Seven months have passed since the deadliest mass shooting in modern U.S history. By now, many details of that October evening in Las Vegas are well known: the lone gunman in a 32nd floor suite atop the Mandalay Bay Hotel, the arsenal of firearms, the terrified concertgoers below. The shooting lasted 11 minutes, according to investigators.
In the months since, the tragedy continues to present difficult questions for the hotel industry and mega-event promoters like Live Nation and A.E.G, which put on the biggest outdoor festivals in the country and a large percentage of the live indoor concerts in North America.
These security issues will be back in the spotlight, now that the busy summer travel and concert season is ramping up. In the coming months, millions of Americans will fill flagship hotels and music festivals across the country — even though the prospect of a hostile attack weighs heavily on the national consciousness. The American public’s concerns about attending crowded events are at a new high. In a 2017 Gallup poll, 38 percent of U.S. adults said they were less willing to attend events with large crowds out of concern the events could become a terrorist target. (By comparison, immediately after the 9/11 attacks, 30 percent of Americans said they felt the same way.) A separate Gallup poll taken days after the Las Vegas shooting found that 39 percent of Americans are “very” or “somewhat” worried that they, or a loved one, will be a victim of a mass shooting.
There have been several high-profile attacks on concerts in recent years, including the 2015 Bataclan attack in Paris and the 2017 suicide bombing at an Ariana Grande concert in Manchester, England. The Las Vegas attack was, however, the first mass shooting at a hotel in the U.S., and it served as a reminder that attacks on entertainment events are a worldwide emerging threat. As investigators looked into the travel and internet search history of Stephen Paddock, the Las Vegas shooter, they found that he had also booked hotel rooms overlooking the Lollapalooza music festival in Chicago, and a room with views of the Life Is Beautiful Festival in Las Vegas a week before his assault.
The attack Paddock carried out — from a hotel with robust security and a state-of-the-art surveillance system — left many industry insiders and security experts stunned.
“They were in a state of disbelief that one shooter could do so much damage and especially from the Mandalay Bay Hotel in Las Vegas, which has excellent security,” said Dick Hudak, the founder of Resort Security Consulting and the former director of worldwide security for Sheraton Hotels and Resorts. Paddock killed 58 people and injured more than 700. “The mystery, ” says Hudak, “is why did all that security not deter the shooter or prevent him from doing the damage that he did?”
In the hospitality industry, the attack prompted a period of soul searching, said Deanna Ting, the hospitality editor at the travel and hospitality trade magazine Skift.
“Almost immediately, I think everyone in the hospitality industry wondered how this could impact what we do now,” Ting said.
Security concerns did not stop the roughly 125,000 festival goers from flocking to the desert outside of Indio, California, for both weekends of the Coachella Valley Music and Arts Festival in mid-April, the first major outdoor music festival in the U.S after the Las Vegas shooting, and a crucial early test of the industry’s response. The festival’s promoters Goldenvoice and AEG Presents, introduced some experimental security measures and more intensive planning, which included working with all levels of law enforcement to secure the event.
“It takes all security professionals to work together with federal, state and local partners, private sector security companies,” Ashour Ebrahim, Director of Health and Safety for AEG Presents, Goldenvoice’s partner in Coachella, said in an interview at the XLIVE conference, a conference about festivals and live events. “How are we going to try to prevent these [mass shooting] events from happening? That takes a lot of proper planning in order to see what the needs are.”
For the first time in Coachella’s 19-year history, organizers used surveillance drones to monitor the vast grounds of the festival. The drones were operated by a third party and had some limitations: they could not fly directly over crowds or cars unless there was a public safety issue. “With a drone we can get somewhere super quick where it would take an officer [more] time,” Sgt. Daniel Marshall of the Indio Police Department.
For months ahead of the festival, a security company called Emergence also trained Goldenvoice security and police officers in “predictive threat analysis,” a security technique that focuses on spotting signs of trouble and disrupting attacks before they take place. At Coachella, this involved teaching security personnel how to spot seemingly insignificant details that could signal something amiss, like the appearance of a new trash can on the festival grounds or a concertgoer who is not paying attention to the concert. Badour said there are often non-verbal behavioral cues given off by an assailant before an attack begins.
The behavior cues at the core of preventive security analysis are typically so minor and seemingly insignificant that they’re hard to find. Yousef Badou, the founder of Emergence, uses a photo of the Boston marathon bombers as an example in his trainings. In it, the two Tsarnaev brothers stand near the finish line. But instead of watching the race itself, they are intensely focused on the spot where they will soon lay their bags filled with explosives.
“There has been an increase in these incidents,” Badou said. “Everyone is paranoid, and they are looking for threats everywhere. With my training, you focus these observations,” he said.
These security upgrades are expensive, though the details aren’t clear because information on how much companies spend on security isn’t typically public. And as security costs for hotels and event promoters increase, concertgoers in the U.S. may see slightly higher ticket prices. According to a Bloomberg report, the average safety cost for festivals in France climbed by $15,000 per day the year after the Bataclan attack in Paris. The music publication Billboard reported that security spending for major festivals could increase by $100,000 to $250,000 per festival in 2018. This should only translate to a minor increase in ticket prices though: a $2 to $5 increase per ticket for a 50,000-person festival.
Preventing another Paddock
Police say Stephen Paddock planned his attack in Las Vegas at least a year in advance. In the days leading up to the shooting, Paddock was able to bring more than 23 rifles into his hotel room, set up a hidden camera in the hallway outside of his room, and drill L-brackets into the 32nd floor stairwell door and his suite to delay police from entering.
Immediately after the shooting, high-profile properties around the city implemented visible security changes. Wynn Resorts, for example, placed guards at the entrance to the building to scan visitors and their bags. The Mandalay Bay Resort & Casino placed 24-hour guards by the elevator banks at the hotel where Paddock carried out his massacre.
