I wrote this in-depth article about using duress devices because unlike card readers and other security equipment, duress devices require special attention to people, process and technology design for each individual device. There are significant liabilities for at-risk individuals as well as for their employers when all three factors do not receive sufficient attention. –Ray Bernard
Be notified when new tools are posted for download on this page.
Duress devices are often known by other names that depict their specific usage including panic buttons, hold-up buttons, cash-clips, watches, pendants and bracelets. Similar devices exist for safety accident and medical emergency notifications, but those topics are outside the scope of this article.
Access control and alarm systems also have keypad duress features that allow an individual to enter a code indicating that the person is under the direction of an intruder or that an attacker is present. Each keypad where the duress code feature is enabled must be given full duress design consideration.
Dangers and Liabilities
Recent walkthrough inspections of some facilities found duress devices that had not been tested since originally installed, and also some that were damaged, missing, or simply considered non-operational. High risk facilities such as airports and banks usually test their alert devices at least once per day.
All duress devices should be tested regularly at appropriate intervals—especially wireless duress devices, which are battery-powered and should be tested frequently to ensure that they are operating properly including at the maximum distances from the wireless receiver.
Many retail and other organizations do have policies and procedures about testing duress devices, but there are still plenty of organizations that do not regularly test their duress devices.
However, device testing alone is not enough to fully address the risks involved in duress situations—which include both personal and organizational liabilities. The people and process elements must also be tested at appropriate intervals, as a people or process failure can have the same or worse consequences as a duress technology failure.
In our facility walkthroughs only very high-risk facilities had provided sufficient instruction and training to personnel who were provided with duress technology.
In other facilities, few or no personnel with duress devices could describe exactly what was supposed to happen when they activated the device—and some individuals had completely wrong expectations. These personnel had not been trained in how they should respond to the types of threats that they may encounter, including what to do and not to do after activating the duress signal.
Liability situations include:
- A device that doesn’t work
- Someone who doesn’t know how to use a working device
- Someone who doesn’t know what to do after sending a duress signal
- Someone who counts on rescue activity that will not occur
- Public duress button instructions that if followed, place the at-risk individual in greater risk (more below on this issue)
- Responses to the duress call (human or technological) that further enrage a hostile attacker or otherwise put the at-risk individual in greater danger
- Someone who applies training from a previous organization or facility that is not appropriate for the current organization or location
- Response teams who are put at risk because they don’t have appropriate training
- Responders who have no situational awareness capability for the duress event
There are several concerns with regard to procedures and training including minimizing the risk to at-risk employees (both the initial at-risk individual and duress call responders); enabling employees to de-escalate if possible and to avoid escalating the situation; and liability to the company.
More information on effective training follows at the end of this article.
A security supervisor’s perspective on liability for actions taken in a duress call response can be found in this article about employer liability at ifpo.org.
The company’s Chief Legal Officer or General Counsel should be consulted with regard to the legal risks involved.
There is also the risk of not having a duress device where there should be one. Most duress devices are installed when an access control or alarm monitoring system is installed. Many years can go by without reevaluating the risk picture to determine if additional duress coverage is warranted.
Public vs. Private Duress Devices
Private duress alarm devices are not visible to the public, and the action to activate the duress signal is known only to the person trained and authorized to use the device.
Public duress alarm devices are intentionally highly visible, with clear markings and instructions on how to activate the duress signal. Parking structures are one type of area where public duress devices may be needed.
It is important that public duress device instructions, when followed, will not place the at-risk individual at greater risk. For example, an instruction to “Push Button and Wait for Response” should account for an approaching threat and also state “but Only if Safe to Remain in this Location”—or provide whatever instructions are suitable for the situation. The duress system design process must consider the possible risk situations and account for them as appropriate in the design.
Monitored video surveillance and two-way communication can be critical elements of a public duress system.
Duress System Design
As used here, the term “duress system design” refers to both technology design and the plan for how the technology is to be used (the people and process elements).
Such a plan is the basis for the written guidance and procedures that should be developed, and the training that incorporates drills and exercises to teach how and when to apply the guidance and procedures.
