PHOENIX — A World Cup stadium may be the most secure place in a host city. The harder security problem can be everything outside it.
During a session at the National Real Time Crime Center Association conference, Max Escate of FIFA, Jason Houser of the Center for Internet Security and John Lasley of the Forsyth County Sheriff’s Office discussed the security and intelligence work surrounding the FIFA World Cup.
Escate began with the scale of the tournament: 39 days, 645 official FIFA sites across three countries and cumulative stadium attendance of more than 6.8 million. The official sites included stadiums, training sites, hotels and VIP hotels, he said. FIFA also tracked nonofficial locations and activity outside those sites.
The speakers discussed what they encountered during the tournament, including people trying multiple entrances after being denied entry, evolving counterfeit credentials, threats after matches, watch parties, drone activity near a practice site and AI-generated images involving players.
Credential misuse changed over the tournament
Escate said FIFA encountered non-ticketed fans who moved from one entrance to another after being denied entry. The tournament also experienced credential misuse and fraudulent credentials.
The fraudulent credentials changed over time, he said. In the first week, they did not resemble FIFA credentials. In the second week, they looked more like FIFA credentials, but the QR codes did not work. Later, the credentials and QR codes became increasingly convincing.
Escate said the response involved more than stopping a person from entering. He said the team needed to determine how a person had attempted entry, who the person was, what credential or target had been used and where the tactic might appear again.
“If he’s gonna do this at the World Cup, he’s probably gonna do it at a concert,” Escate said.
He said identifying and logging tactics was essential because similar activity could occur at different sites and in different jurisdictions.
Threats continued after the match
Escate said FIFA monitored open-source information and other information during matches. He said the team found that many threat spikes occurred after the whistle.
Controversial decisions, threats toward players and other factors could raise tension during a match, he said. The highest point of tension could come after the match ended.
“Just because the whistle ends, you can’t let your guard down,” Escate said.
He described a match involving Argentina and England in which threats followed the final whistle. Escate said law enforcement detained a person after a credible bomb threat following the match. He also said the operation received threats directed at executives, referees, players and FIFA employees.
Escate said the information that was most useful to operations included the time, location, estimated crowd size, route and destination of fan movements.
FIFA used TRX to share reports and information
FIFA used TRX, or the Threat Reporting Exchange, during the Club World Cup and then expanded its use during the World Cup, Escate said.
He described TRX as a Microsoft Teams-based centralized platform. FIFA used it to make materials such as team profiles and match assessments available to users, rather than respond to repeated email and phone requests.
During the Club World Cup, the system had roughly 500 to 700 users, Escate said. During the World Cup, it had more than 4,000 users across Canada, Mexico and the United States.
Escate said FIFA and its partners pushed users to post questions and information through TRX. The group also held weekly calls before the World Cup to help users become more comfortable with the platform.
In one example, Escate said, a person repeatedly attempted to enter through different entrances after being denied entry. A security officer photographed the person and posted the image to TRX. Law enforcement partners from England recognized the person and said he had engaged in similar conduct there.
TRX also allowed users to submit incident forms that created reports available to other users, Escate said. Those reports could be placed on a map to show their proximity to FIFA sites.
FIFA used the platform to post information on suspicious people, suspicious packages and pyrotechnic incidents, Escate said.
Players and threats moved beyond official events
Escate said FIFA-sanctioned events included media events, matches, practice sites and official team dinners. But players also left those events.
“Just like you and I, they’re also humans and they’re also people,” Escate said. “Many of these players have never even been to the United States, Canada or Mexico.”
He said players went on walks, went to dinner and went shopping. Escate also cited an incident involving Manchester City during the Club World Cup, when team personnel went to Miami Beach with little notice to FIFA.
The session also addressed AI-generated images involving players.
Escate said people used AI to place players’ faces in images with bombs or other threats. The first image was identified as artificial intelligence and posted to TRX, he said. The next day, another appeared, followed by three in one day.
Because the first image had been posted to TRX, Escate said more than 4,000 users across Canada, Mexico and the United States had been alerted that the images were AI-generated when later examples appeared.
Houser said CIS had expertise and best practices related to identifying indicators of swatting activity. He said CIS had analysts embedded in the center and could reach back to its operations center and threat intelligence division.
Forsyth County supported Germany’s team base camp
Lasley described Forsyth County’s role in supporting Winston-Salem during the tournament.
While Winston-Salem did not host a World Cup match, it served as Germany’s team base camp. The team established its headquarters at the Graylyn Estate, trained at Wake Forest University’s Spry Soccer Stadium and traveled through Smith Reynolds Airport.
Lasley said the city was the primary agency responsible for the team site, practice site and transportation. Forsyth County supported the effort at Smith Reynolds Airport, which is county property, and monitored cameras at the practice site through its Real-Time Intelligence Center.
Lasley then discussed how Forsyth County supports parades, college football and high school football games. For high school games, he said, the county looks at who is playing and conducts an intelligence workup, including issues that may follow from homes, schools and neighborhoods into the crowd.
“There’s really no event too small, in my opinion, that a real-time intelligence center should not be involved in,” Lasley said.
