21 June 2017, List of security/fire failures, Resorts World Manila attack (updated from 20 June)

Below is a list of security/fire failures regarding the 2 June 2017 active shooter assault on the Resorts World Manila (RWM) complex – specifically, the Maxims Hotel and the casino attached to it. These issues were identified by Philippine lawmakers,* RWM staff, the Manila Bureau of Fire Protection (BFP), and Muir Analytics. They are arranged by major category. This is by no means the final analysis, and hoteliers, security specialists, liabilities lawyers, and insurers are urged to continue to refine this list as more pertinent information becomes available.

*Official hearings, Wednesday, 7 June 2017, held at NAIA-3, the Committee on Public Order and Safety, and the Committee on Games and Amusement.

It should be noted that, despite the many failures listed here, RWM security did successfully evacuate over 12,000 guests through 13 exits during the turmoil. This demonstrates the guard force did have some cohesive emergency procedures in place, and it did exercise a high degree of competence and good leadership regarding this specific issue.

Additionally, despite lacking close quarters battle (CQB) training, the armed RWM force did manage to engage and wound the attacking gunman, which greatly contributed to the eventual endgame of this scenario, messy as it was. In doing so, these security personnel demonstrated a degree of bravery, which should be recognized.

Finally, it should be mentioned that RWM stated on 2 June that it would offer the victims’ families “full support and assistance.” Most hotel brands would not have offered such support. This is a rare occurrence, and a positive one. For a fuller brief on this subject, see the “Features” section of the SecureHotel website.

Intelligence

Failed to heed threat warnings and security increase requirements: Well before the attack, the Philippine Amusement and Gaming Corporation (PAGCOR) issued a warning to all casinos to increase security in light of the ongoing ISIS threat (a result of the ISIS-related Maute Group siege of Marawi City, which began 23 May; the point being that the RWM gunman used terrorist tactics, so counter terror security upgrades would have helped here.)
The PAGCOR warning specifically said for all casinos to: “Increase security preparedness in their respective venues and properties to ensure safety of [their] employees and guests,” and “abide by the rules in curfew and other city ordinances that may be issued by the local government and other government agencies.” Following the advisory was a requirement, not a suggestion, said PAGCOR.

Inadequate personnel/training

(PAGCOR said that, overall, RWM did not have adequate, competent, and properly equipped security personnel – Muir Analytics would caution that the successful evacuation of over 12,000 guests demonstrated at least some level of competence and effectiveness, and a total lambasting of RWM is too broad.)

Security manager not properly vetted: RWM Security Chief Armeen Gomez misrepresented his college degree, and the exact nature of his private security training, which can be effective and professional, remains unclear (though he seemingly had a practical measure of security experience, possibly 10 years, and his record while at RWM was reportedly first-rate.)
No apparent CQB training: When RWM security finally engaged the gunman in the hotel stairwell; CCTV video clearly shows they had little, if any, knowledge of CQB from their multiple mistakes such as framing doorways, etc.
Inferior guard-subcontracting sector: The RWM guard force manning the casino, reportedly contractors from the NC Lanting Security Specialist Agency, came from a sector widely criticized for being overworked in 12-hour shifts, poorly trained, underpaid, and having no social security. This results in a contract guard force that is less than motivated.

Physical security program

(Including security resource allocation and crisis response.)