Implementing a sound design (people, process and technology) ideally would result in:
- Personnel who can de-escalate a situation while silently calling for help
- If appropriate, a way to safely let the at-risk individual know that the call for help was received and is being acted upon
- A means for responders to obtain situational awareness
- Technology that is proven to be fully functional and is regularly tested
- Personnel who are trained (instruction plus drills) and know when and how to use the duress technology
- Personnel who are much more likely to remain calm and take appropriate actions in a duress situation
It is very important to develop design-basis scenarios that describe the situations under which the duress device should be activated and what the at-risk individual should do afterwards. Different situations can require different responses.
For example, an escalating argument between two long-term employees wouldn’t be treated the same way as an intoxicated and belligerent individual with a gun.
Documenting the Design
Without documented design-basis scenarios, how can you be sure that you are doing the right thing?
- How can duress devices be evaluated for fitness to purpose?
- How can suitable training be developed?
- How can the legal department tell if all the risks (to individuals and the company) are being considered?
- How can management determine if the planned-for duress measures are acceptable to themselves and ownership?
- When risks increase—were the existing measures intended to account for that?
Be sure to evaluate the risks periodically and update the documentation if the risk. technology, training or procedure information changes.
Locations to Consider
Places where duress technology may be needed include:
- Cash registers and cashier windows
- Customer service and information desks and counters
- Executive office suites and their reception desks
- Human Resources department interview rooms
- Places where confrontations with or among visitors or the general public may occur
- Parking lot entry/exit booths (whether or not cash is being taken)
- Receptionist’s desks or windows in entrance and lobby areas
- Rooms where cash or other valuables are received, processed, or stored including safe and vault areas
- Security stations and checkpoints
- Shipping & receiving areas
- Storage rooms where guests or employees could be held for confinement
Types of Duress Devices
There are many types of “panic button” and duress device designs, some of which are identified in the standards section above. There are also situations for which telephones and mobile apps can be effective and appropriate.
Telephones, 911 and E911 Systems
Modern office telephone systems in multi-story buildings follow the Enhanced 911 (E911) standard, which includes location information for each individual telephone in the system. See the standards section below for more information on E911 phone systems.
Telephones may be used in a number of ways for public and private duress notification. Related signage, procedures and training should be developed in collaboration with a certified security professional.
In addition to fixed duress devices, mobile phone technologies can provide an additional means of duress signaling with location tracking, such as those provided by Guardly, which has an indoor positioning system for mobile emergency callers (Guardly IPS) plus mobile safety apps that in effect turn cell phones into smart personal emergency phones, and which can use outdoor GPS positioning.
Insurance companies and their policyholders have a vested interest in standards and building codes designed to help protect people and property, and consequently reduce insurance claims. The National Fire Protection Association (NFPA) and Underwriter’s Laboratories (UL) are two associations that develop standards. (The beginnings of the NFPA and UL can be found on the NFPA History page.)
NFPA Guideline Standards
NOTE: These excerpts from the NFPA standards documents are tutorial in nature and intended highlight important duress system design issues. They are not prescriptive. There are other portions of the standards documents—not included here—that also apply to any type of security system design and deployment, and specific design notes such as those for security vaults, that also apply to duress system design. A board-certified security professional, such as a Certified Protection Professional (CPP) or Physical Security Professional (PSP), should be consulted with regard to duress system design.
NFPA 730—Guide for Premises Security
The excerpts below are presented in the order in which they appear in the standards document, with explanatory material from the Annex A and Annex E pages appearing first.
A.3.3.4 Annunciator. An annunciator can log alarms or display a continuous status of devices or systems. The annunciator can signal audibly, visually, or both to indicate a
change of status.
A.220.127.116.11 Duress Alarm Device. A perceived hostile situation might be an intruder. Often these alarms are triggered by unobtrusive sensors so as to not place the victim in increased danger. Duress alarms are usually designed to silently initiate an alarm, which is annunciated at a remote station or guard post.
A.18.104.22.168 Duress Alarm System. In private duress alarm activation, the action to activate the duress signal is known only to the person authorized to activate the device. In public duress alarm activation, the action to activate the duress signal is available to any person at the protected premises.
A.22.214.171.124 Holdup Alarm System. A manual signal depends solely on operation of hand- or foot-initiating devices installed in the work area. Bank teller windows and store cash registers are locations where holdup alarm systems might be installed.
