S02 - Security.1 Phys Sec Risk Assessment.pdf

FOR OFFICIAL VA USE ONLY- (FOUO)

Grand Junction VA Medical Center Renovate Urgent Care Bldg 1 Physical Security Risk Mitigation Design Guidance

CONFIDENTIAL AND PROPRIETARY

PHYSICAL SECURITY RISK ASSESSMENT AND RISK

MITIGATION DESIGN GUIDANCE

RENOVATE URGENT CARE BUILDING 1

Project# 575-19-101

GRAND JUNCTION VA MEDICAL CENTER

2121 North Avenue, Grand Junction, Colorado 81501

Prepared by: Force Protect Security Consultants Frank A Finley II, MS, PSP www.force-protect.com For: Paradigm Engineers & Constructors

2 March 2021

This report is confidential. It is intended for the information and use of the client to whom it is addressed. Force Protect Security Consultants does not guarantee the accuracy and completeness of outside agency records.

http://www.paradigmusa.com/

FOR OFFICIAL VA USE ONLY (FOUO)

Grand Junction VA Medical Center Renovate Urgent Care Bldg 1 Physical Security Risk Mitigation Guidance

ACRONYMS AND ABBREVIATIONS

AHJ Authority Having Jurisdiction AT Anti-Terrorism CLC Community Living Center COOP Continuity of Operations Plan CONWEP Conventional Weapons CPTED Crime Prevention Through Environmental Design DDoS Distributed Denial of Service DHS Department of Homeland Security DOS Department of Safety DSPI Duress Security Phone Intercom DSS Detection and Screening System DVE Domestic Violent Extremist ED Emergency Department EES Emergency Electrical System EOC Emergency Operations Center EOP Emergency Operations Plan FCA Facility Condition Assessment FP Force Protection FPCON Force Protection Condition FTO Foreign Terror Organization HVAC Heating, Ventilation, Air Conditioning HVE Homegrown Violent Extremist HUMINT Human Intelligence IDS Intrusion Detection Systems IoT Internet of Things IPT Integrated Product Team IR Infrared LPR License Plate Reader MOA Memorandum of Agreement PACS Personal Access Control Systems PENTEST Penetration Test PSDM Physical Security Design Manual PSIM Physical Security Information Management REX Request to Exit SCADA Supervisory Control and Data Acquisition SCC Security Control Center SSTV Security Surveillance Television TCO Transnational Criminal Organization VA Department of Veterans Affairs VACO Veterans Affairs Central Office VAMC Veterans Affairs Medical Center VBIED Vehicle Borne Improvised Explosive Device VMS Video Management System YELP Siren Operated Sensor Gate Opener

Grand Junction VA Medical Center Renovate Urgent Care Bldg 1 Physical Security Risk Mitigation Guidance

Table of Contents

1.0 Scope and Executive Summary...………………………………………………….…..4

2.0 Top 10 Critical Targets in Scope……………………………………………………

3.0 Threat Summary………………….…..……………………………………………….…..7

4.0 Most Likely Threats, Highest Impact.……………………………………………....…21

5.0 Risk Mitigation Results & Recommendations ……………………………………...22

Appendix A - Asset Criticality Analysis

Appendix B – MEVA (Raw Data) ………………

Grand Junction VA Medical Center Renovate Urgent Care Bldg 1 Physical Security Risk Mitigation Guidance

1.0 SCOPE AND EXECUTIVE SUMMARY

Per the VA Station COR (Anna Crickmer) the VA Physical Security & Resiliency Design Manual, January 2021 Revision applies to this scope of work. Per PSRDM 1.4, the Building 1 facility is categorized as “Mission Critical (MC)”. Also, per PSRDM 2.4, this scope of work entails greater than 50% of the Urgent Care functional space, therefore renovation entails the entire Urgent Care/Emergency Department operational space, including replacement and expansion of the front façade (west addition). Therefore, this report serves as the scope-specific risk assessment (per PSRDM 1.3 & 2.2) and risk mitigation design guidance to the design team.

The risk assessment was applied to the 35% design of “Renovate Urgent Care Building 1, Project #575-19-101” as it relates to the strategies recommended in the PSRDM 2021.

This risk assessment followed the Interagency Security Committee (ISC) standards and guidelines for risk assessments. Additionally, the ISC-governed risk assessment results are what dictated which VA PSRDM mitigation measures to implement and to what degree.

Based on the aforementioned risk assessment, the scope-specific top likely threats/high impact of loss are utility loss (natural, man-made, or reliability-based), IED, assault, larceny, active shooter, cyber-attack, and vehicle ramming. Additionally, a scope-specific top critical targets list was developed which involve urgent care operations, logistics and utilities. The physical security risk mitigation design guidance, presented to the AE team and VA, is summarized as follows:

1. Install the ambulance screening gate directly at the 50-foot standoff position from Building 1’s northwest corner. To meet true “screening” criteria, arm this gate as a triple-authentication screening gate, complete with ID Card PACS (or “Yelp” system), License Plate Reader (LPR), facial analytics camera, all tied to the Security Control Center (SCC).

2. Create separate entrances into the Urgent Care per PSRDM 5.5, one for ambulance patients and one for dismounted pedestrians.

3. Establish the dismounted pedestrian entrance as a screening vestibule per PSRDM 5.5, armed with weapons/explosives detection and Police/Security management.

Since Building 1 will be required to have screening vestibules at both the east and west public entrances per PSRDM 4.2, as a cost-effective option consider combining the west public entryway through a consolidated Building 1/Urgent Care/MRI screening vestibule.

