Unattended Bag Analytics at Central Station
Central Station has 42,000 daily entries and 180 cameras. Six months ago the agency deployed video analytics that flag unattended bags. The system generates about 200 alerts per day, and security staff estimate 95% are false alarms caused by shoppers setting down bags, cleaners, and shadows. The security operations center has two dispatchers; when alert volume spikes, they silence alerts after about 30 seconds. Last week a real unattended bag with a suspicious item sat near a fare gate for 22 minutes before a cleaner reported it. Police want every alert retained and reviewed. Operations wants the alert threshold raised sharply to reduce nuisance alarms. The vendor says the threshold is adjustable and that the contract requires at least 90% detection. The security director must decide what to change.
1. Conduct a risk assessment of the current unattended-bag detection process. Identify the failure modes and their relative priority.
Read the worked answer
The process has four stages: detection, triage, response, and governance. The highest-priority failure is triage collapse: 200 alerts per day against two dispatchers produces about one alert every 2-3 minutes, and silencing after 30 seconds means alerts are dismissed before meaningful video verification. That creates desensitization and explains the 22-minute dwell time for a real bag. The second failure is detection tuning: a 95% false-alarm rate is operationally unsustainable, but raising the threshold without measuring true-positive capture could suppress real events. The third is response: there is no clear escalation trigger, no timer for unattended bags, and no assigned ownership after an alert is acknowledged. The fourth is governance: the contract's 90% detection requirement is not tied to field-validated performance or false-alarm limits. Prioritize triage and response redesign first, then tune detection with measured data, then renegotiate performance metrics.
2. Recommend changes to alert thresholds, procedures, and staffing. Justify with expected effects.
Read the worked answer
Recommend a two-tier triage model. Tier 1 is automated verification: the analytics should send only alerts that persist beyond a defined dwell time, such as 60-90 seconds, and should include a short clip and camera location. Tier 2 is human verification by a dedicated dispatcher who checks the live view, tags the object, and either clears it or escalates within 60 seconds. Do not simply raise the threshold to reduce volume; tune it in steps while measuring missed detections using test objects and audit samples. Add one dispatcher at peak or create a roving verification role. Set a hard rule that no unattended-bag alert is silenced without a documented disposition. Track time-to-verify, percentage of alerts verified within 60 seconds, confirmed true positives, and false alarms per camera per day. Expected effect: lower nuisance volume without reducing true-positive capture, faster response, and auditable decisions.
3. What should the after-action report and training program include?
Read the worked answer
The after-action report should reconstruct the 22-minute timeline, identify who received the alert, what actions were taken, why the bag was not escalated, and whether staffing or system design contributed. It should distinguish system performance from human performance and avoid blaming a single dispatcher. Recommendations should include a revised unattended-bag checklist, a 60-second verification standard, escalation triggers for police and transit police, and a test-and-audit schedule using staged objects. Training should cover recognition of suspicious versus ordinary items, privacy limits, documentation, and the authority to close a platform or train. It should include drills with realistic alert volume and a debrief that measures decision time. Finally, the report should assign owners and due dates and be reviewed by the safety and security committee.