Commercial Facilities Sector Perspectives

The Commercial Facilities Sector is one of the 16 critical sectors identified by the U.S. Department of Homeland Security. The versatility, resilience, and capacity of commercial facilities are exemplified by the fact that they often serve as shelters during disasters. In January 2024, fans near Houston’s NRG Stadium were urged to shelter in the stadium and other areas due to severe winds prior to the start of the College Football Playoff Championship. During the coronavirus pandemic in 2020, an indoor training facility at Arthur Ashe Stadium was used as a makeshift hospital for COVID-19 patients. During the devastating Maui fires in the summer of 2023, residents needing to evacuate farm and ranch animals were offered the use of Oskie Rice Arena. In 2007, wildfires in San Diego prompted the largest evacuation in the region’s history and 15,000 evacuees to use Qualcomm Stadium for shelter.

What Makes This Sector Critical to the Nation and What Possible Effects Does It Have on States and Local Communities?

The commercial facilities sector includes sites and properties used to conduct business, purchase retail products, and enjoy recreational events and accommodations. Although most of the industry is privately owned and operated, it includes publicly traded companies and some publicly owned buildings, such as the approximately 17,000 public library locations (there are only 19 private, membership-based libraries) and 33,000 museums (only 59 art museums are private). The assets range from small nightclubs to large stadiums that can host national special security events (NSSEs).

The U.S. government divides the sector into eight subsectors to coordinate facilities with similar functions, operations, and security issues:

• The entertainment and media subsector includes media production facilities (e.g., television and motion pictures), print media companies (e.g., newspapers, magazines, and books), and broadcast companies (e.g., television and radio stations).
• The gaming industry includes commercial and tribal casino operators, cyber and physical assets, suppliers, and other affiliated entities.
• Lodging includes nongaming resorts, hotels, motels, hotel-based conference centers, and bed-and-breakfast establishments.
• The outdoor events subsector comprises amusement parks, fairs, exhibitions, parks, parades, marathons, and other outdoor venues and events.
• Public assembly includes assets where large groups of people gather, such as convention centers, auditoriums, stadiums, arenas, movie theaters, and cultural properties like museums, zoos, planetariums, aquariums, libraries, and performance venues.
• Real estate includes office buildings, office parks, apartment buildings, multifamily towers, condominiums, self-storage facilities, and property management companies.
• Retail includes tenant space in enclosed malls, shopping centers, strip malls, and freestanding retail establishments.
• The sports leagues subsector comprises major sports leagues and associations.

Commercial facilities dominate the U.S. economy, contributing trillions of dollars to the U.S. gross domestic product while employing and supporting millions of jobs. Federal, state, and local-level entities use these facilities to run the government, conduct business, purchase retail products, and enjoy recreational events and accommodations. The entertainment and media subsector and retail subsector are two of the most critical to the nation’s economy, with 2022 revenues of $2.32 trillion and almost $5 trillion, respectively. Within the entertainment and media subsector, the film and television industry employs 2.4 million people in every state across diverse skills and trades. The gaming subsector similarly has a national impact; some form of gaming is legal in all but four states. And the retail subsector supports one in four U.S. jobs – 52 million working Americans.

What Are This Sector’s Key Assets and Interconnected/Interdependent Systems (Physical or Cyber)?

Commercial facilities are built to be resilient. They must withstand substantial human traffic, weight from office and other equipment, and adverse weather. Thus, most commercial buildings use structural-grade building materials with proven reliability that can resist the loads and stresses acting on the structure. The building materials comprise natural (e.g., stone and wood) and manufactured (e.g., concrete and steel) building materials.

Once built and occupied, commercial facilities require many systems and services inside. For example, they need electrical power, water – including potable water – waste removal, telecommunications, and internet access.

Almost all the sector’s subsectors also require private and public sector security. Some government offices reside within commercial facilities as tenants, so the facility and government must collaborate on security. For NSSEs, including major sporting events, the U.S. Secret Service is the lead agency for planning, coordinating, and implementing security operations. Cybersecurity requirements for NSSEs include ensuring the Secret Service and the supporting contractor protect personally identifiable information for credentialing production. The Federal Bureau of Investigation (FBI) is the lead federal agency for crisis management, counterterrorism, hostage rescue, and intelligence. The Federal Emergency Management Agency (FEMA) is the lead federal agency for consequence management (response and recovery operations).

What Are This Sector’s Dependencies (Physical, Cyber, Geographic, and Logical) and Interdependencies With Other Critical Infrastructures?