4. By establishing 24/7 weapons, explosives, and contraband passive screening operations at the designated dismounted patient/visitor entrance, the VA/AE can forgo a lobby/waiting area reinforced separation wall from Urgent Care medical/exam space due to preventing a satchel IED (W1) from being introduced into the lobby/waiting area (requires submitting for deviation).

Grand Junction VA Medical Center Renovate Urgent Care Bldg 1 Physical Security Risk Mitigation Guidance

5. Implement anti-ram measures at a 5-foot standoff along west side of Urgent Care and MRI (ASTM F2656 M-30 rated).

6. Implement blast protection measures along the west expansion façade and “exposed” portions of the second-floor mechanical space envelope design, per PSDM chapters 6 & 7. Guidance from the Blast Specialist is required, as well as permissions from the VA Central Office regarding controlled W & GP values.

Consider submitting for exception from the AHJ for structural enhancements due to screening of ambulance traffic outside the standoff, as well as future physical security master plan projects (via SCIP) that mitigate the chances of a VBIED entering the campus.

7. Implement various measures of building envelope hardening regarding doors, fenestrations, door/window hardware, and electronic security measures that secure the building envelope 24/7, as well as serve as a proactive detection for trespass, tampering, larceny, etc.

8. Implement up-to-date SSTV devices and backbone systems in performance anticipation of the future VAMC Physical Security Information Management (PSIM), enabling use of behavior analytics and interlocked PACS/IDS alarms.

9. Protect the utilities via PSRDM-compliant measures regarding relocation of exterior distribution utilities within the building envelope or surrounding with protective systems per PSRDM Chapter 6, as well as secure all utility rooms and cover with trespass analytics SSTV.

10. Protect staff, as well as control and separate public vs private exam space throughout the interior, via UL 752 Level 1 construction, door PACS, SSTV, and augmented panic/duress.

It is understood that this physical security report does not imply any dissatisfaction with the security policies and procedures currently in place at VA or dissatisfaction with VA management. Rather, it is a positive effort to ensure that reasonable provisions have been made to protect VA employees, property, vendors, contractors, and authorized visitors. It is important to note that implementation of the recommendations in this assessment do not guarantee that a crime, act of terrorism or act of nature will not occur on the premises or that VA security liability may be reduced or eliminated on the property assessed. The recommendations are based on solid documentation developed during the assessment and meet the standards of reasonableness and feasibility. Recommendations are based on best practices in the security industry to address vulnerabilities identified during the risk assessment, the VA Physical Security & Resiliency Design Manual 2020 (Rev Jan 21), guidelines issued by ASIS International, as well considering the safety of patients, visitors, and staff. Implementation of the recommendations in this report may reduce the probability that a loss will occur on the premises assessed or, if a loss does occur, it may be minimized.

All recommendations and identified deficiencies (oral or written) communicated to VA management during this assessment will remain confidential.

Grand Junction VA Medical Center Renovate Urgent Care Bldg 1 Physical Security Risk Mitigation Guidance

.2.0 TOP 10 CRITICAL TARGETS RELATED TO SCOPE

(Based on CARVER and MSHARPP analysis, Appendix A):

1. Triage/Waiting/Public Space

2. Urgent Care

3. West Roadway/Ambulance Drop-Off

4. MRI Trailer

5. 1st Floor Mech & Elec Rooms 1633, 1634, & 1635

6. Pedestrian Entrance Vestibule

7. Ambulance Entrance Vestibule

8. 2nd Floor Mech Rooms 2800 & 2639

9. Clean & Dirty Linen Rooms

10. Medication Room

Grand Junction VA Medical Center Renovate Urgent Care Bldg 1 Physical Security Risk Mitigation Guidance

3.0 THREAT SUMMARY

3.1 Terrorism: Domestic terrorism trends for 2019 – 2021 in the United States seem to point toward the following:

• International and domestic violent extremists have developed an extensive presence on the Internet through messaging platforms and online images, videos, and publications. These facilitate the groups’ ability to radicalize and recruit individuals who are receptive to extremist messaging. Social media has also allowed both international and domestic terrorists to gain unprecedented, virtual access to people living in the United States to enable homeland attacks.

• According to the Department of Homeland Security, Domestic terrorists and violent extremists are mobilizing in response to the coronavirus pandemic, and the threat could get more severe “until the virus is contained and the normal routine of U.S. societal life resumes.”

• Mass gatherings for social/political causes grow as a flashpoint for anarchist extremists and their ideological/political opponents (anti-government).

• Lethal domestic terrorist attacks continue to be committed by lone offenders.

• Non-civilian targets most prevalent among international terrorist attacks (police, military, federal/state government).

Over the past year, the Department of Homeland Security (DHS) has observed a roughly consistent rate of attacks moving from operations directed and enabled by Syria-based facilitators to a higher percentage of attacks by individuals inspired by violent extremist messaging. This observation underscores ongoing concerns regarding the resonance of violent extremist messaging among homegrown violent extremists (HVEs) and lone offenders and the challenge of detecting and disrupting plots with little or no formal connections to a foreign terrorist organization (FTO). The

Grand Junction VA Medical Center Renovate Urgent Care Bldg 1 Physical Security Risk Mitigation Guidance

2019 – 2020 domestic Islamist extremist landscape, so far, is mostly consistent with that of previous years, with a greater proliferation of online methods of recruitment and communication. In Fiscal Year 2019, 228 terrorism subjects were arrested in the United States by or in coordination with the FBI (Figure 1). Of these, 121 arrests were international terrorism subjects, 19% of which were arrested for providing material support to an FTO.