Yet hotel security experts remain skeptical that there’s much they can do to detect when someone is planning an attack. And some have even resigned themselves to the impossibility of the task. “Hotel professionals know they can’t keep track of every bag that guests take up to their room,” said Todd Seiders, the director of risk management at Petra Risk Solutions, an insurance brokerage firm for the hotel industry. “The hotels know they are soft targets, but they also have to balance guest experience. They want hotel security, but they do not have many options.”
The debate over MGM’s do-not-disturb policy is an example of the challenges hotels face in striking the right balance between security and user experience. Steve Wynn, the longtime CEO of Wynn Resorts criticized MGM Resorts for leaving Paddock alone during the days before the shooting.
“That would have triggered a whole bunch of alarms here,” Wynn said in an interview with Fox News shortly after the attack. (Wynn stepped down as CEO earlier this year amid allegations of sexual misconduct). Mandalay Bay’s do-not-disturb policy was also cited in a lawsuit filed by more than 1,400 survivors and victims’ families against MGM Resorts and Live Nation, the festival promoter. Paddock “closed the door and barricaded himself inside,” Muhammad Aziz, an attorney for the plaintiffs, said in an interview in January. Aziz said that hotels on the Las Vegas strip were well aware that they were a soft target for an attack. An important question, he said, is “whether the MGM staff had training in how to detect someone with hostile intent.”
In a statement to the Newshour, an MGM Resorts spokesperson said the company works “closely with local, state and federal law enforcement to develop and execute security plans and procedures specific to each event. We are constantly evaluating and refining our security procedures.”
After the shooting, Wynn Resorts, Hilton and Disney Resorts all changed their internal policies regarding do-not-disturb signs. In October, Wynn Resorts issued new guidance that staff investigate if a sign is in place for more than 12 hours. At the Hilton, this means that staff must now inform security or managers if a sign has been in place too long. Walt Disney World changed its signage from “do not disturb” to “room occupied” in late December at four of its resort properties in Florida. Disney also required a hotel employee to enter hotel rooms at least once a day.
Still, some security experts have criticized the hotel industry’s response to the Las Vegas shooting, arguing that hotels haven’t focused on the core problems. Mac Segal, a security consultant for the executive protection company AS Solution, said that the hotel industry has largely focused on “security theater,” adding measures that calm their guests’ safety fears without fundamentally preventing or mitigating threats.
Segal said the changes to rules around do-not-disturb signs do not represent a fundamental shift in security. Others agreed. “The do-not-disturb sign does not preclude hotel staff from entering the hotel, [it] never has. It’s a customer service request by the guest to be considered by the hotel,” said Stephen Barth, an attorney and hospitality professor at the University of Houston who said he supports the policy changes.
Indeed, the Las Vegas Police Department’s investigative report on the shooting indicated that Paddock was far from shut-in during his six-day stay at the Mandalay Bay. He interacted with hotel staff at least 10 times and spent hours on the casino floor, according to the report. Although Paddock was always present when housekeeping cleaned the room, the day before the shooting, Sept. 30, 2017, was the only day he declined cleaning services.
And the debate over how to monitor hotel guests once they’ve checked in doesn’t even get at the difficulties of dealing with guests who are in legal possession of a firearm. Marriott CEO Arne Sorenson touched on the challenge at an event shortly after the shooting. The intersection of guns and hotel security is a “tough space for us,” Sorensen said. “We do all the things to do the best we can in that space, and then we pray.”
Readiness is rare
Rigorous response plans remain rare across the hotel and concert industries, and when they do exist, they’re often lacking, said Greg Crane, the founder of Alice Training Institute, an active shooter readiness program.
Announcing a “shelter in place” warning to customers is a common active shooter response plan for many private businesses, including hotels, Crane said. But that is a “horrible way” to deal with active shooter situations, he added. In Las Vegas, there was no way to announce to the crowd at the outdoor music festival that it was under attack, and at first, some concertgoers mistook the gunshots for fireworks. Crane said the policy should be to announce to the public all information that is known at that time. If there is an active shooter or a suspicion of one, including that in the announcement is essential, he said.
Daniel Rivera, who leads an active shooter training program for the Department of Homeland Security, said he asks the attendees at the start of every training session if their company has an active shooter emergency plan. “I would say 5 percent of people in the class raise their hands,” Rivera said. When Rivera asks those with their hands raised if they actually know the plan, “all of those hands drop,” he said.
In the U.S., there are no common security standards across the hospitality industry. Most exit plans are based on fire code regulations. And when a shooting takes place, it often plays out incredibly fast. “Whether it is a 45-minute response or a five-minute response, it still left a lot of time for these lunatics to hurt a lot of people,” Crane said. Segal argued that there has to be a significant shift in the way hotels, businesses and concert venues think about security. That change “will save lives,” he said. But it hasn’t happened yet.
The pace of progress in security policy changes stands in marked contrast with changes in public perception about mass shootings. A CNN poll in February found that nearly two-thirds of adults believe that mass shootings can be prevented; the first time since the Columbine shooting in 1999 that a majority of Americans felt that way.
In April, MGM Resorts confirmed it was forming a SWAT team-style security unit in Las Vegas that may also be used at other MGM properties.The “Emergency Response Team” includes former Las Vegas SWAT and military officers and will be led by a former Marine Corps sergeant, the Las-Vegas Review Journal reported.
Today, an impromptu healing garden filled with daffodils sits on the festival grounds in Las Vegas where 58 people lost their lives. The 32nd floor of the Mandalay Bay hotel is now gone; in February, the hotel renumbered its floors, erasing any physical marker of its existence. And Mandalay Bay says that room 3215, where Paddock stayed, will never again be open to guests.