizing the local landline infrastructure as effectively as possible. ACTI-CCM at EDUCAUSE Annual Conference 2012 11/6/2012

Recommended desirables (cont’d): Recommended Implementation Strategies, Requirements, & Desirables (cont’d.) Recommended desirables (cont’d): Scenario 2: Multi-pass – It would be desirable to ensure that a distributed 1st tier of folks (1st responders, main department contacts, etc.) are contacted initially, followed by everyone else. The idea is to maximize word of mouth, which is most effective when the initial receivers are equally distributed. Scenario 3: Non-medium-specific communication preferences – Allow for any 1 endpoint to be specified as “primary,” regardless of whether a phone number, SMS or e-mail address, etc. Scenario 4: Time-of-day preferences – Allow the preferences above to be specified based on time of day (& day of week). ACTI-CCM at EDUCAUSE Annual Conference 2012 11/6/2012

Recommended desirables (cont’d): Recommended Implementation Strategies, Requirements, & Desirables (cont’d.) Recommended desirables (cont’d): Additional modes – “Sirens”/Loudspeakers, network pop-ups, video/CATV (NTSC, digital, & IP), instant messaging, fire panel alarms w/voice enunciation, digital signage (including changeable message signs on roads), 2-way radio, UC, etc. (User-definable) Notification variable support (e.g., “location”), including speech phrase variables (in order to be able to reuse speech phrases, such as “This is PSU Police Chief Tyrone Parham. Please listen to this important PSU Alert”). CAP and/or EDXL compliance. ACTI-CCM at EDUCAUSE Annual Conference 2012 11/6/2012

Recommended desirables (cont’d): Recommended Implementation Strategies, Requirements, & Desirables (cont’d.) Recommended desirables (cont’d): Access to service management portal using federated credentials. Universities are typically members of the InCommon Federation; providing a Shibboleth login solution is desirable. Other federation solutions may also be acceptable. National EAS compatibility. Presence support (i.e., UC/OCS/Zimbra integration) towards an even-smarter tiered-logic approach. Campus address (building vs. street) support (in terms of GIS mapping). Unlimited-usage (vs. pay-per-message) cost model. ACTI-CCM at EDUCAUSE Annual Conference 2012 11/6/2012

The Clery Act1 Federal law enacted 1990 (subsequently amended in 1992, 1998, & 2000), following the murder & sexual assault of Jeanne Clery, a freshman at Lehigh University, & the discovery that campus had not been apprised of 38 violent crimes on campus in the 3 years preceding that attack. Applies to all institutions receiving Federal Title IV student financial aid funds (e.g., virtually all of higher ed) The Department of Education is charged w/enforcement Penalties include fines of $27,500/incident, & may even include revocation of institutional permission to participate in all federal student financial aid programs Clery Act Handbook available from Department of Education at http://www.ed.gov/admins/lead/safety/handbook.pdf Why is this relevant here? The Clery Act includes a "timely warning" provision for specific enumerated crimes. 1 - “Clery Act” slides liberally borrowed from Dr. Joe St Sauver’s “Mass Real Time Emergency Notification” presentation at a recent Internet2 Member Meeting, w/his kind permission. ACTI-CCM at EDUCAUSE Annual Conference 2012 11/6/2012

Timely Warning: 34cfr668.46(e) (1) An institution must, in a manner that is timely & will aid in the prevention of similar crimes, report to the campus community on crimes that are-- (i) Described in paragraph (c)(1) & (3) of this section; (ii) Reported to campus security authorities as identified under the institution's statement of current campus policies pursuant to paragraph (b)(2) of this section or local police agencies; & (iii) Considered by the institution to represent a threat to students & employees. (2) An institution is not required to provide a timely warning w/respect to crimes reported to a pastoral or professional counselor. [emphasis added to the above] ACTI-CCM at EDUCAUSE Annual Conference 2012 11/6/2012