Figure 1 - 2019 US FTO/HVE -Related Arrests

Several terrorist personnel have been exposed or plots have been foiled by Federal agencies throughout Colorado within the past five years, including:

• February 2021 Jonathon Ryan Armijo was taken into custody in connection with two incidents related to leaving behind IEDs in public parking lots in Las Anima County, Colorado.

• May 2020 a 53-year-old man was arrested for possession of pipe bombs prior to attending a Reopen Colorado rally at the state Capitol building in Denver.

Recent calls over the past year for attacks on hospitals in the West by media outlets sympathetic to the Islamic State of Iraq and ash-Sham (ISIS) highlight terrorists’ perception of hospitals as viable targets for attack. Targeting hospitals and healthcare facilities is consistent with ISIS’s tactics in Iraq and Syria, its previous calls for attacks on hospitals in the West, and the group’s calls for attacks in the West using “all available means.” While DHS/JTTF has not seen any specific, credible threat against hospitals and healthcare facilities in the United States, they remain concerned that calls for such attacks may resonate with some violent extremists and lone offenders in the Homeland because of their likely perceived vulnerabilities and value as targets.

Grand Junction VA Medical Center Renovate Urgent Care Bldg 1 Physical Security Risk Mitigation Guidance

For sake of definition as it pertains to the VA Medical Center, “Terrorist” is defined in this assessment to include Foreign Terrorist Organizations (FTO) and Homegrown Violent Extremists (HVE). For sake of reference, Saudi Military Trainee 2LT Mohammed Alshamrani, the shooter in the Pensacola (Florida) Naval Air Station attack in December 2019, is categorized as an FTO. This is based on his direct ties with al-Qaeda. For additional sake of reference, Omar Mir Siddique Mateen, shooter in the Orlando Pulse nightclub attack in June 2016, is categorized as an HVE. This is based on his foreign ties with Hezbollah, ISIL, and al-Qaeda (via family).

3.2 Domestic Violent Extremist (DVE) Groups: The definition of domestic extremism includes a wide range of groups and individuals with an equally diverse set of goals and grievances operating within the state. However, it should be noted that this category does not include information on Homegrown Violent Extremists (HVE), who are individuals inspired by foreign terror organization(s), operating while in the U.S., and not directly collaborating with a foreign terror organization.

Most domestic terrorist attacks and plots between January 1 and August 31, 2020 were committed by white supremacists, anti-government extremists from the violent far right, and involuntary celibates (incels). As shown in Figure 2, far-right terrorists committed 67 percent of attacks and plots, far-left terrorists committed 20 percent, and extremists with other motivations (such as supporters of the Boogaloo movement) and Salafi-jihadists each committed 7 percent.

Figure 2 – Number of Terrorist Attacks and Plots by Perpetrator Orientation, Jan – Aug 20

In recent years, many of the problems that Colorado residents have faced have come from domestic right-wing extremist movements: race supremacists, anti-

Grand Junction VA Medical Center Renovate Urgent Care Bldg 1 Physical Security Risk Mitigation Guidance government extremists, and single-issue extremists. While domestic Muslim extremists do pose serious threats, it is the race supremacists and anti-government extremists who are more numerous and have been frequently involved in criminal activity. Colorado remains a fertile location for a myriad of domestic extremist groups and individuals with a highly diverse set of motivations. Many groups are actively preparing through weapons training, communication, and collaboration for an eventual breakdown in social norms and possible government failure, to enact their own governance structure. Considering the current social climate and instant availability of information, many DVE groups and members have positioned themselves through training, communication, and ideology to negatively impact future events through violence and continued radicalizing rhetoric. For sake of most recent reference, the shooter involved in the Walmart shooting in El Paso, Texas in August 2019 is categorized as DVE due to his manifested targeting of Mexicans.

On May 1, 2020, a 53-year-old man was arrested after agents from the Federal Bureau of Investigations (FBI) and the Bureau of Alcohol, Tobacco, Firearms and Explosives discovered four pipe bombs at his residence. The suspect, a veteran, had posted online pictures of weapons, and indicated intent to attend a Reopen Colorado rally at the state Capitol building in Denver.

In October 2020, Richard Holzer, a Colorado man, pleaded guilty in federal court to federal hate crime and explosives charges for plotting to blow up the Temple Emanuel Synagogue in Pueblo, Colorado.

Per the DHS, the 6 January 2021 violent breach by suspected DVEs into the US Capitol Building likely will serve as a significant driver of violence for a diverse set of DVEs. These DVEs and others may also perceive the event as a step toward achieving their initiatives and consider the death of a perceived like-minded individual as an act of martyrdom. Some DVEs’ view the 6 January event as a success, in conjunction with the potential to exploit follow-on lawful gatherings and ideological drivers—including conspiracy theories, such as Q’Anon—likely will also inspire some DVEs and others to engage in more sporadic, lone actor or small cell violence against common DVE targets, including racial, ethnic, or religious minorities and institutions, law enforcement, and government officials and buildings.

3.2.1 Hate Groups have sporadic presence in the Grand Junction area, but exist statewide in the form of:

• Asatru Folk Assembly (Neo-Volkisch)

• Atomwaffen Division (Neo-Nazi)

• Folks Front/ Folkish Resistance Movement (Neo-Nazi)

• International Conservative Community (White Nationalist)

Grand Junction VA Medical Center Renovate Urgent Care Bldg 1 Physical Security Risk Mitigation Guidance

• National Socialist Order (Neo-Nazi)

• Patriot Front (White Nationalist)

• Proud Boys (General Hate)

Their agenda is to “preserve race and community”, primarily lending to nonviolent acts and crimes committed to raise funds to finance group activities. Some activities also relate to criminal endeavors generally used by these extremists to further operational planning. Although unlikely, it is still possible select VA patients could be active members of these type racist and anti-Semitic groups.

