Image: Mumbai attack
Punit Paranjpe  /  Reuters file
People duck as gunshots are fired from inside the Taj Mahal hotel in Mumbai on Nov. 27, 2008.
updated 3/9/2009 11:45:54 AM ET 2009-03-09T15:45:54

The Mumbai attacks exposed vulnerabilities in hotel security. Experts reveal what these are — and what must be done to fix them.

The November 2008 Mumbai attacks could bring changes to international hotel security just as sweeping as those Sept. 11 brought to aviation. By the time the 60-hour rampage that targeted three of the city's top hotels had ended, security experts, law enforcement and hoteliers worldwide knew that they were facing a new reality.

The threat of terrorism at luxury hotels has long been recognized: In 2001, the U.S. Department of Homeland Security identified hotels as soft targets, and since then fatal attacks have occurred at a dozen properties around the globe. To be sure, the two other incidents in 2008 — at the Marriott Hotel in Islamabad and the Serena in Kabul — were in high-threat countries not frequented by tourists.

But several earlier attacks took place in destinations popular with both business and leisure travelers: Netanya, Israel (2002); Jakarta (2003); and Sharm-el-Sheikh, Egypt, and Amman, Jordan (2005). Yet the Mumbai violence, in which 171 perished, sounded the loudest alarm, say hotel security professionals.

"We've been monitoring attacks on our industry [in the Middle East and Asia]," says Jimmy Chin, chairman of the security committee for the Hotel Association of New York City. "These had high death tolls. The [terrorists] are honing their skills."

Chin, who is also the executive director of risk management for the New York Palace Hotel, says the Mumbai violence struck close to home. "Mumbai is a financial capital; New York is a financial capital. Mumbai has a high population; New York has a high population. Mumbai has luxury hotels; New York has luxury hotels."

Although no U.S. hotels have been attacked to date, industry insiders are increasingly concerned about their vulnerability. "Major European capitals and American cities are a couple of places we're worried about," says Robert Grenier, a 27-year veteran of the CIA who is chairman of global security consulting at the corporate security firm Kroll. "Mumbai is going to force five-star hotels in high-threat capitals to focus on security — at least in the short term."

The challenges of hotel security
As quasi-public spaces where people come and go freely, hotels by their nature are difficult to fully secure. "They are not nuclear power plants, prisons, or airports," says Thom Davis, president of the security company Hospitality Risk Controls, who is also on the Department of Homeland Security's lodgings committee. "They have some obligation to provide reasonable security measures, but there is only so much they can do."

In fact, hotel safety and security efforts can vary wildly, even within one brand. And hotels are not subject to international — or in this country, federal — safety standards beyond basic fire and municipal codes. Matters of hiring security guards and training staff are mostly left up to hotel management. Experts say it's impossible to institute a national standard. "What applies in Manhattan may not apply at a hotel in Dublin, Ohio," says Davis.

A 2002 study of American hotels by Cornell University's School of Hotel Administration found that "over one-third of general managers surveyed had done nothing to alter their security procedures," and that the safest properties are those at airports, followed by luxury hotels, especially new and urban ones.

A follow-up study in 2008 concluded that little progress had been made. Many hotel security auditors say that name-brand luxury properties in major cities tend to be the most focused on guest safety. But according to Grenier, "You might be better off staying in a boutique hotel" — an unlikely target for a terrorist attack.

  1. Don't miss these Travel stories
    1. Lords of the gourd compete for Punkin Chunkin honors

      With teams using more than 100 unique apparatuses to launch globular projectiles a half-mile or more, the 27th annual World Championship Punkin Chunkin event is our pick as November’s Weird Festival of the Month.

    2. Airports, airlines work hard to return your lost items
    3. Expert: Tourist hordes threaten Sistine Chapel's art
    4. MGM Grand wants Las Vegas guests to Stay Well
    5. Report: Airlines collecting $36.1B in fees this year

In the 1990s, the U.S. hotel industry did effectively address the problem of crime and theft by making electronic key cards standard and installing back-of-house surveillance cameras and in-room safes. Hotel auditors expect a similar industrywide effort to focus on protection against terrorism.

But that doesn't solve the problem of porous security abroad, particularly in places where counter-intelligence is weak and local law enforcement cannot be counted on in the case of a heightened threat. The Indian press reported that two months before the Mumbai attacks, local police gave the Taj hotel a list of 22 needed security improvements, including placing a grill gate over the back entrance where the attackers gained access.

Slideshow: Alluring Asia The hotel reportedly relaxed security just before the bombings. A spokesperson for the Taj wouldn't comment on the company's security procedures, but in a televised interview Ratan Tata, the chairman of the Taj hotel group, blamed poor intelligence and ill-equipped law enforcement for the fatalities.

Many large chains hire security consultants such as Hospitality Risk Controls, Kroll, and the Annapolis-based global security firm iJet Intelligent Risk Systems to audit their hotels to detect security lapses. iJet also provides clients, typically Fortune 500 companies and high-net-worth individuals, with detailed country profiles and daily travel alerts reported by staff around the world, many of whom are retired intelligence and military officers. The company audits about 500 hotels annually, and those that pass its rigorous safety checks and covert inspections land in a database available to subscribers (subscriptions start at $5,000 a year).

"There's such a range of players out there," says iJet president Bruce McIndoe. "Some recognizable brands don't know how to spell the word security. They don't even have anyone in charge of it. Other have sophisticated global operations," he says. "Hotels need to do better. The industry doesn't have standards, and the brands don't have control."