Section c(1) Reportable Crimes (i) Criminal homicide: (A) Murder & nonnegligent manslaughter. (B) Negligent manslaughter. (ii) Sex offenses: (A) Forcible sex offenses. (B) Nonforcible sex offenses. (iii) Robbery. (iv) Aggravated assault. (v) Burglary. (vi) Motor vehicle theft. (vii) Arson. (viii) (A) Arrests for liquor law violations, drug law violations, & illegal weapons possession. (B) [as (A), except referred for campus disciplinary action] ACTI-CCM at EDUCAUSE Annual Conference 2012 11/6/2012

Section c(3) Reportable Crimes Reported crimes if a hate crime. An institution must report, by category of prejudice, any crime it reports pursuant to paragraphs (c)(1)(i) through (vii) of this section, & any other crime involving bodily injury reported to local police agencies or to a campus security authority, that manifest evidence that the victim was intentionally selected because of the victim's actual or perceived race, gender, religion, sexual orientation, ethnicity, or disability. ACTI-CCM at EDUCAUSE Annual Conference 2012 11/6/2012

Some Clery Act Questions Quoting from PDF pages 75-76 of the ED Clery Act Handbook, "By now you are probably asking, "What do you mean by 'timely'?" & "How do you expect me to alert everyone?" Neither the Clery Act nor ED define "timely." The warning should be issued as soon as the pertinent information is available because the intent of a timely warning is to alert the campus community of continuing threats especially concerning safety, thereby enabling community members to protect themselves. [emphasis added] "Although the format for the warning has not been mandated, the notice must be timely & reasonably likely to reach the entire campus community & aid in the prevention of similar crimes. Therefore, timely warnings must be issued in a manner that gets the word out quickly communitywide. They may be e-mailed, posted around campus, or otherwise distributed according to your institution’s policy. A combination of dissemination methods may be used. Timely warnings may not be issued in a manner or posted in a location that requires the campus community to make requests for them or to search for them. The responsibility for the warning rests solely w/the institution." ACTI-CCM at EDUCAUSE Annual Conference 2012 11/6/2012

Lessons Learned at Penn State An ED statement announcing an investigation into Penn State's handling of the Sandusky case mentions both the annual reporting & timely warning requirements. The investigation also reported “a lack of awareness of child abuse issues, the Clery Act, & whistle-blower policies & protections.” ACTI-CCM at EDUCAUSE Annual Conference 2012 11/6/2012

Lessons Learned at Penn State (cont’d.) Awareness training & clear reporting policies are critical. (Almost all of us are mandatory reporters.) A handful of universities have been fined under the Clery Act since its inception: Virginia Tech (2007 rampage) Eastern Michigan University (Laura Dickinson murder, 2006) Salem International University (2005 annual report) Mount St. Clare College / Ashford University (2000 annual report) ACTI-CCM at EDUCAUSE Annual Conference 2012 11/6/2012

Lessons Learned at Penn State (cont’d.) In the past five years, the ED has ramped up Clery Act enforcement. It now has a staff dedicated solely to conducting investigations. It also has partnered w/the FBI to audit a random sample of universities, a practice that has revealed widespread problems w/crime data reporting & a lack of policies to ensure compliance. ACTI-CCM at EDUCAUSE Annual Conference 2012 11/6/2012

Free Mobile “Killer Apps” Everyone Should Have Emerg. Radio Free ACTI-CCM at EDUCAUSE Annual Conference 2012 11/6/2012

Free Mobile “Killer Apps” Everyone Should Have (cont’d.) ACTI-CCM at EDUCAUSE Annual Conference 2012 11/6/2012

Free Mobile “Killer Apps” Everyone Should Have (cont’d.) ACTI-CCM at EDUCAUSE Annual Conference 2012 11/6/2012

Free Mobile “Killer Apps” Everyone Should Have (cont’d.) ACTI-CCM at EDUCAUSE Annual Conference 2012 11/6/2012

Free Mobile “Killer Apps” Everyone Should Have (cont’d.) ACTI-CCM at EDUCAUSE Annual Conference 2012 11/6/2012

Free Mobile “Killer Apps” Everyone Should Have Mobile Alert ACTI-CCM at EDUCAUSE Annual Conference 2012 11/6/2012

Q&A Thank you! ACTI-CCM at EDUCAUSE Annual Conference 2012 11/6/2012