White supremacists and other like-minded extremists conducted two-thirds of the terrorist plots and attacks in the United States in 2020, according to CSIS data. Anarchists, anti-fascists, and other like-minded extremists orchestrated 20 percent of the plots and attacks, though the number of incidents grew from previous years as these extremists targeted law enforcement, military, and government facilities and personnel. Despite these findings, however, the number of fatalities from domestic terrorism is relatively low compared to previous years.

3.2.2 Sovereign Citizen movement has caused even more problems in Colorado in recent years. The FBI considers sovereign citizens to be “domestic terrorists” with their offenses ranging from the minor to the severe, such as becoming confrontational when approached by law enforcement or some exhibit acts of local terrorism against government agencies/authorities. The Southern Poverty Law Center (SPLC) estimates that approximately 100,000 Americans are "hard-core sovereign believers", with another 200,000 "just starting out by testing sovereign techniques for resisting everything from speeding tickets to drug charges.” In surveys conducted in 2014 and 2015, representatives of US law-enforcement ranked the risk of terrorism from the sovereign citizen movement higher than the risk from Islamic extremism.

In late 2008, a wave of anti-government hostility swept the country, helping to generate a resurgence of anti-government extremist groups and movements. Unfortunately, Colorado has served as a fertile breeding ground for these movements. Sovereign citizens believe a conspiracy infiltrated and subverted our government, replacing it with an illegitimate tyranny. Accordingly, they claim to owe no allegiance to the "illegitimate" government and hold that it has no jurisdiction over them.

https://en.wikipedia.org/wiki/Southern_Poverty_Law_Center https://en.wikipedia.org/wiki/Terrorism https://en.wikipedia.org/wiki/Islamic_extremism

Grand Junction VA Medical Center Renovate Urgent Care Bldg 1 Physical Security Risk Mitigation Guidance

In waging war against the government, they resort to "paper terrorism" tactics of harassment and intimidation and sometimes also resort to brutal physical violence. As part of the “sovereign revolt” against authority figures, the protestors will occasionally target judges, law enforcement and other representation of the state and federal government. Within Grand Junction, sovereign citizens have been known to frequently conduct “first amendment audits” against local police. Additionally, Bruce Doucette, one of the most prominent sovereign citizens in the country, was sentenced to 38 years in prison in 2018 after being charged with racketeering, conspiracy and other felony counts. Historically, the antigovernment activity and membership has risen sharply when Democrats take the presidency, as fears of gun grabs and federal action against such groups’ surges, and decline during Republican administrations, when such fears abate. However, this does not appear to be the case since the election of President Trump, as the movement’s numbers, while decreasing, are doing so at a severely reduced rate.

The VA qualifies as an opportune target of the sovereign citizen movement solely based on its representation of the federal government.

3.2.3 Anti-Government Militia

Extremists: Militia Extremists are groups or individuals who facilitate or engage in acts of unlawful violence directed at federal, state, or local government officials or infrastructure in response to their belief that the government deliberately is stripping Americans of their freedoms and is attempting to establish a totalitarian regime. These individuals consequently oppose many federal and state authorities’ laws and regulations, and often belong to armed paramilitary groups. Militia extremist groups often conduct paramilitary training designed to violently resist perceived government oppression or to violently overthrow the U.S.

Government. Further, militia extremists often legally and illegally stockpile firearms and explosives in support of their ideological agendas, and typically

Grand Junction VA Medical Center Renovate Urgent Care Bldg 1 Physical Security Risk Mitigation Guidance engage in operational security tactics, such as meeting in person to evade law enforcement scrutiny. According to state law enforcement intelligence sources, there are four primary militia extremist groups throughout Colorado: Oath Keepers, III% United Patriots, American Patriots Three Percent.

A VA Medical Center is an unlikely target for militia-activity based on the representation of military Veterans. However, it should not be ruled out as a target of their anti-government movement.

3.2.4 Antifa (Anti-Fascist): Antifa have

orchestrated numerous statewide violent protests throughout 2020, as well as active doxing of individuals they view as threats to their cause.

Their decentralized nature, being composed primarily of localized, autonomous groups, makes it difficult for law enforcement to track and combat Antifa operations. A VA Medical Center is a potential target of Antifa violence due to the anti-government nature of the movement.

3.2.5 Animal Rights Extremists

believe all animals—human and non-human—have equal rights of life and liberty and believe violence is needed to stop those they think are hurting animals or the environment. These violent extremists usually do not seek to kill or injure people, but their crimes—which include property damage, vandalism, threats, cyber-attacks, arson, and bombings—have caused millions of dollars in damages and disrupted the lives of many Americans. Violent animal rights extremists attack those they believe are linked to the abuse of animals. Typical targets include the fur industry, Grand Junction VA Medical Center Renovate Urgent Care Bldg 1 Physical Security Risk Mitigation Guidance companies and individuals involved in animal research, and businesses that ship animals. The most outspoken and active of these groups currently operating in Colorado are Direct Action Everywhere (DxE) and Denver Baby Animal Save.

A VA Medical Center is a likely target for animal rights extremist-activity based on the use of animals in research in VA Medical Centers across the country.