What hotels are doing now
The week after the Mumbai bombings, police departments in several U.S. cities — including New York, Chicago, and Miami — met with hoteliers to urge them to step up employee training and monitoring, background checks, and lobby security. (Some Manhattan hotels have had 24/7 plainclothes security in their lobbies since 9/11.) Any increase in such safeguards will be a deterrent to would-be attackers, says Grenier. "If they see an obvious upgrade in security, they'll find other targets."

Cement blockades at the checkpoint of the Islamabad Marriott reportedly saved hundreds of lives when the hotel was attacked last year, and the Sheraton Karachi, where 13 people were killed in a 2002 suicide bombing, recently touted its "security enhancements." The days of keeping mum on security so as not to frighten guests may be over as safety measures actually become a marketing tool — particularly in a competitive economy.

The Starwood chain, for one, works with two security firms. "Several years ago, we overhauled our existing emergency and crisis procedures to address terrorism-related events as well as traditional crises," says Starwood spokesperson K. C. Kavanaugh. Access to its Mumbai properties is now restricted to guests.

What the future may bring
Hotel security experts say we can expect some of the following: no underground parking; the scanning of luggage upon arrival (already being done in Bangkok, Hong Kong, Jakarta and Saudi Arabia); metal detectors at all entrances (currently used in Egypt, Indonesia and Israel); bag searches; an end to luggage storage and to being allowed to send luggage or packages in advance of your arrival at the hotel; uniformed security in lobbies and restaurants; and random photo I.D. requests.

In extreme cases, hotels may limit lobby access to registered guests and require key cards for once-open doors — a measure Hilton and Marriott have instituted at their Jakarta properties.

But until the industry makes dramatic changes, says Susan Gurley, executive director of the Association of Corporate Travel Executives, guests must be increasingly self-reliant. "You need to take ownership of your trip. You have the right to get on the phone and ask questions of the hotel [see "Sleep Tight"]. And if you're on a tour, you have the right to ask them of your tour operator."

Tips on hotel security
Before you arrive
In choosing a hotel, treat safety and security as you would any other amenity. Make sure that you (or your travel agent or tour operator) consider the following before reserving a room:

  • Have hotel staff undergone security and emergency management training in the past year?
  • Does the hotel have an emergency evacuation plan?
  • Are background checks performed on all members of the staff?
  • Does the hotel have security personnel on duty 24/7?
  • Confirm that the hotel has sprinklers in every room. (Check out for other crucial fire-safety tips.)
  • Avoid rooms facing busy streets or with ground-level windows. Sliding doors that front pools or beach areas should also be avoided. If rooms are directly over the lobby, stay on the fourth floor or higher.
  • Reserve a room located between the third and seventh floors — away from prowlers who can gain access from the street and within reach of most fire-department ladders.
  • Women traveling alone should avoid staying in rooms by stairwells and elevators. In off-hours, they should not hesitate to request that a hotel employee escort them to their room.
  • Don't stay next to government offices, embassies, landmarks, or religious centers, especially in destinations where there's been recent unrest or that have been the subject of a U.S. State Department travel warning or alert.
  • Only stay at hotels with electronic key-card access. In high-crime cities such as Rio de Janeiro and Mexico City, make sure the property's elevators also require key cards.

At check-in

  • Did the hotel receptionist announce your room number? If so, experts say you should request another room. Properly trained employees will show you your room number — and never broadcast it.
  • Request a map of the hotel and your floor. Have the bellboy show you to your room and point out all elevators and emergency exits and evacuation routes. Then, on your own, count the number of doors between your room and the exits, in case you need to escape in smoke or darkness.
  • Don't indicate that you're a solo traveler or are not in your room. Instead of hanging the please make up this room card on the door, call housekeeping to request maid service. Also avoid leaving a room-service breakfast-order card on the doorknob that is clearly for just one person. Instead, phone room service before going to bed.
  • Use valet parking, especially if the hotel's garage is dimly lit or the destination has a high crime rate.
  • Always ask the concierge about the safety of any area you're setting out to see. Neighborhoods can change and new threats can emerge since the last time you visited or since the guidebook you're using was printed.

In an emergency
iJet, a risk-management firm, had 40 clients in Mumbai during the attacks, 11 in the two hotels under siege. iJet representatives talked these travelers through the same instructions they use in the event of a hurricane, a tornado, a biological or chemical attack, or, as was the case in Mumbai, being trapped in a building with armed assailants. Here are key points to follow:

  • Avoid windows: Many were killed after the initial Islamabad Marriott blast because they rushed to see what happened.
  • Double-lock your door and barricade it with heavy furniture.
  • Drag the mattress to the center of the room and hunker down under it — the mattress will provide a buffer in case of gunfire.
  • If there is smoke, stuff wet towels under the door.
  • Don't broadcast your whereabouts. The temptation, of course, will be to call loved ones on your cell phone, but chatter can alert attackers to your presence. While trapped in the basement of the Taj in Mumbai, Judy Hevrdejs, the dining editor of the Chicago Tribune, listened in horror as people screamed into their cell phones to family abroad, "We're in the basement!"

© 2013 Condé Nast Traveler


Discussion comments


Most active discussions

  1. votes comments
  2. votes comments
  3. votes comments
  4. votes comments