Commercial facilities could not sustain operations without the water and wastewater systems, energy, and communications sectors:

• The water and wastewater systems sector provides potable water, water for fire suppression systems, and wastewater treatment for commercial facilities.
• Electricity and natural gas accounted for roughly 94% of energy consumed in commercial facilities. According to the U.S. Energy Information Administration, in 2018, over 30% of energy use for commercial buildings, which includes health care and religious worship buildings, was for space heating – the most energy-intensive item in U.S. commercial buildings.
• In addition to communications required for telephone calls, commercial facility fire alarm systems use the communications sector for off-premises signaling. This signaling includes sending fire alarm notifications to a supervising station or public communication center to initiate the appropriate response, such as notifying the local fire department. The communications sector also relies on the commercial facilities sector. The former almost entirely houses its operations and critical nodes in commercial facilities.

In addition, the transportation systems sector allows employees and customers to travel to and from commercial facilities and enables these facilities to receive supplies. In turn, the transportation sector earns revenue from customers traveling to these facilities. The importance of this interdependency is evident before, during, and after some sports games when public transportation authorities increase transport availability and extend operating times.

Strong interdependencies also exist between the commercial facilities sector and the financial services sector. The latter needs commercial facilities to conduct daily business operations. All eight subsectors of the commercial facilities sector rely on all financial services sector categories: (1) deposit, consumer credit, and payment systems products; (2) credit and liquidity products; (3) investment products; and (4) risk transfer products.

As mentioned, government offices sometimes reside within commercial facilities as tenants. For example, the General Services Administration (GSA) leases office space in commercial buildings for federal agencies and manages the lease agreements. In December 2023, the GSA had over 7,600 leases with commercial properties. All levels of government that occupy commercial buildings also rely on private sector security, often in addition to government security.

What Are This Sector’s Current and Emerging Vulnerabilities, Hazards, Risks, and Threats?

In the U.S., the commercial facilities sector has suffered significant fatalities at the hands of foreign and domestic terrorists.

• The estimated number of people killed at the World Trade Center in the September 11, 2001, terrorist attack is 2,750.
• In the worst terrorist attack on American soil since the September 11 attacks, in June 2016, a gunman killed 49 at the Pulse nightclub in Orlando, Florida.
• Three employees and 15 children in the America’s Kids Day-Care Center, which was in the Alfred P. Murrah Federal Building in Oklahoma City, were killed in the 1995 truck bombing of the building.
• In August 2019, a self-described white nationalist killed 23 people at a Walmart in El Paso, Texas.

However, commercial facilities are also vulnerable to other threats and hazards.

Natural Disasters

Increasingly severe weather events – including water and climatic hazards such as hurricanes, tornadoes, and floods – can devastate commercial facilities. Hurricane Katrina caused almost $200 million in damages to the Louisiana Superdome, which sheltered 30,000 people during the disaster. Reportedly, roughly 730,000 retail, office, and multi-unit residential properties risk flood damage in the contiguous U.S., with over $13.5 billion annually in associated structural damage and $50 billion in economic impacts. As an indicator that the frequency and intensity of extreme weather events are increasing, nine of the top 10 costliest hurricanes in the U.S. have occurred since 2005, and five of the top 10 since 2017.

The commercial facilities sector is also prone to geological hazards like earthquakes and tsunamis. The U.S. Geological Survey and its partners in California assess that an earthquake in the San Francisco Bay region could result in business interruption. Damaged buildings could affect 40% of establishments and employees in central Alameda County. Industrial and warehouse establishments could experience disproportionate harm. A New Madrid Seismic Zone earthquake in the central U.S. could moderately or completely damage almost 170,000 multifamily residences and other commercial facilities in eight states, according to a 2009 study.

Construction of commercial facilities in flood zones, inadequate building codes, poor building practices such as placing critical facility structures (e.g., mechanical, electrical, and plumbing systems) below the base flood elevation, and inadequate business insurance can exacerbate the effects of natural disasters and extreme weather. Hurricane Sandy in 2012 and Hurricane Harvey in 2017 exemplified these additional factors.

Armed Attackers

Armed attacks at shopping centers, office buildings, and open arenas are difficult to predict or prevent, particularly given the sector’s open access design – a necessity that is vulnerable. Of the 333 active shooter incidents between 2000 and 2019, businesses open to pedestrian traffic had the most incidents at 96. In businesses open and closed to pedestrian traffic and malls, 147 active shooter incidents occurred – 44% of all incidents. Of the 178 mass public shootings (i.e., four or more victims murdered with firearms – not including the offenders) between 1966 and 2021, at least 60% occurred in the commercial facilities sector.