A.10.2.5.1 Duress alarm device buttons can be located at strategic locations throughout the facility, including elevators, stairwells, and parking areas, with prominent signs posted showing their locations. The duress alarm system and intercom system can be integrated with the video surveillance system for enhanced effectiveness of the systems.
E.126.96.36.199 Intrusion detection systems can be designed so that various parts of a building have separate sensor circuits, or zones. Duress or holdup alarm circuits can be added to enable employees to summon security personnel.
E.4.4 Holdup, Duress, and Ambush Alarms.
E.4.4.1 The teller’s holdup alarm in a bank is a common example of an emergency alarm. Based on a risk analysis, emergency alert alarms should be considered for use at medical treatment facilities, personnel counseling or interview offices, credit unions, cash-handling activities, and other high-risk areas. The type and location of the device should be selected carefully to ensure the device is readily available for surreptitious activation in an emergency. If there is a building security force, a silent alarm should annunciate at the dispatch point. If not, the alarms can be transmitted directly to a central station monitoring location or directly connected to local police. Holdup alarm units should be listed to ANSI/UL 636.
E.4.4.2 The planned response to an emergency alert alarm must be designed to prevent endangering the occupants or creating hostage situations.
188.8.131.52 Holdup Alarm. An alarm that originates from a point where holdup protection is required, such as a bank teller window or store cash register.
184.108.40.206 Duress Alarm Device. An initiating device intended to enable a person at a protected premises to indicate a hostile situation.
220.127.116.11 Security Signaling Device. A device that indicates an alarm, emergency, or abnormal condition by means of audible, visual, or both methods, including sirens, bells,
horns, and strobes.
18.104.22.168 Duress Alarm System. A system that controls duress alarm devices and operates in private or public.
22.214.171.124 Holdup Alarm System. A system or portion thereof in which the initiation of a holdup signal is either semiautomatic or manual.
126.96.36.199 Intrusion Detection System. A system designed to detect the entry or
attempted entry of a person or vehicle into a protected area.
188.8.131.52 The alarm system should be periodically tested and properly maintained as required in NFPA 731, Chapter 10 of NFPA 731.
10.2.5.1. Duress Alarms. Public duress alarm systems, where present, should be installed and maintained in accordance with NFPA 731.
184.108.40.206 Holdup, Duress, Ambush, and Man Down Alarms. Holdup, duress, ambush, and man down alarms should comply with the requirements of NFPA 731.
220.127.116.11 Threat, Door, and Miscellaneous Alarms. Threat and door alarms and other alarms relating to the safety of people should be monitored by security personnel.
NFPA 731—Standard for The Installation of Electronic Premises Security Systems
Read the full standard online for free (requires website registration), or purchase the document ($44.50) to download
A.18.104.22.168.2 Duress Alarm Initiating Device. Often these alarms are triggered by unobtrusive sensors so as not to place the victim in increased danger. Duress alarms are usually designed to silently initiate an alarm, which is annunciated at a commercial or proprietary monitoring station or guard post.
A.22.214.171.124.3 Holdup Alarm Initiating Device. A holdup device at the protected premises can be at a bank teller window or store cash register. It is usually initiated by actions of the operator or teller. The alarm is silent, to protect the cashier.
3.2 NFPA Official Definitions.
126.96.36.199 Initiating Device. A system component that originates transmission of a change-of-state condition.
188.8.131.52.1 Ambush Alarm Initiating Device. An initiating device or procedure that personnel authorized to disarm the intrusion system at a protected premises can use to transmit a signal indicating a forced disarming of an intrusion detection system.
184.108.40.206.2 Duress Alarm Initiating Device. An initiating device intended to enable a person at protected premises to indicate a hostile situation.
220.127.116.11.3 Holdup Alarm Initiating Device. An initiating device intended to enable an employee of a protected premises to transmit a signal indicating a robbery has transpired.
18.104.22.168 Signaling Device. A device that indicates an alarm, emergency, or abnormal condition by means of audible, visual, or both methods, including sirens, bells, horns, and strobes.
22.214.171.124 Duress Alarm System.
126.96.36.199.1 Private Duress Alarm System. A system or portion thereof in which the action to activate the duress signal is known only to the person activating the device.
