The Most Common Security Mistakes
Most Museum Architects Make

By Steven R. Keller

So you've just received the bids for that new museum,
and the cost will be almost twice as much per square foot as estimated by the cost consultant. Don't you just hate it when that happens? Well, you could have done something about it. But things didn't work out like they should have and the numbers are too high. Brooding about it won't help and the figures won't rearrange themselves on that bid form. So it's back to the drawing board.

Where do you go from here? Well, you can look to see which systems came in substantially higher than first estimated and find out why. That's what most architects do. That's when you see that the security system came in triple the cost consultant's estimate. "Let's get that darn security consultant and tar and feather him," you say. As a security consultant, I hate it when that happens!

I provide security consulting and protection system design services to museums and historic restoration projects throughout North America, and time after time, the security system either comes in "high" or ends up being inadequate. The latter results from allowing someone unfamiliar with museum operations and security requirements to estimate and design the systems. Too often, when the burglar alarm is being designed, the drawings simply show very large empty rooms where gallery details will eventually be added by the exhibit designer. The local alarm company is called in or the electrical engineer, often unfamiliar with museum security operations, is asked to lay out a security system. Typically, one detector, often the one we refer to as the "Big Gray and Ugly" is programmed for use. After all, one high-powered microwave detector can cover a very large open gallery. Of course, when the gallery is subdivided, the detector is blocked and there will be no detection in the space. Or when the huge metal sculpture is installed, the detector, whose microwaves bounce off of metal, begins to false alarm.

The security system often comes in well over original budget estimates when it is properly designed. Cost consultants can't believe that museum security systems are three times their estimate. But a well-designed museum security system is usually over-designed to assure versatility for exhibit designers in an ever-changing environment. Even when the design is minimal, cost consultants simply do not understand that the formulas they use to estimate museum security systems are grossly inaccurate. The worst method of estimating a system is to call the local alarm company and ask them for a price. If they estimate high, you will go elsewhere. So they always estimate far too low.

Before we look more closely at specific security mistakes that architects make, it is important to understand that there are only three aspects to good museum security. Everything that we, who are in security, do works toward access control, parcel control, and internal security.

If we can control who comes and goes (employees, visitors, contractors), when they come and go (public hours, non-public hours, staff access hours, nighttime hours), where they go once inside (offices, galleries, high security storage mail rooms, etc.), what they bring in (razor blades and spray paint), what they take out (items from the collection and computer terminals) and if we can hire honest employees and keep them honest, we will achieve perfect museum security.

It is imperative that the architect design good security into the building. Once he or she has designed the building so that these three basic elements of good security cannot be achieved or can't be achieved economically, good security is impossible for the life of the building. For example , if you design the building so that access control is impossible to maintain economically, there might never be adequate security because museums usually can't afford basic operating expenses let alone the costs of extra security. Never is a long time when you consider that museum buildings are themselves works of art that will long outlive their designers.

Over the years, I have seen a number of "mistakes" that architects make to some degree in nearly every museum job. Let's take a look at some of them:

1. The security system is not extensive enough. A good museum security system needs to meet the requirements of the "Suggested Guidelines in Museum Security," published by the American Society for Industrial Security in Arlington, Virginia. To provide less protection is a serious mistake for the museum, as well as for the architect who may be criticized for this failure. Museum security systems need to be over-designed. The security system designer should provide enough detection so that "hanging walls" or display cases can be moved and detectors can be subsequently blocked without reducing overall protection.

There needs to be a defined security perimeter which can be secured when the motion detection is off. This is usually, but not always, the outer walls of the building, except where there is mixed use of space as in a college art center that houses a museum gallery or in a cultural center where the symphony and the museum share space. During periods that the cleaners or other staff are working when the museum is closed to the public, door, window and glass break detection can often assure continued security for the collection.

There needs to be motion detection, and it needs to be relatively extensive. Remember this: I would never break into a museum. I would enter during the day and stay behind at night and simply break out. Therefore, museums need extensive motion detection not only to detect a break-in, but also to detect a stay-behind.

The security system designer needs to fully understand how the building will function and design the building with sufficient alarm zones and sub-zones to enable after-hour activity to occur while collections are protected. Detection needs to annunciate point by point. Too many alarm systems are zoned with anywhere from a dozen to thirty or more detection devices on one zone. When any device is activated, a single common descriptor annunciates, making it impossible to determine exactly which detector is in alarm. This may be significant in locating an intruder or troubleshooting a false alarm. And when a single device fails and goes into continuous false alarm, it might be necessary to shunt the point until service can be obtained. When 30 detectors are on this troublesome zone, all thirty then need to be turned off until the problem is located and fixed, making large areas of the museum vulnerable.