Another indicator of the sector’s vulnerability to armed attackers is that two of the deadliest mass shootings in recent U.S. history occurred at commercial facilities – the 2017 massacre at the Route 91 Harvest Festival in Las Vegas and the Pulse nightclub shooting in Orlando in 2016.

Pandemics

For at least the past two decades, government officials and virologists have repeatedly warned about the possibility of a global pandemic. This forecast came to fruition in 2020 with COVID-19. As occurred with COVID-19, another pandemic could severely threaten the large workforce of the commercial facilities sector, compromising facility operations or limiting services. Pandemics can spread easily through commercial facilities, as large groups congregate daily. Insufficient or inadequate ventilation, filtration, personal protective equipment, administrative controls (e.g., policies that encourage ill employees to stay at home without fear of any reprisals), work practices (e.g., social distancing), and engineering controls (e.g., installing sneeze guards between customers and employees) in commercial facilities could facilitate the spread of infections during a pandemic. Rising vaccine skepticism can also impact infection rates.

Internet Outages and Cyberattacks

The commercial facilities sector uses the internet for business intelligence, marketing, merchandising, ticketing, and reservations. A mass communications or cloud service failure leading to an internet disruption could affect large swaths of the sector and have cascading economic effects. Cyberattacks could pose a reputation risk, disrupt operations, compromise private information, and result in revenue loss or ransom payments.

The August-September 2023 hacking of MGM in Las Vegas paralyzed MGM-owned hotels from Las Vegas to the East Coast, affecting reservation systems, registration, room keys, and slot machines. The criminal actors obtained personal information, including social security and passport numbers. MGM estimates the attack cost the company $100 million and an additional $10 million in “technology consulting services, legal fees and expenses of other third party advisors.” The breach at Caesars in Las Vegas around the time of the MGM hack compromised Caesars customers’ driver’s license numbers and social security numbers. Caesars reportedly paid a $15 million ransom.

Theft

The commercial facilities sector, especially the retail subsector, is impacted by a range of theft crimes – including internal (employee) and external theft, fraud, and organized retail crime. The splintered nature of the retail subsector makes it difficult to collect reliable figures on theft, especially organized retail crime. However, recent estimates indicate roughly $112 billion in total losses in 2022. Additionally, intellectual property theft threatens a company’s ideas and inventions, including trade secrets, proprietary products, media, and software.

Explosive Devices

Attackers have used homemade explosives, or improvised explosive devices, to attack commercial facilities, causing mass casualties and property damage. Open public access, particularly facilities with limited screening, makes many facilities vulnerable to explosives. In 2022, there were 966 explosions in the U.S., 334 of which were bombings, although it is unclear how many were against commercial facilities. In 2020, on Christmas Day in Nashville, Tennessee, a bomb in a recreational vehicle detonated in the vicinity of several commercial facilities. The apparent target of the bombing was a vital but not well-publicized AT&T communications hub. The attack impacted several states’ emergency, health and healthcare, and airport services.

Commercial entities within or near government facilities can lead to collateral damage from attacks against those government facilities. As previously mentioned, 18 people at a daycare in the Alfred P. Murrah Federal Building in Oklahoma City were killed in the 1995 truck bombing of the building. Damage from the explosion covered an estimated 48-square-block area. The Regency Tower, a 24-story, 273-unit apartment complex located one block from the Murrah Building, sustained extensive structural damage.

Suspicious devices and hoaxes can significantly disrupt commercial facilities for hours. In May 2023, authorities reportedly evacuated two hotels within and just beyond the mandatory 640-foot evacuation zone after a man attempted to drive a large U-Haul truck close to the White House. In 2022, there were more than 5,500 reported suspicious or unattended package incidents and over 300 hoax device incidents.

Uncrewed Aircraft Systems

Malicious actors could use drones to gain security knowledge or private information about a facility or event, and the drones can also be weapons. Open-air events such as concerts, sports games, and political events are at greater risk of drone incursion because it is more difficult for a drone to access a building through its doors. Drones also pose accidental injury risks should they malfunction or collide with other objects. Additionally, drones can be armed with a deadly weapon, as seen in modifications by the Ukrainian military and also terrorist and militant groups. Due to the limited payload capacity of most commercially available drones, the panic-induced crowd crush and trampling in the aftermath of a drone attack could pose more of a risk than the attack itself.