188.8.131.52.2 Public Duress Alarm System. A system or portion thereof in which the ability to activate a duress signal is available to any person at the protected premises.
184.108.40.206 Holdup Alarm System.
220.127.116.11.1 Manual Holdup Alarm System. A system or portion thereof in which the initiation of a holdup signal depends solely on operation of manually operated hand or foot initiating devices installed within the working area.
18.104.22.168.2 Semi-automatic Holdup Alarm System. A system or portion thereof in which the initiation of a holdup signal does not depend solely on operation of manually operated hand or foot initiating devices installed within the working area.
4.5.3 Power Supplies Sources.
22.214.171.124 Power supplies shall be installed in conformity with the requirements of NFPA 70, National Electrical Code.
126.96.36.199 Power supplies shall be reliable and of adequate capacity for the intended service.
188.8.131.52 At least two independent power supplies shall be required, one primary and one secondary, for the The following electronic premises security systems shall be required to be provided with at least two independent and reliable power supplies:
- Intrusion detection systems
- Holdup, duress, and ambush systems
Note: additional power supply and battery-backup requirements apply that are not included in the excerpt material above.
Chapter 8 Holdup, Duress, and Ambush Systems
Note: The entirety of Chapter 8 applies to duress alarms of various types. Only a few excerpts are included below.
8.1 General.8.1.1 Construction.
184.108.40.206 The construction of holdup alarm initiating devices shall be in compliance with applicable standards, such as ANSI/UL 636, Standard for Holdup Alarm Units and Systems.
220.127.116.11 The construction of private duress alarm initiating devices shall be in compliance with applicable standards, such as ANSI/UL 636, Standard for Holdup Alarm Units and Systems.
8.3 Duress Alarm Systems.
8.3.1 Installations. Portable duress alarm initiating devices shall be in compliance with ANSI/SIA CP-01, Control Panel Standard — Features for False Alarm Reduction, Section 4.2.4.
18.104.22.168 A duress alarm initiating device shall lock into the alarm position or shall display a visual indication when it is operated.
22.214.171.124 Visual displays of the operation of a duress device shall be permitted at the device, at the control unit to which it is connected, or at the location where the duress alarm signal is received.
126.96.36.199 Visual indication of the operation of a duress device shall require a manual operation to reset it.
188.8.131.52 Each duress alarm initiating device shall require positive, intentional action to initiate a duress alarm signal.
184.108.40.206 Operation of a duress alarm initiating device shall result in an audible signal or a visual signal at the location of the initiating device or at a staffed location elsewhere on the protected property.
220.127.116.11.1 In addition to the staffed location required in 18.104.22.168, a duress alarm signal shall be received at a constantly attended location at the protected premises or transmitted to a monitoring station.
22.214.171.124 Private Duress Alarm Systems.
126.96.36.199.1 Fixed-in-place duress alarm initiating devices shall be installed within 1.22 m (4 ft) of the workstation and accessible from the normal work position of the individuals responsible for utilizing the device.
188.8.131.52.2 Each private duress alarm initiating device shall be located so that it cannot be observed by the public.
184.108.40.206.3 The activation of a private duress alarm initiating device shall not be obvious to a hostile party.
220.127.116.11.4 Each person expected to use a private duress alarm initiating device shall be instructed in the operation of the device.
Chapter 9 Monitoring Stations
Note: Only a few excerpts from this chapter are included below, even though the majority of the material will apply to any duress device installation.
9.1 Application.The performance and operation of monitoring stations that monitor electronic premises security systems shall comply with the requirements of this chapter.
9.6.3 Holdup Alarm.
18.104.22.168 Upon actuation of a holdup alarm, the monitoring station shall immediately notify the public safety agency unless otherwise directed by special instructions.
22.214.171.124 The monitoring station shall not call the protected premises.
126.96.36.199 Alternative special instructions shall be allowed to supersede the requirements of 188.8.131.52.
9.6.4 Duress Alarm.
184.108.40.206 Private Duress Alarm.
220.127.116.11.1 Upon actuation of a private duress alarm, the monitoring station shall call the protected premises before notifying the public safety agency unless otherwise directed by special instructions.
18.104.22.168.2 If the call required in 22.214.171.124.1 is answered, the monitoring station personnel shall identify themselves and ask for a name and identification credential.