2. Coat check facilities and retail sales areas are
too often inside the security perimeter rather than outside the perimeter. A perimeter must be established for security to be maintained. Anything and anybody moving through the perimeter must be controlled at all times. When a retail sales area is inside the perimeter, it is absolutely impossible to provide parcel control. Visitors will need to carry oversized parcels, such as reproductions, rolled prints or posters, or other purchases through and eventually out of the museum. Since guards are not, nor should they be, trained to make artistic decisions about whether something is a reproduction or an original, such a condition creates an opportunity for theft.

When coat room facilities are in the outer lobby, visitors can check coats and oversized parcels before moving through the perimeter checkpoint. But if the coat room is inside the perimeter and toward the core of the building, we can only pray that users are honest and don't wander off course when directed to check an item. Of course, if they were all honest, security wouldn't be needed. When coat and parcel rooms are inside the security perimeter, every parcel moving out of the building theoretically needs a parcel pass and a parcel search, an impossible task "politically," legally, and from a labor standpoint.

3. Coat and parcel facilities are often inadequate in size and facilities offered. Time and time again, I've seen architects take coat room facilities lightly, providing inadequate capacity.

But when coat rooms fill up, visitors are either turned away or allowed to carry their parcels inside. Since we know they won't be turned away, we have created a condition where they can carry parcels inside-- the single most serious problem for security personnel. Coat rooms must be designed for a worst-case situation with adequate umbrella racks, a variety of locker sizes, adequate shelving for storage of briefcases, suitcases, and packages, and special storage space for fur coats, cameras and other valuables. Ignoring the problem will not, I assure you, make it go away.

Another problem is the inability to secure a coat room each night. Not every visitor will remember to pick up personal property left in the coat room. And unless there is a way to secure the coat room after hours, property in the museum's care will disappear. But there is a more serious problem. Picture a museum with a lobby foyer, coat room, gift shop and public facilities like phones outside the security perimeter. The perimeter is located at the gallery end of the foyer lobby. Visitors come and go during public hours and never have to check parcels until they cross into the security perimeter and actually enter the museum. The lobby, coat room and gift shop are not "protected space." Most coat rooms have self-service lockers. During hours that the museum is not open to the public and the outer doors are locked, it is necessary to have a means to secure the lockers from use by employees and contractors who work inside the actual perimeter.

Picture this scenario. It is 8:30 AM and the museum is closed. It opens at 10:00 AM, and at that time the perimeter post is staffed by guards. Until then, no guard is required because no access or egress can be gained through the outer doors without causing an alarm. During this time, a cleaner, contractor, or employee working unattended galleries removes a valuable object from display, takes it to the coat room, and places it in a self-service locker. No guard is present at this hour to conduct a parcel search. Later, when the museum opens to the public, the thief returns from the outside and enters the now open public door. He or she goes to the coat room, removes the object from the locker and leaves without ever having to pass a guard. The object was carried through the perimeter before it was secured.

By providing a way to secure the coat room after hours and placing control of the coat room under the security department, this opportunity to steal can be eliminated. Lockable doors on the coat room are the answer.

4. Mail room facilities are almost always
inadequate. If you are a museum employee, how can you steal something and have virtually no chance of being detected? Mail the object to yourself. By placing the mail room inside the security perimeter, as is almost always done, employees can send mail to the mail room and not be required to account for it. Mail is never searched when it leaves the building and is rarely accounted for before it is sealed into the envelope.

In fact, mail moves in large bags which can be used to conceal objects that aren't even packaged in boxes or envelopes. Movement of mail is a serious risk in a museum.

If the mail room is located outside the perimeter, perhaps on the loading dock just outside the guard post, staff can be required to hand-carry mail in larger flats and packages unsealed through the perimeter and into the mail room. Business envelopes can be sealed and handled in the traditional way. All objects moving out through the perimeter, including mail in unsealed packages, should be inspected by the guard at the perimeter checkpoint. If a property pass would be required for the object to be hand-carried out of a building, it would also be required when the object is carried by the employee to the mail room.

5. The architect often fails to identify "special event" space and isolate it with security in mind. Museums survive on income from after-hour events. If a museum builds a new wing with a large space suitable for after-hour events, there should be an entrance door with full coat room, rest room, catering and access control facilities near the event space. It should be possible to isolate the space from the closed portions of the museum. To fail to provide for such facilities as a coat room or a security checkpoint will result in one of two things occurring. Either the visitors will not be required to check parcels when they arrive, thus breaching security; or they will be required to enter via another more remote door and walk through galleries not normally used for the after-hour event in order to reach the event location. This would then require that guards be assigned along the route and in galleries used for passage, which can substantially increase event costs and reduce event "profit" used to pay museum operating costs.