Facility Collapse

Although rare, commercial facilities can collapse if built using outdated building codes or poor engineering, mandated inspections are not performed, or inspection results are neglected. More than a dozen collapses in the commercial facilities sector have occurred in the U.S. since 1979. Updated building codes and increased inspections by regulators can mitigate these collapses. Collapses since 2000:

• May 18, 2000 – Pier 34 and Club Heat, Philadelphia, Pennsylvania. Pier 34 collapsed under its weight, plunging the recently opened outdoor nightclub at the end of the pier into the water. Three women were killed, and 43 others were injured.
• June 29, 2003 – Chicago apartment balcony, Chicago, Illinois. When an overloaded apartment balcony collapsed during a party, 13 people died, and 57 others were seriously injured. It remains the deadliest porch accident in U.S. history. In 2006, inspectors found 6,670 porch violations throughout Chicago.
• July 7, 2007 – Crab House Restaurant, Wildwood Crest, New Jersey. Nine persons were injured when the floor of the restaurant collapsed.
• June 5, 2013 – Market Street Building, Philadelphia, Pennsylvania. A four-story building being demolished collapsed onto a one-story Salvation Army store, killing six and injuring 14.
• June 16, 2015 – Berkeley apartment balcony, Berkeley, California. The balcony of a 5th-floor apartment collapsed, killing six and injuring seven others.
• January 13, 2018 – Merriweather Post Pavilion, Columbia, Maryland. The roof overhanging the reserved seating at the outdoor concert venue suffered a total failure and collapsed. It was in the final stages of a project to raise the structure.
• October 12, 2019 – Hard Rock Hotel, New Orleans, Louisiana. The hotel under construction partially collapsed, killing three workers and injuring dozens of others.
• June 24, 2021 – Champlain South Tower Condo, Surfside, Florida. The 12-story condominium partially collapsed, causing the deaths of 98 people and injuring almost a dozen others.

What Else Do Emergency Preparedness, Response, and Recovery Professionals Need to Know About This Sector?

The commercial facilities sector is perhaps the most diverse critical infrastructure sector in terms of types of buildings and occupants. Facilities built by the same company for the same purpose – such as apartments constructed by the same real estate development company – will have vastly different designs, vulnerabilities, and risks. Familiarity with a facility before an emergency can mitigate the effects due to facility variations.

Emergency professionals should also be aware of the possibility of mass casualties in assembly areas and facilities. Audiences and crowds are susceptible to crowd crush and trampling because of panic or inadequate safety and security measures, such as at the Astroworld music festival in November 2021. Sometimes, a disaster occurs simply because of a crowd’s perception of potential harm (e.g., a loud noise perceived to be gunshots), a facility’s structural failure (e.g., the collapse of a railing due to excessive crowd weight), or ill-advised crowd management and crowd control (e.g., Indonesian police firing tear gas into the crowd after a soccer match in October 2022, which resulted in 125 deaths from trampling and suffocation).

Emergency professionals must be prepared and willing to provide unsolicited advice and recommendations to facility managers and security professionals at commercial facilities. Commercial facilities often have unaddressed vulnerabilities, as most facilities have never had a holistic risk assessment – or even a cursory risk assessment. Risk assessments are sometimes limited to “guns, guards, and gates,” neglecting other risks that can negatively impact safety, security, and business continuity. For example, numerous commercial facilities have no numbering on exterior doors, which could facilitate emergency response in certain situations. Emergency professionals could mention such observations to a facility’s appropriate stakeholders during a familiarization visit or after an alarm response.

Partnerships between commercial facility operators and the first responders prior to disasters are vital. Facility operators should also be acquainted with relevant guides produced by the U.S. Department of Homeland Security (DHS) and its Cybersecurity & Infrastructure Security Agency (CISA). For example, stadium and arena operators should be familiar with the DHS “Evacuation Planning Guide for Stadiums.” Based on the expertise of first responders, security professionals, and information provided by DHS (including FEMA), commercial facility operators should write formal policies, plans, and procedures and occasionally conduct exercises.

The commercial facilities sector is vast and diverse and has an outsized impact on the U.S. economy. This sector’s interdependency with other critical infrastructure sectors is extensive, complicating the risks inherent in building, operating, and occupying commercial facilities. Understanding this immense sector is crucial in preparing for the unfortunate and inevitable repeats of the sector’s past mishaps, catastrophes, and disasters.