Physical Security

The Ins and Outs of Access Control at a Community College District

• By Dian Schaffhauser
• 03/20/08

Campus security takes many forms--emergency notification, monitoring for Web breaches, data privacy protection, video monitoring. But when was the last time you thought about the security offered by your school's doors?

Devitt Hartney, building system engineer for the 40,000-student San Mateo County Community College District in Northern California, thinks about them a lot. After all, the three colleges in his district have 75 buildings with a total of about 4,000 doors.

Three years ago, the district, which includes Cañada College, College of San Mateo, and Skyline College, started putting to work an infusion of capital from a bond measure to upgrade the campuses. One aspect of the new construction was to evaluate security, and those doors presented a major problem: According to Hartney, nobody knew who had keys to which buildings. "All the campuses were built in the 1960s," he said. "In some cases that's how old the key systems were. Each campus had three or four master key systems, which was very difficult to keep track of... So we decided to migrate to a new system."

The district brought in TEECOM Design Group, a California consulting firm, to evaluate how the campuses were handling security. Hartney worked with security integrator Thomas Keller to create an access control scheme that would allow for better door access management. The challenge was to create a tiered system that would grant people access based on specific need. Whereas an instructor might need access to one building where he or she teaches a class once a week, a custodian would need access to multiple buildings during certain times of the day. Campus management would require even greater access, as would the campus police force.

A committee consisting of Hartney, the director of facilities for each school, as well as chief engineers, the head of security and a number of faculty members spent six months evaluating the options. TEECOM had come up with three vendor recommendations to supply the hardware and software for the new access control system. One candidate was rejected, said Hartney, because the company came across as too small to support campus needs. A second candidate's solution didn't include video integration. The third candidate, AMAG Technology, won the work with its Symmetry product suite.

Centralized Door Management
Now electronic hardware on the doors controlled and managed by computer handles building access. Hartney can enter a time schedule to lock and unlock the doors. "This prevents having security people or custodians running around to unlock doors so students can get into buildings," he explained.

On holidays and weekends, the buildings can stay locked, unless special events are scheduled.

When somebody joins the faculty or staff or departs, nobody needs to issue or retrieve physical keys. The access is controlled by the software. If the class moves from one building to another, the faculty member's access is handled by a change to the software.

Users--whether faculty or staff--use fobs or keycards to gain access. Hartney said each user has a choice, but almost everybody chooses the fob over the keycard. "We have a lot of people who are free thinkers," he said. "They don't want an ID card."

The access rights for each person are maintained in Microsoft Database Engine (MSDE) tables. (Microsoft SQL Server can also be used.) Those reside on a server that each campus has. Two additional servers are housed at the district offices where Hartney works. One is called the card handler client; the other is a global server. The global server handles communication to the individual campuses and acts as a backup server. It can take information from one campus and reroute it to another one.

It also allows Hartney to do centralized administration by remote management as if it were a local client. Weekly, the individual campus servers communicate to the global server, which does a backup. If communication is lost between the global server and the campus, users at the school can continue to operate, update the user database and do reprogramming of access rules.

Besides granting or denying access to a building, the software maintains a record of fob or keycard use. "As long as the building was not scheduled to be unlocked, we can see who has been going into that building via their fob," said Hartney. "If in middle of the night something has gone missing, we can look at the system and see if somebody has forced the door open or somebody has used a key fob. If they've used a key fob, then we know who to talk to."

The system can monitor and let users change the conditions of doors--whether a given door is opened, closed, locked or unlocked.

The system also handles alarm monitoring. If a door is forced open or a window is broken, that will set off an alarm. "I don't mean bells and sirens," said Hartney. "The system sees it as an 'event,' a problem--something happening out of the ordinary." The software will communicate with an offsite company that monitors the system 24 hours a day. That company will call the appropriate authority, depending on the type of event--whether security on campus or the local police department.

Video for Forensics
Video recording is set up in several areas that have the new access control hardware, but Hartney says it's not used for surveillance. Nobody is constantly monitoring the cameras. They're used for after-the-fact analysis, "to look back and determine who, what, where and when."

The cameras have buffer memory, which is constantly being recorded over, comparable to a Tivo device. When an event takes place, the software sends an alert to the hard drive to collect what has been recorded to the buffer. The contents of the recording can then be analyzed by a user to determine the seriousness of the event. "When we come in, we can see there was an alarm," explained Hartney. "We can look at the hard drive. We can see somebody walk up to the door. 'Oh, it's a custodian. He's using a key. Let's call him at home.'"

The cameras also include a panic alarm option. If somebody is attacked and pushes the panic button, the cameras will maintain a recording of everything that happened a few minutes before and after the button was pushed. "Then possibly, we'll get the face of the perpetrator," said Hartney. "But we don't have security guards sitting there watching everything that's going on. We don't want to invade anybody's privacy."

Currently, between the three campuses, 14 buildings have been entirely outfitted with the access control and alarm management systems. All new construction includes it. Within seven years, Hartney said, almost every building will have the new technology on outside access doors, if not all doors. The only exceptions will be those rare buildings that consist of classrooms that contain nothing of high value and that are located in areas that aren't vulnerable to other types of security problems.

Education about the access control system is on-going, said Hartney. He has given training to large groups, put information on Web sites and issued a pamphlet. One lesson he's learned, he says, is that "not everybody reads what they've been given." When a person is issued a fob or keycard, they have to verify that they've read a document explaining how the new system works. "If they start causing a lot of false alarms, we have security personnel visit them," he said.

Hartney wouldn't push an electronic system comparable to the one at San Mateo for smaller campuses. "It's disruptive. It's a new system," he said. But for schools that have lost control over who has access to what, he concluded, "I think the electronic system is a wonderful way to go."