3.3 Crime: The vicinity encompassing the Grand

Junction VAMC contains top five crimes of larceny theft, burglary, assault, vehicle theft, and rape. Figure 3 provides a comparison of the site’s risk to the national, state and county average risks for the year 2020 to present 2021.

Figure 3 – Grand Junction VA Crime Risk Comparisons

Regarding the area immediate to the Grand Junction VAMC the overall crime risk is considered “Elevated” (higher than 84% of US addresses) due to the averages of crime committed in that concentrated area (Figure 4), with larceny, burglary, rape, homicide, and assault being higher risks in this area, by comparison to the rest of the state. Based on predictive analysis (Figure 5), violent crime is expected to decrease slightly year-by-year for the next five years, with property crime expected to increase. Additionally, there are 237 sex offenders residing or working within 3 miles of the Grand Junction VA Medical Center.

Figure 4 – Grand Junction VA Overall Crime Risk

Grand Junction VA Medical Center Renovate Urgent Care Bldg 1 Physical Security Risk Mitigation Guidance

Figure 5 – Grand Junction VA Crime Forecast

Top 5 Crimes on the Grand Junction VAMC campus FY 2020 include:

1. Disorderly Conduct

2. Contraband – weapons (knives, firearms), drugs and alcohol

3. Larceny (personal property and government property, including drugs)

4. Vandalism

5. Assault

(Source: VA Police Uniformed Crime Report UCR FY 2020 – Report Exec)

3.4 Drugs: Commercial Prescription Drugs (CPDs), Crack Cocaine, Heroin, methamphetamines, synthetic drugs, and marijuana are readily available in Grand Junction, Colorado. Cocaine destined for the United States originates primarily from Colombia and moves north via Central America, Mexico, and the Caribbean— by maritime, land, and air conveyances—crossing primarily through the US Southwest land border (SWLB) and into major US distribution hubs. Drug trafficking organizations (DTOs) mostly smuggle cocaine across the SWLB through ports of entry (POE) in privately owned vehicles (POVs) and commercial vehicles. Within the United States, DTOs mainly move cocaine along US interstates and highways in POVs, and typically rely on local US criminal groups and street gangs to distribute cocaine at the retail-level. The map in Figure 6 depicts general routes out of key hubs. Grand Junction serves as one of the minor distribution stops along the route from Las Vegas into Colorado. From Mexico, narcotics make their way to Grand Junction enroute to Denver, which serves as a

Grand Junction VA Medical Center Renovate Urgent Care Bldg 1 Physical Security Risk Mitigation Guidance regional distribution hub.

Figure 6 – DTO Distribution Routes/Hubs 2018 – 2020

The types of drug found in drug seizures by the Grand Junction Police Department are detailed in Figure 7.

As this subject pertains to the Grand Junction VA Medical Center, across the Department of Veterans Affairs, Federal authorities have launched dozens of new criminal investigations into possible opioid and other drug thefts by employees at Department of Veterans Affairs hospitals, a sign the problem is not going away despite new prevention efforts. Data obtained by The Associated Press shows 108 open criminal investigations involving missing prescriptions, theft, or unauthorized drug use. Most of those probes typically lead to criminal charges. Therefore, internal threat of narcotics theft is a likely threat that must be considered.

Figure 7 – Grand Junction PD Drug Seizures by Drug Type

Grand Junction VA Medical Center Renovate Urgent Care Bldg 1 Physical Security Risk Mitigation Guidance

3.5 Gangs: Every state and major city in

the United States is plagued with local, loosely structured, street gangs that are mainly motivated by drug sales. These local groups form based on common interests and a sense of loyalty to individuals from their city, neighborhood, street, or housing complex. They adopt generic names such as Players, Posse, Crew, Mafia, Gang, and Bad Boys and attach their street or avenue name to it. Although they are loosely structured and tend to conduct their illegal activities in a specific location, they are extremely violent and develop bitter blood rivalries. Often the group evolves and adopts an alliance with a national street gang such as the Bloods, Crips, Folk Nation and People Nation sets and use their symbols and identifiers.

Grand Junction is experiencing a rise in drug trafficking and violent crime that is speculated by local law enforcement to be linked to gang activity, which is difficult to properly identify and define. Prevalent gangs in Grand Junction include Sureños, Norteños, and Satan’s Disciples, the local leader of which was sentenced in 2020 to 194 years in prison for various crimes, including aggravated robbery, arson, and racketeering.

Other common crimes associated with gangs include weapons possession, criminal mischief (graffiti vandalism), and loitering around homes and businesses.

Violent crimes, such as battery and murder, have also been perpetrated by gang members. Violence may ensue due to conflicts between rival gangs, personal disputes, or as a form of intimidation to enforce loyalty and silence in the community where the gang lives.

A limited number of known gang members within these gangs are quite possible prior service military members, few of which quite possibly receive services from the Grand Junction VA Medical Center and surrounding CBOCs. Military-trained gang members pose a serious threat to law enforcement and to the public. They learn combat tactics in the military, then return home to utilize these new skills against rival gangs or law enforcement. Military training of individual gang members could ultimately result in more sophisticated and deadly gangs, as well as deadly assaults on law enforcement officers.

Gang access to government institutions remains low. However, attempts continue and the potential impact for infiltration is substantial. Infiltration of government institutions can provide gangs with access to sensitive law enforcement information, including law enforcement techniques and pending investigations.

