GCPSG-021 (2025): Fundamentals of Detection Systems in Physical Security

Purpose

The purpose of this guide is to inform departments and agencies of a variety of available detection systems for use in a departmental physical security management program. Included in this guide are the application and efficiency of these detection systems as safeguards to minimize risks to the people, information, and assets of the GC.

Applicability

This guide applies to GC security functional specialists assigned physical security responsibilities in the protection, detection, response, and recovery functions of any GC facility or property. This also includes property management personnel and decision makers with a risk management or risk acceptance authority within the department or agency.

Equity, Diversity, and Inclusion in physical security systems

All employees of the GC have a responsibility to safeguard persons, information and assets of the GC. It is important that security policies and practices do not serve as barriers to inclusivity, but instead support and respect all GC personnel while ensuring appropriate security measures are maintained for the protection of GC personnel, assets, and information.

Initiatives to promote equality and inclusion among the diverse communities and heritages within the GC, should be respected in the development and maintenance of physical security systems. Departments and agencies should follow all GC legislation, policy and directives on Equity, Diversity, and Inclusion (EDI) in the promotion of a fair and equitable work environment for all persons while ensuring they meet their mandated security responsibilities.

Departments and agencies should conduct a risk management exercise to ensure, that while the dignity of all is respected, the protection of GC information, assets, and personnel is maintained. All questions on EDI policies and directives should first be addressed to your responsible departmental authority.

Information Technology considerations

With the constantly evolving threat landscape, and the convergence of physical and information technology (IT) security, the requirement to assess the risk of any application and/or software connected to a network to operate and support equipment in GC controlled buildings is critical. Some examples of these control systems could be for items such as, but not limited to, security lighting, perimeter gates, doors, HVAC, etc.

Before implementing any applications and/or software that will control and/or automate certain building functions, your departmental security requires the completion of a Security Assessment and Authorization (SA&A). This will ensure that the integrity and availability of the components the applications and/or software controls are maintained and that any risks highlighted will be mitigated. Starting the SA&A process early is highly recommended to ensure project delivery schedules are not affected. For more information on the SA&A process, please consult your Departmental Security.

Electronic Intrusion Devices

Electronic intrusion devices (EID) are automatic detection systems that often make up a component of a facility's security profile. EID systems operate by monitoring various conditions in their area of operation and notify when conditions change in such a way that may indicate the presence of a person. EID systems do not typically generate a response on their own, requiring supplementary systems to investigate the cause of the alarm. This is often done utilizing CCTV and security patrols to follow up on EID systems being triggered. EID is a resource effective way to monitor large facilities where it may not be practical to have security staff constantly monitoring the entire site; instead deploying resources only to areas with unverified activity requiring investigation. Another benefit of EID is detecting unscheduled access to a site and notifying security personnel or law enforcement, such as detecting movement in an office when it is expected to be unoccupied. In any case, EID systems provide a detection element only and will require additional safeguards to provide the response and recovery elements to ensure threats are properly mitigated.

CCTV Assisted Monitoring

CCTV systems are connected networks of equipment designed to capture, transmit, display, and store imagery data. CCTV systems range in complexity from a single camera connected to a display monitor, up to networked systems capable of monitoring and controlling hundreds of cameras connected locally, remotely, and globally.

These systems can be accompanied by software that can identify and alert to changes to what the system is observing, providing a similar function to motion detection. These programs operate by triggering an alert when a specified visual change is observed by the monitoring software, generally caused by movement in the area being observed. The software detects visual changes and not true movement, so these programs are subject to false alarms caused by changes in lighting conditions or other non-movement related changes to the visuals. This can be partially mitigated by calibrating the amount of change needed to trigger an alert, and identifying specific sectors of the monitored area to detect visual changes, such as entry points and travel routes. This software is most commonly used to initiate recording when there is perceived activity, saving storage space and extending the length of time recordings are retained before overwriting occurs. Any notable disruption in one or all cameras within a system should be immediately and thoroughly investigated.

More information on CCTV systems and their applications can be found in GCPSG-011 Guide to CCTV-CCVE Systems.

Personnel Based Monitoring

Personnel can be relied on in a limited capacity to detect incidents in either a dedicated or passive model. A dedicated model is the most commonly utilized, and includes security personnel conducting patrols, CCTV operators, sentries/access control guards, and properly trained reception employees. One of the primary responsibilities of these staff is to be on the lookout for persons attempting to enter the facility, and they should be trained on how to respond to, or alert, security staff should an unauthorized or suspicious person be observed. In addition to monitoring the movements of individuals, personnel can be utilized to identify objects carried or planted and communicate that information to security staff as required. As an example, an individual carrying an umbrella compared with an individual carrying a baseball bat would require vastly different approaches from security staff. This is a distinction that detection equipment alone may not be able to reliably make.

Passive models of personnel based monitoring is the byproduct of a risk aware and security trained workforce. This incorporates staff whose primary duties do not involve monitoring areas, but have received the training to identify and report suspicious or unusual incidents to security staff for investigation. Passive models of monitoring should not be relied on as a dedicated safeguard, but as a supplementary layer of protection to enhance the dedicated detection systems in place. Passive detection alone is often unreliable as it is proportional to staff's security awareness and training, willingness to report suspicious activity, and likelihood of noticing unauthorized persons in restricted access areas. This type of detection is most effective in smaller facilities, where staff know and recognize each other and will notice anything unfamiliar in their facility.

