Shopping Malls: Are They Prepared to Prevent and Respond to Attack?
The shootings in an Omaha shopping mall in December 2007 brought home, once again, what security experts have known for decades:
retail malls are "soft targets." Based on surveys of private mall security directors and State homeland security officials,
researchers reported in 2006 that U.S. retail malls had received "too little attention" from security officials as potential
sites for terrorist and other attacks.
An Assessment of the Preparedness of Large Retail Malls to Prevent and Respond to Terrorist Attack, a study funded by the National Institute of Justice, was based on data from the 3-1/2 years after the 9/11 terrorist attacks.
It was performed by the Police Foundation, the Vera Institute of Justice, ASIS International, the Midwest Research Institute,
Eastern Kentucky University, and Carleton University.
The researchers noted that it is the very nature of retail malls that makes them vulnerable: Large numbers of people, many
carrying sizeable parcels, come and go through multiple entrances and exits, making it easy for a shooter to blend in with
the crowds. Overseas, open-air street markets—the world's original malls—have similar risk factors. And natural disasters,
such as fires, tornados, and earthquakes, pose many of the same security issues for malls. But regardless of the event—natural
disaster or attack via automatic weapon, bomb, or chemical or biological agent—casualties in malls can be high. The December
5 shooting at Omaha's Westroads Mall left nine dead and five injured.
In our research, Christopher Ortiz, Robert Rowe, Joseph Broz, George Rigakos, Pam Collins, and I examined the state of private
security in U.S. shopping malls in the post-9/11 world. We found significant gaps in the emergency preparedness of malls:
- Very little money has been spent to upgrade security since 9/11.
- Training of mall security staff on preventing and responding to attacks remains inadequate.
- Hiring standards for prospective security officers have not changed substantially since 9/11.
- Risk assessments are rare, and emergency management plans are frequently developed without the input or participation of first
There are several steps that could be taken to be better equipped for all emergency situations, whether terrorist attack,
mass shooting and other violent acts, or natural disaster. State homeland security officials, local police, and mall owners
and tenants all have roles to play in protecting the Nation's malls.
How the Study Was Conducted
My colleagues and I examined whether malls have become better prepared to respond to incidents since terrorists attacked the
World Trade Center and the Pentagon on 9/11. Our investigation—designed to go beyond earlier surveys on mall security—consisted
of four parts:
- Survey of State homeland security advisors. The U.S. Department of Homeland Security distributed a written survey to homeland security advisors in the 50 States and
Puerto Rico. We received 33 responses, representing good dispersion across the country.
- Survey of mall security directors. Written surveys were sent to 1,371 security directors of the Nation's largest indoor retail malls; 120 completed surveys were
returned. Although only 9 percent responded, there was no significant difference in response rates by mall size or geographic
- State-by-State analysis of legislation. We analyzed State laws that regulate the hiring and training of private security workers in the 50 States and the District
of Columbia to determine whether statutes changed post-9/11.
- Site visits. We visited eight malls across the United States and two malls in Israel.
The discussion in this article is based on the two surveys and the legislative analysis. See U.S. Site Visits Confirm Lack of Preparedness, for a discussion of the domestic site visits.
Levels of Mall Preparedness
We asked the State homeland security advisors to characterize the level of preparedness of large malls in their States: Of
the 33 who responded, 31 percent said "poor," 24 percent said "fair," 27 percent said "good," and 18 percent said "very good."
The most frequently cited reasons for the "poor" rating were inadequate training and equipment, or the opinion that private
mall security would be irrelevant during an attack because the responsibility for response would fall to law enforcement.
When asked how retail malls could better prepare, nearly half (15) of the security advisors endorsed improved training for
security staff and emergency responders.
The need for better training was also cited by the mall security directors. Fifty-two percent of the 120 who responded said
that their employees received special training on preventing and responding to terrorism; however, 50 percent also said that
their mall's antiterrorism training was inadequate.
Analysis of State Laws
In our analysis of State laws—which was performed approximately 3-1/2 years after 9/11—we found that although 22 States had
mandated a minimum number of hours of general training for private security officers, no State had mandated specific training
on preventing or responding to terrorism.
Our legislative analysis also revealed that, at that time, two-thirds of States required some level of background investigation
for prospective security officers, most commonly a criminal history check. Nearly all mall security directors said they required
criminal background checks. Slightly more than half (65 directors) responded that they also required drug tests.