Grand Junction VA Medical Center Renovate Urgent Care Bldg 1 Physical Security Risk Mitigation Guidance

Infiltration can further help shield illicit activity and provide access to compromised police officers, which can hamper law enforcement efforts, and ultimately undermine public confidence in law enforcement. Infiltration often involves attempts by gang members, gang associates, and their family members to gain access through civilian positions.

3.6 Disgruntled Veterans: Nearly 75 percent of the almost 25,000 assaults and other workplace violence reported annually in the United States happen in a healthcare setting, and healthcare workers are four times more likely to be the victim of a violent workplace event than any other private-sector employee, according to recent figures from the Occupational Safety and Health Administration (OSHA).

Hospitals and healthcare facilities face a unique security challenge because of the constant flux of people coming and going and the unrelenting nature of the industry. Workplace violence has always been part of healthcare because of the dynamic and emotional situations that people find themselves in at hospitals and the fact that many people lack coping mechanisms to deal with unexpected situations.

According to the most recent FBI data, there have been 250 healthcare active shooter incidents between 2000 and 2017, in which 799 people were killed and 1,418 others were wounded. In the first half of that time frame, there was an average of 6.7 incidents per year, but there was an average of over 20 incidents per year in the second half of that period. A separate 2012 study examined all U.S.

hospital shootings between 2000 and 2011 in which there was at least one injured victim. That study identified 154 incidents in 40 states causing death or injury to 235 people. Researchers say the "run, hide, fight" response to an active shooter may work in venues and for certain hospitals, but in general, healthcare facilities should consider a different approach for areas where "run, hide, fight" is not possible. Healthcare workers should "secure" the location, "preserve" the life of the patient and oneself, and "fight" only if necessary. This "secure, preserve, fight" approach offers a good strategic framework to reduce potential harm if the work is planned carefully, designed thoughtfully, and recurrent training is prioritized.

Grand Junction VAMC: Mostly positive reviews documented (Yelp, Facebook, Yellowpages.com, VA OIG, and VA patient surveys) 2015-2021 regarding the facility and service. Most complaints pertain to dismissiveness, complacency, and negligence of staff, and excessive wait times for appointments and prescriptions.

However, the positive commentary relates to friendliness of staff members, and effectiveness of care from doctor/nursing staff.

The VA is an open, full access campus which is surrounded by retail businesses, residential areas, a sports complex, and a golf course. Additionally, the campus does not have a perimeter fence. This campus would be considered a soft target by a disgruntled Veteran.

Grand Junction VA Medical Center Renovate Urgent Care Bldg 1 Physical Security Risk Mitigation Guidance

3.7 Disgruntled Employees: Grand Junction VAMC: Mixed satisfaction in the Grand Junction VAMC workplace based on VA OIG, Indeed.com, Glassdoor.com, Twitter and other employee surveys. Positive reviews unanimously revolve around pay, levels of activity at work, benefits and serving Veterans. Negative reviews center on dissatisfaction with effectiveness of executive leadership, prevalence of politics within workplace, and working with outdated equipment.

3.8 Cyber Crime: In 2016, medical facilities around the world were attacked with ransomware, resulting in the cancellation of medical procedures, the unavailability of patient records, and the diversion of ambulances.

The U.S. Food and Drug Administration (FDA) has warned consumers that hackers could remotely hijack certain medical devices, by exploiting cybersecurity flaws.

The vulnerable devices use third-party software called IPnet, and the FDA is uncertain precisely which devices or how many are at risk. The agency says scientists have identified eleven flaws that could allow any hacker to remotely commandeer a device, "and change its function, cause denial of service, or cause information leaks or logical flaws, which may prevent device function." The FDA is evaluating the security risk and identifying affected devices in collaboration with stakeholders and subject matter experts.

In January 2019, a government-backed coalition of hospitals and medical device manufacturers released a 53-page "joint security plan" outlining cybersecurity strategies that manufacturers and hospitals should implement. The voluntary plan was issued by the Healthcare Sector Coordinating Council, a liaison on security issues between industry and government. The new plan was drafted by roughly 60 medical organizations and was led by the Mayo Clinic, the Food and Drug Administration, and medical device company BD. It advises device manufacturers to describe to hospitals how they will scan for new cyber vulnerabilities in their devices and how and when they will patch them. Manufacturers should also tell hospitals how long they will support vulnerability patching and when hospitals should plan for devices to reach the end of their usable lives, according to the plan.

The council and the Department of Health and Human Services also released a separate guide that outlines hospitals' cybersecurity responsibilities, including what they should expect from device manufacturers.

This medical center has wi-fi internet service, wireless medical devices, select IoT, MOBUS and SCADA. Select VA CBOCs have wi-fi internet service and wireless medical devices. Many medical devices are vulnerable to cyberattacks or exposing data because the technology is often outdated, and healthcare IT and security budgets are stretched. All of the aforementioned services and devices offer cyber vulnerability in which Cyber criminals who gain access to sensitive medical information could exploit it by selling it on the dark web, blackmailing identifiable individuals, or even potentially using the exposed servers as means of https://www.zdnet.com/article/healthcare-lags-behind-in-vulnerability-management-banks-are-holding-their-ground/ https://www.zdnet.com/article/healthcare-lags-behind-in-vulnerability-management-banks-are-holding-their-ground/ https://www.zdnet.com/article/healthcare-lags-behind-in-vulnerability-management-banks-are-holding-their-ground/

Grand Junction VA Medical Center Renovate Urgent Care Bldg 1 Physical Security Risk Mitigation Guidance delivering ransomware to hospital networks.