Training and Implementation

When visual monitoring is a planned element of a facility's detection system, there should be an emphasis on training, and maintenance of these skills especially by employees conducting patrols and monitoring surveillance equipment. Visual monitoring is directly proportional to the aptitude and attentiveness of the security team. Even the most comprehensive surveillance system is entirely ineffective if the person monitoring it is not paying attention to it or is not trained on how to handle observed incidents. When determining the potential of visual monitoring to detect threats, only employees dedicated to the task should be included in any risk mitigation calculations. Passive monitoring by staff who are security trained and aware is not as reliable or measurable as staff trained and employed specifically for the detection of individuals both permitted and trespassing. There are several categories of visual monitoring to consider, explored in Table 1: Visual Monitoring and Training Recommendations.

Metal Detection

Metal detectors are commonly used to detect and mitigate the risk of prohibited items being introduced to a controlled area. They are often used in areas that are open to the public however are at risk of being targeted by threat actors. These are commonly used at sporting events, cultural & historic sites, transportation hubs, education campuses and government buildings. Metal detectors are a component of a manned checkpoint, and will have one or more security guards operating the equipment. Metal detectors come in two common types, often deployed together for greater efficiency. These are the "walk through metal detector" and the "hand-held wand". At checkpoints with metal detectors people walk through first, and anyone who alerts at the walk-through detector are searched with a hand-held wand to pinpoint the metal object and determine if it is permitted or prohibited.

X-Ray

Similar to metal detectors, the primary function of X-Ray machines is to detect unauthorized items before they are introduced to a controlled environment. These machines commonly scan bags and equipment however, some models are designed to screen people. X-Ray machines require trained security personnel to operate them. Security personnel will also conduct secondary searches as necessary, and seize any items they have the authority to confiscate. X-Ray machines reveal the contents of a container, or items hidden on a person and some devices are capable of identifying threats autonomously. A well-trained operator will be able to accurately identify metal objects, wires and electronic components, liquids, and plastics, and determine whether the person or container requires a secondary physical inspection. An X-Ray machine is able to mitigate the risk of nonmetallic threats by allowing operators to see the shape and material of concealed items, and can be effective at detecting hostile devices that may not contain enough metal to be identified by a metal detector (such as plastic printed firearms, ceramic blades, plastic explosives/PVC pipe bombs, or noxious chemicals in nonmetallic containers).

X-ray machines will often be deployed alongside metal detectors where there is a reasonable expectation that guests or employees will be carrying bags, such as transportation hubs, courthouses, and historic sites open to the public. An X-ray machine is less invasive and time consuming than physically searching every bag, and can identify items sewn into the lining of bags that may elude detection with a manual search. X-ray machines are a common and practical mitigation effort for mail rooms and delivery docks, especially if the public is able to send packages or mail directly. Mail delivered hostile devices have become more common in recent decades, and every government department and agency should consider mitigation efforts to detect potentially hostile mail before it is introduced to a facility.

Checkpoint Planning and Operation

Employing checkpoints, either permanent or temporarily, should be considered when there is a concern, threat actors or prohibited items will enter a facility. Although they can be unpopular, they are often necessary when admitting people without security clearance, at mass gatherings, or when a site with cultural or political symbolism. All of these factors contribute to the risk of being targeted by threat actors. A TRA should be conducted to determine what items should be prohibited and the actions the security team should take if any are identified. Some items to consider prohibiting are:

• Mass casualty devices
• Weapons
• Intoxicants
• Propaganda
• Vandalism paraphernalia
• Tools
• Surveillance equipment

SOPs should be in place that clearly outline how security staff are to respond to finding prohibited items; denial of entry, confiscations and even arrests. All guards working the checkpoint must be trained on these procedures and have clear directions on how to escalate and report any incidents.

Defense in Depth

Defense in depth, also known as rings of protection, is a concept that an asset should have multiple layers of security safeguards that become increasingly dense the nearer you get to an asset. A perimeter fence is the most common first layer of defense; it is effective at establishing where public access ends but will do little to delay a deliberate threat actor from breaching or scaling it. Common detection efforts in the second layer include CCTV systems, security guard patrols, motion sensors, and access control safeguards; these are likely to be effective against most unsophisticated threat actors. The inner layers will be the most stringent and difficult to breach and will likely include multiple physical security safeguards working together to protect the asset from being compromised. As well as being highly difficult to breach for even sophisticated threat actors, these final layers of defense should also be designed to mitigate the risk posed by insider threats who may use valid credentials to bypass the first defensive layers. These final layers will likely have strict asset control that limits access to specific staff with a need-to-know or need-to-access.

Zones

Physical security zones, when appropriately integrated, should enhance the overall security environment of a facility. Physical security zoning should promote a sense of ownership or territorial reinforcement, provide opportunities for natural surveillance, and establish a clearly defined sequence of boundaries through which an appropriately screened visitor or employee may pass.

Before a person moves from one physical security zone to another, they should perceive the zoning boundary (implied or actual) and understand the rules or limitations associated with crossing it. Departmental functional space requirements should also be taken into consideration when establishing zoning boundaries.

For additional information on physical security zones refer to GCPSG-015 Guide to the Application of Physical Security Zones.

Protection, Detection, Response, and Recovery

PDRR are the four critical components that make up a dynamic and efficient security posture. Every safeguard or mitigation effort is designed to address one or more of these elements. Consult GCPSG-019 - Guide to Protection, Detection, Response, and Recovery for an in-depth look at these concepts.

Crime Prevention Through Environmental Design (CPTED)

Crime Prevention Through Environmental Design (CPTED) is a multi-disciplinaryapproach to crime prevention during the designation, definition, and security design of an environment. Facility design and management of natural and man-made environments, can enable departments and agencies to deter criminal or adversarial actions while safely managing the flow of individuals throughout a facility. These models intend to positively influence behavior and activities while discouraging undesirable actions by staff, visitors, and potential adversaries.