126.96.36.199.3 Monitoring station personnel shall notify the public safety agency if any one of the following occurs:
- The person at the protected premises does not give a valid identification credential.
- The call to the protected premises is not answered within six rings.
- The call is forwarded.
- The call results in a busy signal.
188.8.131.52 Public Duress Alarm.
184.108.40.206.1 Upon actuation of a public duress alarm, the monitoring station shall immediately notify the public safety agency unless otherwise directed by special instructions.
220.127.116.11.2 The notification in 18.104.22.168.1 is not required if the alarm signal is determined to be false by the use of enhanced verification in accordance with 22.214.171.124(1).
9.6.5 Ambush Alarm.
126.96.36.199 Upon actuation of an ambush alarm, the monitoring station shall immediately notify the public safety agency unless otherwise directed by special instructions.
188.8.131.52 The monitoring station shall not call the protected premises.
184.108.40.206 Alternative special instructions shall be allowed to supersede the requirements of 220.127.116.11.
Chapter 10 Testing and Inspections
10.1 Application. The inspection, testing, and maintenance of electronic premises security systems shall comply with the requirements in this chapter.
10.1.1 This chapter shall apply to those systems installed under the provisions of this standard.
10.1.2 Inspection, testing, and maintenance programs shall do the following:
- Satisfy the requirements of this standard
- Conform to the equipment manufacturer’s recommendations
- Verify correct operation of the electronic premises security systems
10.1.3 The system user or the premises security system provider for the protected premises shall be responsible for the inspection, testing, and maintenance of the systems and alterations of the systems.
10.1.4 Inspection, testing, or maintenance shall be permitted to be performed by a person or organization other than the owner if conducted under a written contract.
10.1.4.1 When the responsibility for the activities outlined in 10.1.3 is delegated to a third party, it shall be in writing with proof of such delegation provided to the AHJ [authority having jurisdiction] upon request.
10.1.5 Inspection, testing, and maintenance procedures that are required by other parties and that exceed the requirements of this chapter shall be permitted.
Example Duress System Test Report Forms
Note: The images of the example “INTRUSION DETECTION OR HOLDUP AND DURESS SYSTEMS INSPECTION & TESTING REPORT” form below are for illustrative purposes only, to provide some idea of the scope of the example forms. To obtain the original example forms, go online to view them or purchase the NFPA 731 document for download.
UL Device and System Standards
Underwriter’s Laboratories (UL) is a global independent safety science company with more than a century of expertise innovating safety solutions from the public adoption of electricity to new breakthroughs in sustainability, renewable energy and nanotechnology.
If a product carries the UL Listing Mark, it means UL found that representative product samples met UL’s safety requirements for the UL listing number.
One of more of the UL standards below are likely to apply to your duress alarm equipment or system, as well as others not presented here (such as for power supplies). Require that your system provider identify UL-listed devices that are a part of the system being installed. Where non-UL-listed equipment is being provided, ask for the reasoning behind using a non-UL-listed device; there may be a valid reason.
Each UL standard number below links to the UL web pages describing the scope of the standards.
- UL 365 Standard for Police Station Connected Burglar Alarm Units and Systems
- UL 603 Standard for Power Supplies for Use with Burglar-Alarm Systems
- UL 609 Standard for Local Burglar Alarm Units and Systems
- UL 636 Standard for Holdup Alarm Units and Systems
- UL 639 Standard for Intrusion-Detection Units
- UL 681 Standard for Installation and Classification of Burglar and Holdup Alarm Systems
- UL 1037 Standard for Antitheft Alarms and Devices
- UL 1076 Standard for Proprietary Burglar Alarm Units and Systems
- UL 1635 Standard for Digital Alarm Communicator System Units
E911 Standard – The Next Generation 911
Moving to a next generation 911 system in an efficient and cost-effective manner will require coordination of standards and technology. The use of common standards is necessary for 911 public safety answering points (PSAPs) to communicate and allows them to transfer and share data – even among geographically dispersed PSAPs and other emergency response agencies.
The structure that underlies IP-enabled 911 (i.e. a network-phone based 911 system) is based upon many different technical standards to make sure all parts of the 911 system work smoothly together.
For more information on E911 standards development and a national progress report go to: www.911.gov.