6. The wrong intrusion detectors are too often used for the application, or they are improperly installed. Walls are for hanging art and ceilings are, to many architects, almost sacred space in spite of the forest of hanging light cans and array of vents. So security detectors are too often selected for appearance or "mountability" rather than for performance. There is a temptation to use fewer detectors that cover larger areas. These are also the models most prone to false alarms in museums. Microwave detectors penetrate glass, walls and even metal elevator doors, false alarming when birds fly by or elevator cables move in the shaft. Single technology detectors cost less than dual technology detectors and are often selected to keep costs down. Unfortunately, the architect isn't the one who is called in several times each night to check out false burglar alarms in a dark museum.

Magnetic contacts are often used on glass doors as the only detection device. Simply breaking the glass will permit the burglar to climb through without setting off the alarm. Smoke detectors, rated by UL for mounting flat on a ceiling, are often side-mounted on walls or mounted in light cans to minimize their appearance. This reduces their sensitivity and voids UL listings.

Speaking of magnetic contacts, if you take nothing more away from this article, remember this: It is impossible to adequately install concealed door contact or card reader on a Herculite or other frameless glass door. But time and again I see frameless glass doors used in locations where national standards and insurers demand security.

7. Security control rooms are rarely large enough.
Guards have virtually no say in museum design, and there is often no one to speak up for their concerns. Space is at a premium and guards are usually situated in a small room better suited as a closet. As the realities of security grow, more and more security and fire equipment are placed in the "control room." Soon the room is full, and it is impossible for anyone to work in the space, let alone view CCTV monitors effectively. Security control rooms need to be ergonomically designed.

Another problem relating to the security control room is the failure to fully understand all that occurs here. This is probably the only space in the building that is never unstaffed. Every minute of every day it is occupied. Yet, it is often an unfinished space. I've seen numerous security control rooms, intended to house CCTV monitors and computer equipment, which had no drop ceiling for dust, noise and temperature control. I've seen several designed with no air conditioning, or no effort to balance the heat and air conditioning load to the heat-producing equipment that will be housed there. Phone line capacity is almost always inadequate for daily operations, let alone adequate to handle the crowd that gathers in a fire or emergency.

Since the security control room is one of the most important elements of the security system, thought must be given to its design and fortification. If the control room can be overtaken, the museum can be cleaned out by the criminal. Control rooms need to be highly secure with minimal windows to the exterior of the building, interior windows made of bullet resistant glazing, and sufficient security equipment provided to enable guards to do their jobs in a secure environment. Panic alarms, dip trays, secure parcel pass-throughs, mantraps, and other security elements are critical.

Since the appearance of this space is often the single most important psychological deterrent to a thief, as it mirrors the institution's image of security, it needs to be as attractive and professional as any other work space in the museum. Yet, all too often it is a hodgepodge of equipment, a tribute to the lack of coordination and planning by the architect.

8. Galleries are not designed to minimize security manpower requirements. Very often it is possible to reduce the number of guards that would be required to protect a space simply by carefully placing walls or adjusting sight lines. CCTV is often not used to its full advantage in reducing on-going, indeed annually escalating, security manpower costs.

Other important security points can be designed with security in mind, as well. The loading dock and employee entrance, both requiring a guard, can often be combined, reducing the need for one guard position. This is usually the location of the security control room. The museum switchboard can be located near, but not in, the security control room, and can be configured so that the operator backs up the security control operator by monitoring critical alarms. It is a mistake to combine the security control room with engineering and phone operations spaces, but there are advantages in locating them near one another.

9. Egress is critical to museum security.
It is necessary to guard all exits, including fire exits, to prevent someone from grabbing an object and running out the door. Often it is possible to design museums so that guard manpower can be reduced, but architects rarely design with this in mind.

10. Another problem often found in larger museums is the lack of thought given to crowd control space. It is important for the museum designer to understand the relationship and delicate balance between security, life safety, crowd control, and museum economics. Exhibit managers, especially for large, blockbuster type shows, want to crowd as many people through the exhibition as possible, and he or she is supported by the financial manager who knows that a specific number, say, 300 visitors per hour, is the average that must be met to break even on the costs of producing the exhibit. The Life Safety Officer wants to limit crowds to a safe level, and he or she is supported by the security manager who sees the relationship between crowds and crimes of opportunity. A well-designed exhibit space will provide for adjacent areas for crowd ticketing, staging, catalog sales, outfitting with audio tour equipment, and retail sales. Any good museum financial manager knows the advantages of staging or holding your visitors strategically in front of catalog sales desks or other "opportunities" to make a purchase. Visitors anxious to finally see the treasures will not stop in a moving line to buy a catalog or rent an audio tour wand, but they will make the purchase if they are held in front of the sales booths as part of the routine crowd flow plan. Exiting crowds should always exit through a retail space and be given an opportunity to make a purchase while they are still enthusiastic. How well the architect designs the space with future exhibits in mind will determine, in part, how financially stable the museum will operate during its entire life.