3.9 Public Safety: Grand Junction, CO Natural Hazards: The top likely natural hazards to impact Grand Junction, containing high impact of loss, include thunderstorm winds, hail, and flash flooding. The chance of earthquake damage in Grand Junction is lower than Colorado average and is much lower than the national average. The risk of tornado damage in Grand Junction is much lower than Colorado average and is much lower than the national average.

Natural Hazards Effects on the VA: The extreme winds from tornadoes and storms, as well as ice from winter storms, snow melt-off or flooding will affect this VA campus through the cascading effects from electricity disruption, water and wastewater system disruptions, and the closure of roadways caused by ice or flooding. The Grand Junction VA Medical Center does not have fuel capacity for self-sufficient supply backup emergency power generation for a 96-hour time-period in event of a national emergency. This campus has a water tower, however it is not confirmed that the capacity meets the requirements of PSRDM Chapter 8 to sustain a 96-hour national emergency, as well.

Of course, an earthquake would have a devastating effect on the multi-story buildings due to progressive collapse. However, note that “seismic response” to an earthquake was not studied, as this subject is not prescribed in the PSRDM.

Chapters 6 and 7 of the PSDM address requirements for blast protection and progressive collapse due to explosive blasts (W1, W2 and GP2 magnitudes).

These explosive blast-related protective measures, per PSRDM 6.0, are in addition to hurricane, earthquake and any other extreme loading condition required by code.

https://www.zdnet.com/article/ransomware-an-executive-guide-to-one-of-the-biggest-menaces-on-the-web/

Grand Junction VA Medical Center Renovate Urgent Care Bldg 1 Physical Security Risk Mitigation Guidance

4.0 MOST LIKELY THREATS, HIGHEST IMPACT

(Based on MEVA Appendix A)

1. Utility shutdown of property power utility (physical plant, substation switchgears, local transformers) or other key utilities (oxygen/medical gas, chilled water, IT server) via natural disaster (lightning strike, tornado, hurricane effect, flood, fire).

2. Reliability induced failure of utility (MEP - electrical transformer, chilled water, HVAC, refrigeration, IT server).

3. Possible leave-behind explosive (improvised explosive, pipe bomb, grenade, etc.) left in building, in parking lot or near building by a terrorist, extremist (DVE/HVE), disgruntled patient, or disgruntled employee.

4. Assault in parking lot or on perimeter grounds (including sexual assault) on employee or patient by criminal (robbery), fellow patient, domestic relation, or violent extremist (DVE/HVE), with or without knife/club.

5. Disruption to operations via arson, vandalism (spray paint, property destruction, water/fuel contamination), or utility shutdown (sabotage) as political statement by an extremist (DVE/HVE), disgruntled patient, or disgruntled employee.

6. Larceny theft of government (including drugs, utility equipment, parts, and materials for scrap value) and personal property & materials by trespasser, contractor, employee, or patient during hours (unsecured) or after hours via forced entry (window/door).

7. Active shooter in parking lot or on perimeter grounds via violent extremist (DVE/HVE), criminal (robbery) or outside relation (domestic).

8. Cyber-attack of VA IT system via electronic hack by terrorist or extremist to disrupt operations. Includes insider cyber breach, but not physical penetration.

9. Vehicle ramming of pedestrians, utilities, or buildings via terrorist/violent extremist (DVE/HVE) Terrorism/Homegrown Violent Extremists (HVEs) in parking lot or campus roadways to produce mass casualties/impede operations.

10. Active shooter inside building via violent extremist (DVE/HVE), criminal (robbery) or outside relation (domestic).

Grand Junction VA Medical Center Renovate Urgent Care Bldg 1 Physical Security Risk Mitigation Guidance

5.0 RISK MITIGATION RESULTS & RECOMMENDATIONS

5.1 Clinic Building Exterior

5.1.1 Building Standoff

• Vulnerability: Currently Building 1 has unscreened vehicle travel within the 50-foot standoff along the north, east, and west (gate left in open) sides. However, per PSRDM 3.3, no unscreened vehicles may travel or park within this distance. Per the 35% design, it is proposed to relocate the ambulance drop-arm gate to a position closer to the intersection that enters the parking garage (Figure 1, red circle). However, a simple drop-arm gate is not a sufficient means for vehicle screening, by UFC standards (one of the baseline references for the PSRDM).

Figure 1 – Building 1 Urgent Care 35% Designed Ambulance Control Gate Position

● Mitigation:

1) To establish proper vehicle screening for the ambulance-only vehicle space, establish triple authentication. This can be accomplished by arming the proposed drop arm gate with ID Card PACS, License Plate Reader (LPR), facial analytics camera

Grand Junction VA Medical Center Renovate Urgent Care Bldg 1 Physical Security Risk Mitigation Guidance

(observing the driver), and intercom (use as needed), all tied to the Security Control Center (SCC) and its PSIM (see concept, Figure 2).

This measure will also reduce the standoff within this restricted zone down to 5-feet, per PSRDM 3.3. Ensure to also install ASTM 2656 M30 rated anti-ram barriers on both sides of the drop arm gate system to prevent vehicle circumvention (recommend bollards, boulders, concrete planters).

Figure 2 – Triple Authentication Drop-Arm Gate for Vehicle Screening

Note 1: In the event an ambulance driver does not have an ID card to present for PACS (or ID card is not already pre-registered in the SCC’s P2000 PACS) then consider also arming the gate with a “YELP” mode siren-operated sensor opener.

