Threat Detection at Events: A Collaborative, Layered Approach

Special events, especially large-scale gatherings, are highly visible and increasingly attractive targets for threats and terrorism. These events provide a platform where the impacts of harmful actions can be amplified, seen, and felt by many. Disruptions at events can vary significantly in scale, from minor incidents, such as a lone protester interrupting the Microsoft 50th Birthday Celebration, to major tragedies like the 2025 vehicle attack and attempted bombing on Bourbon Street in New Orleans. Threats may be confined within secure perimeters or target soft areas such as fan zones and entertainment districts. In some cases, they extend beyond the immediate venue, as seen in the thwarted bombing attempt outside a Taylor Swift concert in August 2024.

Preventing such disruptions and, more critically, the next tragedy, requires a multilayered approach encompassing assessment, monitoring, communication and coordination, and education throughout all phases of an event. While this article focuses on large events, it is equally important to recognize that smaller events may also be potential targets. The concepts discussed are scalable and should be applied appropriately based on the event’s scope.

Event Risk Assessment

Long before the first ticket is sold, organizers must conduct a comprehensive risk assessment of the event’s scope, location, facilities, and infrastructure. Risk assessments are an integral part of the event planning process, helping to identify potential hazards early and apply control measures to eliminate or reduce the hazards. By proactively addressing these risks, planners can prevent unnecessary operational impacts as well as emergencies that might strain jurisdictional resources and require public safety responses. At first glance, the focus may naturally fall on physical elements such as security vulnerabilities, access points, evacuation capabilities, perimeter fortifications, weather shelters, and environmental hazards.

While these elements are vital, a deeper assessment is also needed to evaluate intangible risks. Considerations such as the anticipated crowd characteristics, performer histories, involvement of opposing interest groups, current political climate, and technology vulnerabilities are all elements of a risk profile. Event planners must also account for potential risks beyond the venue or event site’s perimeter, known as the external zone. Although incidents in the external zone may fall outside the event’s direct control, they can still affect the event, and, conversely, incidents at the event can have an impact on surrounding public infrastructure.

Building Relationships With Public Safety

To match their expertise in event production, organizers need the support of emergency preparedness subject matter experts. Federal, state, and local agencies can provide invaluable guidance in both preparedness and response within their jurisdictions. Building relationships grounded in mutual respect can yield significant benefits when coordinating emergency action plans, especially in the realm of intelligence sharing.

Agencies should make themselves accessible to organizers. Prominently displaying contact information on jurisdictional websites can encourage outreach from event organizers. Once connections are made, setting up regular pre-event meetings with relevant stakeholders on both sides helps ensure collaboration. Creating plans for information-sharing allows both groups to exchange insights about evolving conditions around the event. Shared intelligence might amount to nothing, or it might reveal critical threats or vulnerabilities.

Developing an Event Threat Monitoring System

Fusion centers often play a direct role in supporting special events. Events can be voluntarily submitted to the Department of Homeland Security’s Office of Homeland Security Situational Awareness for an assessment. Events falling below the level of a National Security Special Event, may be assigned a Special Event Assessment Rating, which determines the level of federal, state, and local support resources provided.

Just as the nation depends on fusion centers to detect, prevent, and respond to criminal and terrorist activity across agencies, event organizers should develop internal systems to monitor, mitigate, and escalate concerns, whether or not the event has been assigned a formal rating. Events have an advantage: numbers. With hundreds or thousands of staff, vendors, volunteers, attendees, and even members of the surrounding community all observing the event, organizers can tap into a robust intelligence network through a multilayered, crowdsourced approach. Crowdsourcing facilitates the collection of information and the generation of insights either over time or in real time, often leveraging online platforms and social media networks.

Here are examples of such layers:

• “Before You Leave Home” or “Know Before You Go” emails encouraging patrons to report suspicious activity
• On-site announcements as part of a safety script
• Reporting mechanisms integrated into the event website and app
• QR codes on signage leading directly to reporting tools
• Training and pre-shift safety briefings for staff and volunteers
• Social media monitoring for relevant chatter
• Internal reporting forms or dedicated emails for crew members

All reports should flow into a centralized system, where trained staff can review and assign resources, or escalate concerns to authorities as needed. Even reports that do not meet the threshold for escalation should be logged to monitor emerging patterns or threats.

Real-Time Monitoring During the Event

On event days, these systems can be enhanced by establishing a centralized coordination hub using unified command principles to support communication and decision-making. This could take the form of separate nodes for event and emergency personnel, a joint command post, or, depending on the scale, a hybrid of both. Technological tools such as closed-circuit television, crowd-monitoring systems, and drones can provide instant insights into crowd behavior, conduct reconnaissance, or detect breaches in security protocols. Incident management platforms enable rapid deployment of assets and resources in response to evolving situations.

Training and Exercises

Knowledge is power, but only if it is shared. Event staff and volunteers need tailored training to recognize and respond to suspicious activity with confidence. Even basic guidance can empower potential tipsters who might otherwise hesitate to speak up. For instance, those answering event phones or emails should be trained on handling a bomb threat. Volunteers assisting patrons should know what behaviors warrant a report and how to escalate concerns. Robust reporting systems are only as effective as the people trained to use them.

Before the event, organizers and jurisdictions should coordinate a joint tabletop exercise with key stakeholders. This provides an opportunity to test information flow, communication protocols, and response plans. A post-exercise “hot wash” helps identify and correct any gaps well before event day. Importantly, these exercises also allow participants to build familiarity with one another. The first time that event organizers and public safety officials meet should never be during an emergency.

Next Step: A Coordinated Approach

Special events are intended to celebrate and bring communities together. However, evolving domestic and international threats continue to increase the complexity of security planning. With the growing number of high-profile, mass-gathering events on the horizon, it is essential to implement a coordinated approach that combines assessment, relationship-building, intelligence monitoring, real-time communication and coordination, and training to transform potential vulnerabilities into strengths.

For more detailed guidance, event stakeholders can consult the Event Safety Alliance’s Event Safety Guide, FEMA’s Sport and Special Events Management course series, and American National Standards Institute (ANSI) event safety standards, including ANSI ES1.6-2025 Event Safety – Communications and ANSI ES1.40-2023 Event Safety – Event Security. Risk assessments and the external zone are discussed in more detail in courses AWR-167 Sport and Special Event Risk Management and MGT 466 Sport and Special Event Enhanced Risk Management and Assessment.