11. Another problem is inadequate space for the security operation. When a museum moves into a new building, it is often in a growth stage and is moving "upward." It will have more staff, more important exhibits, and more security problems in the new facility. But the architectural program prepared by the architect or planner often is based on the existing security operation, which probably is inadequate to begin with and will be even more inadequate in the new building. Because many of the aspects of a good security program are dictated by the "Suggested Guidelines in Museum Security" and are mandatory, not optional, the designer must provide for them in the space designated for security. Any reasonably sized museum, with thirty or more employees, volunteers, or others serving in an employee-like capacity, needs a security manager or supervisor, an ID card issuance program, a lock and key control program, and guards. This implies a space for security offices, which is private, secure, and suitable for a professional level employee, not a closet or afterthought space. ID cameras require space. Key storage space is extremely important and must be surprisingly large. Adequate uniform storage space is rarely ever provided, and absolutely necessary. Space is needed to store files, reports, forms, and spare equipment like disaster tools, flashlights, batteries, bolt cutters, first aid supplies, and spare parts for radios and other equipment. Lost and found items must be secured for over 30 days before being disposed of, and the volumes of items left in museums is often underestimated. Because the number of guards employed in a museum is usually seasonal and varies from special exhibit to special exhibit, both male and female guard locker rooms must be provided with an adequate supply of lockers to accommodate varying numbers of guards of both sexes, depending upon the ratio of male to fe male guards at any given time. Men obviously design guard locker rooms, because they almost always provide twice as many male lockers as female lockers. Other space required for security is a space for ongoing training, roll calls, meetings, etc.

Security is one department that continues to generate paperwork 24 hours per day, seven days per week. Yet administrative space is often inadequate. A medium-sized security operation requires everything that any other administrative offices require including computer hook-ups, adequate phone line capacity, intercoms, voice mail, furnishings, etc.

12. Even when a security consultant is on the job during the design phase, he is rarely consulted about door hardware. This task is left to the hardware consultant. The "Suggested Guidelines" address high security locks on collection storage rooms and the requirement that galleries have a means of being secured during installation or off hours. Keyways should be proprietary or restricted on all doors and display cases.

13.  Security systems in most medium to larger
buildings are simply computers on networks. All I have to do to defeat the system is interfere with the network. Any computer on the network is a portal into the network where viruses can be introduced. And since museum networks touch the internet, a denial of service attack initiated from any place in the world can easily bring down a security system in a museum. Computer networks serving security systems must be dedicated exclusively to security. Security systems may never share the building wide network.

14. The biggest, most unforgivable mistake occurs when the architect signs off on the building without having a thorough acceptance test conducted of the burglar alarm system. Until an error and omission suit sobers architects to the need for careful fine-tuning of the security system prior to acceptance, this will probably continue to be a problem. If a good security consultant is involved, he or she won't let this happen. We find this occurring most often when the second biggest mistake has been made-- the architect allowed the vendor to design the system.

Museum security is highly specialized. To design security for a museum project requires involvement by the museum's security consultant in the programming process. The security system designer must know how the building will work, i.e., how, when, and by whom it will be cleaned, for example. Since guards are often not rocket scientists, the alarm system must be user friendly, not so complicated as to require an MIT degree to operate. Since museums are rarely adequately funded after construction, a year's warranty and a year's optional service following the warranty must be specified as part of the construction specification. It will take a full year to get the bugs out of a museum security system due to the changing nature of the facility.

The security consultant must become involved in the early stages of design. He/she can be a real asset to the architect, explaining how security can be designed into the building in a way that makes the building more secure for less ongoing cost. A good consultant will have a “can do” attitude and will understand the aesthetic requirements of the architect. But he or she will also know when to draw the line on corner cutting that might jeopardize the collection and ultimately the reputation of the designer and museum director.

A museum security system is every bit as important and complicated as any other electrical and mechanical system, yet too often no real specification is provided. The importance of a good specification is even greater when government money is involved. Security, fire and life safety suffer from low bid requirements unless the spec is skillfully prepared. While the conduit system can go to bid as part of the electrical package, the security system should be bid selectively so that sensitive details of the alarm system don’t lie around in the Dodge Room, union hall or bidder’s offices.

Museum security systems must meet the requirements of Underwriters’ Laboratories and the “Suggested Guidelines for Museum Security” which some have called a de facto standard. Anyone who would allow security to be designed to a lesser standard must not fully understand the professional risk he or she is taking.

A good security consultant experienced in museum or cultural property security will be able to identify all of the issues He or she will produce a relatively accurate cost estimate early I the design process so there are fewer surprises later on. The result will be a museum that meets the first requirement of most museum mission statements—the ability to “preserve and Protect” its collections.


The author is a Principal of Steve Keller & Associates, Inc. Protected by Copyright All Rights Are Reserved.