Note 2: As part of SSTV design, instruction to VA Police: All facial analytics and license plate databases should be updated weekly with the terror watch list, felon list, VA-restricted personnel list and tied into the Security Control Center (SCC). This process discourages trespass by perpetrators due to observation, gives immediate alert of trespassers, gives SCC monitoring a view of suspicious visitors, as well as records all personnel for use in a court of law, if needed.

2) As for the standoff enforcement along the north portion of the

Urgent Care, a future physical security master plan project (via SCIP) will need to establish 50-foot standoff, screen vehicle travel along the north, blast protect Building 1 envelope, or mitigate the chances of a VBIED entering the campus via 100% campus vehicle screening. This project requirement is to be mentioned in the design narrative.

Grand Junction VA Medical Center Renovate Urgent Care Bldg 1 Physical Security Risk Mitigation Guidance

5.1.2 Building Construction/Envelope

5.1.2.1 Anti-ram:

• Vulnerability: Per the risk assessment, vehicle ramming ranks in the top 10 likely threats with high impact of loss. Amidst the west side of Urgent Care being restricted to ambulance traffic, the envelope and entry vestibules are still vulnerable to accidental/intentional vehicle assault.

• Mitigation: Per PSRDM 5.5.3.1 line the entire west side of Urgent Care and the MRI with ASTM F2656 M30 anti-ram barriers (recommend bollards, boulders, concrete planters) at a 5-foot standoff.

5.1.2.2 Blast Protection and Progressive Collapse (Tie-force Method)

• Vulnerability: IED (satchel, pipe, pressure cooker) ranks in the “top 10 likely threats, high impact of loss” per the risk assessment.

Although the threat of VBIED did not rank in the “top 10 likely threats, high impact of loss”, it does rank in the top 1/3rd (31 out of

Grand Junction VA Medical Center Renovate Urgent Care Bldg 1 Physical Security Risk Mitigation Guidance

87). Therefore, the blast requirements addressed in PSDM Chapters 6 and 7 are justified.

• Mitigation: The structural and envelope construction of the

Building 1 Urgent Care west expansion must be constructed of same IBC classification as the existing Urgent Care and shall meet the criteria of PSRDM Chapters 6 & 7. These requirements are in addition to the requirements for conventional structural design, including the provisions for hurricane, earthquake, and any other extreme loading condition required by code. Since the category of this building is Mission Critical (MC) the magnitudes of W1, W2, and GP2 are defined in the Physical Security Design Standards Data Definitions, a document separate from this report.

The values will be provided on a need-to-know basis to the blast/structural engineers performing analysis and design of VA projects. It is understood that Paradigm’s Structural Blast Engineer will receive these values from the VA Central Office (Fred Lau fred.lau@va.gov), conduct all dynamic modeling, and thus render structural design as it pertains to blast mitigation.

Urgent Care West Expansion

The structural and envelope construction criteria of PSRDM Chapters 6 & 7 is summarized below (as applicable to the expansion scope).

1) Blast Resistance: Structures shall be constructed to withstand the peak pressures and corresponding impulses produced by the design level explosive threat (W2) located at the minimum standoff distance of 50 feet and the design level satchel threat (W1) that may be delivered to the pedestrian entrance (which is already prescribed to serve as a screening vestibule).

Standoff distances provided more than 50 feet may not be accounted for in the calculation of the blast loading environment. Regarding blast design for a MC facility, after a blast the building is required to remain fully functional and economically repairable (minimal damage, not to impede operations).

2) Progressive Collapse: Two stories and under is exempt from progressive collapse requirements per PSRDM.

3) Exterior Wall Protection (Envelope): Per PSRDM 6.2.3, for building renovations, upgrades, modernizations, or additions in which a non-load bearing exterior wall is being replaced, the mailto:fred.lau@va.gov

Grand Junction VA Medical Center Renovate Urgent Care Bldg 1 Physical Security Risk Mitigation Guidance replacement wall must comply with the requirements defined in Section 6.2 Non-Load Bearing Exterior Walls.

Non-load bearing exterior walls shall be designed such that they have some permanent deformation but are generally repairable in response to the calculated peak pressures and impulses resulting from the design level vehicle threat (W1) located at the minimum standoff distance of 50 feet, but no greater than GP2.

a. Walls shall span from slab to slab and shall not be attached directly to gravity load bearing elements (such as columns and shear walls) unless an advanced analysis of the load bearing element demonstrates it can accept the maximum blast forces transferred by the members framing into it without compromising its load bearing capacity.

b. Walls shall be able to accept the tributary loads transferred from glazed fenestration and doors in addition to the design level blast pressures applied directly to their surface.

4) Façade Fenestrations (Windows, Atria Enclosures, Skylights):

All façade fenestrations shall be designed to crack but remain in the frame in response to the calculated peak pressures and impulses resulting from the design level vehicle threat (W1) located at minimum standoff distance of 50 feet, but no greater than GP2. Standoff provided more than the 50 feet or increased distances over the height of the building may not be accounted for in the calculation of the blast loading environment. All blast resistant design requirements are in addition to the requirements of the VA Window Specifications.

The use of operable windows for blast resistant design is discouraged; however, where operable windows are required, their performance must be demonstrated with acceptable explosive (or shock tube) test data while in the open position.

a. Glass: All new exterior glazing is to use laminated glass.

For insulated glazing units (IGUs) the laminated glass is required only for the inner lite. Glass performance shall be based on probability of failure of 500 breaks per 1000.

b. Glazing: The glass shall be restrained within the mullions with a minimum ½” bite and a 3/8” continuous bead of structural silicone adhesive…