Notably, we found that few hiring standards had changed in response to the 9/11 terrorist attacks: only 6 percent of the 120
mall security directors who responded to the survey said hiring standards were made more stringent, and just one in 10 said
they required additional background verification.
Our research indicated, however, that many malls had made operational changes to improve security after 9/11. Sixty-three
percent of the 120 mall security directors reported, for example, that patrol and surveillance strategies were modified post-9/11,
with the most frequently reported change being the increase in security officer visibility.
Sixty of the security directors said their malls had a closed-circuit television system, the large majority of which (81 percent)
were used to monitor events in real time (as opposed to taping for later review, if necessary). Thirty percent of the malls
had passive barriers, or bollards, to prevent vehicles from breaching the entrance. Nearly half (49 percent) reported that
their staff were instructed to be on the lookout for unusual behavior or dress of mall clients, including generally suspicious
activity such as taking photos or notes of the facilities, suspicious (such as extra-bulky) clothing, and large or unusual
Nearly three-quarters (73 percent) of the security directors reported that they had protocols for security staff to follow
in the event of a disaster. The same proportion reported that these plans included coordinating and communicating with local
law enforcement, fire, and medical first responders.
But our research revealed little cooperation in rehearsing emergency response. Only 30 percent of mall security directors
held exercises to rehearse emergency protocols with first responders. Fifteen of the State homeland security advisors said
they were aware of joint exercises between private security staff in some malls and local police. Only 13 of the State officials
were aware of joint exercises between mall security staff and fire or EMT professionals.
More State Involvement Sought
The 120 mall security directors reported a low level of support from their State homeland security office in working to improve
security. Only 3 percent characterized their State advisor as "very involved" in planning, reviewing, or approving mall security
measures. Seventy-eight percent reported that their State security advisor was "not at all involved."
The mall security directors did, however, report that local law enforcement agencies were significantly more involved in mall
preparedness than were their State homeland security advisors. Two-thirds characterized their local police as being "somewhat
involved" in their security planning. Slightly more than one-third (36 percent) reported that their relationship with local
law enforcement had become closer since 9/11.
The majority (63 percent) of security directors said they would welcome more involvement by State homeland security offices
and local police, including:
- Sharing more key intelligence (40 percent).
- Conducting risk assessments or developing emergency management plans (33 percent).
- Helping to train security officers (27 percent).
When asked to identify the biggest impediment to improved mall security, the majority of the State homeland security advisors
cited cost and lack of funding. Only 16 percent of the mall security directors said that their budgets had increased beyond
the rate of inflation since 2001.
How Can Malls Better Prepare?
Private mall security directors and State homeland security officials could take some steps to improve emergency preparedness.
Our recommendations include:
- Conducting a formal risk assessment by experts.
- Curtailing access to air circulation systems and other sensitive areas.
- Monitoring deliveries.
- Using passive barriers to prevent cars with explosives from penetrating heavily populated areas.
- Developing and rehearsing detailed and coordinated emergency response plans in coordination with first responders and mall
- Standardizing antiterrorism training by setting minimum standards for frequency, material, learning methods, and performance
- Enhancing partnerships with the public sector to maximize the expertise of State homeland security officials and first responders.
These measures would not only help prepare malls against attack, but the risk assessments, emergency plans, and drills would
also mitigate the impact of random acts of violence, fires, earthquakes, and other natural disasters.
NIJ Journal No. 259, March 2008
About the Author
Robert Davis is senior research analyst for the RAND Corporation. At the time of the research discussed in this article, he was with the
Police Foundation. Davis has directed projects on policing, domestic violence, victimization, crime prevention, courts, prosecution,
and parole reentry. He is the author of two books on crime prevention and editor of five books on crime prevention and victimization.
Back to the top.
 Davis, R.C., C. Ortiz, R. Rowe, J. Broz, G. Rigakos, and P. Collins, An Assessment of the Preparedness of Large Retail Malls to Prevent and Respond to Terrorist Attack (pdf, 50 pages), final report submitted to the National Institute of Justice, December 2006 (NCJ 216641).
 "Police: Nine Killed in Shooting in Omaha Mall, Including Gunman," Exit Notice CNN.com, December 6, 2007.
 Although we do not claim that the eight U.S. malls we visited were representative of the industry, it should be noted that
the malls were geographically diverse: They were located in California, Texas, Wisconsin, and Utah.
Date Created: March 17, 2008