Lack of security personnel at the casino-hotel entrance/taxi drop-off and parking garage areas: These are two access points the gunman passed through, and they were not manned by security.
Improper placement of armed/unarmed security forces: RWM policy posted armed security guards outside the casino-hotel and forbade them from being inside the establishment. The reason given was that armed security inside the establishment “would escalate the situation,” according to RWM Chief Operating Officer Stephen Reilly.
Inadequate quick reaction force/emergency response procedures: The gunman had free reign of the facility for approximately 30-45 minutes despite there being 200 security personnel on premises (for the entire resort, not just the casino and Maxims Hotel.)
Improper active shooter protocols: RWM active shooter/counterterror reaction policy, according to Security Chief Gomez, was to notify the police and let them engage the hostile actor(s). Modern day active shooter protocols require immediate and aggressive engagement of the hostile actor(s) by security personnel closest to the attacker.
Poor guard shift management: There were few guards assigned to the 12:00-7:00 am casino shift.
Poor guard team structure: The guard force did not use a “buddy system” (two-person teams) in case of emergency or a hostile act, which caused the guard force to deal with problem personnel one-on-one, a distinct disadvantage.
Guards were not at their posts in the Maxims Hotel/casino, or they abandoned their posts when the attack began: COO Reilly, narrating the CCTV footage of the path of the gunman through the hotel and casino, revealed at least five places where there should have been guards, but there were none.
No intelligence/data supported access control: The gunman was able to enter the facility despite being barred from all state-sponsored/operated casinos (“player exclusion order,” issued 24 March.)
Poor physical access control at casino entrance: The gunman refused to pass through a metal detector and easily pushed his way past a lone female guard at the interior casino entrance (again, a “buddy system” would have helped here.)
No Identification, Friend or Foe (IFF) procedures: As the police and RWM security maneuvered through the Maxims Hotel/casino complex to clear it of hostile threats, police shot and wounded an armed RWM security guard, thinking he was the/a gunman. Clear private security-police IFF procedures, to include recognizable IFF identification tactical garb or markers (such as fluorescent strips,) would have helped prevent this shooting. Joint tactical training in this regard would have been helpful as well.

Situational awareness/command and control (C²)

(Entire facility has 2,500 CCTV cameras.)

Lack of C²: As the attack unfolded, there seemed to be a lack of C² and leadership spearheading a coordinated emergency response – this assertion based on the minimal actions taken by Security Chief Gomez and the broad inaction of the guard force – except for the efficiencies listed at the beginning of this list. All information to date also suggests that there was little coordination with police once they arrived on scene. The below issues add to the lack of C²/leadership observation.
Hysteria overran true situational awareness: As the masked gunman began shooting, gamblers, hotel guests, and the security force assumed it was a full on, ISIS terrorist attack. Security Chief Gomez said, “It was obviously a far superior force being executed by a perceived terrorist…some were even shouting, ‘ISIS! ISIS!’ With these assumptions at that point, we immediately realized that it’s beyond our capacity already, that’s why within 1 minute, we immediately notified the PNP [Philippine National Police] for reinforcement.”
CCTV personnel did not warn of suspicious behavior: The gunman demonstrated suspicious behavior – all picked up on CCTV – by toting a large backpack in the elevators heading toward the casino (he did not behave/appear like other gamblers) and also by putting on what appeared to be a surgical mask. People in the elevator were alarmed at his behavior; CCTV personnel should have been as well.
CCTV personnel did not provide situational awareness/on site intelligence to security operators: As the attack unfolded, CCTV personnel in the backup/alternate CCTV site reportedly did not provide real time intelligence to RWM’s security team or police regarding the gunman’s activities and location (the main CCTV site was abandoned 13 minutes into the melee.) Nor did they set the “ISIS terrorist attack” claim straight by alerting RWM security/police that the attacker was a single gunman. RWM showed Philippine National Police Chief General Ronald dela Rosa the alternative CCTV site 45 minutes after he arrived at the Maxims Hotel/casino, which was at 2:20 am. (It does appear likely however, that at some point, RWM CCTV personnel showed police that the gunman ended up on the 5^th floor of the Maxims Hotel where SWAT secured his body.)

Fire safety

Sprinkler system only partially effective: The sprinkler system worked in dousing the flames of the fires started by the gunman, but it did not prevent toxic smoke from continuing to fill the casino. National Capital Region Chief Rico Tiu of the BFP said that firefighters were necessary to decisively douse the flames and smoke.
Firefighters could not gain access to the fire: BFP Chief Tiu said that, although his firefighters arrived on scene about 10 minutes after receiving the emergency call, they could not enter the building to fight the fire and rescue people because security forces had yet to neutralize the gunman.
Inadequate ventilation system: It does not appear that RWM had a ventilation system that was capable of venting smoke out of the venue.
Possible use of toxic furniture materials (when burned): Information to date suggests that the toxic smoke that caused most victims to perish came from furniture coverings and possibly carpet that turned extremely toxic when burned. (This observation might change as more information becomes available.)
Failed fire evacuation procedures of impact areas: Most of the 37 victims (10 female and 12 male guests, and 10 female and 3 male employees) died of smoke inhalation while sheltering in place in a casino bathroom (18 people,) or in a side gambling salon (as many as 19 people, this room was 2 meters from an emergency exit) for fear of being gunned down.* No RWM security forces accounted for these guests, nor did anyone tend to their evacuation.