On the evening of December 15, 2013, Dustin and Jamie Friedland returned to their Range Rover on the third level of a parking deck at The Mall at Short Hills (Short Hills Mall). It was shortly after 9:00 p.m., ten days before Christmas.
Dustin opened the passenger door for his wife, then walked around the rear of the vehicle. Two men approached, and a struggle ensued. Dustin was struck with a handgun and shot in the head. Jamie was forced from the vehicle at gunpoint. The attackers fled in the Range Rover, following their accomplices out of the garage in a GMC Suburban. Dustin Friedland was pronounced dead at the hospital. He was 30 years old. (New Jersey Courts)
The four men responsible were ultimately convicted or pleaded guilty. Their criminal responsibility is clear: they went to the mall intending to steal a vehicle, selected a target, brought a firearm, attacked an innocent couple, and murdered Dustin Friedland.
Nothing in a security analysis should dilute that responsibility. Yet protecting people from foreseeable threats is precisely what security is supposed to do. The Short Hills Mall attack raises a second, unavoidable question: how were armed criminals able to search one of the country’s most prestigious shopping-center parking areas, return after an earlier visit, and leave a trail of warning signs without being stopped?
That question matters far beyond the Short Hills Mall. It applies to every mall, office complex, hospital, residential tower, and commercial property that treats its parking garage as secondary infrastructure rather than a critical part of the security environment.
This Was Not a Random Encounter
The offenders did not arrive, unexpectedly see a Range Rover and make an impulsive decision. Court records show that they traveled to the property intending to steal a vehicle. The December 15 attack was not their first visit.
Three days earlier, a Millburn police sergeant observed the same two-tone GMC Suburban driving suspiciously through the mall parking lot and ran its plate. Surveillance footage later showed the Suburban following a white Range Rover from the property onto the highway. E-ZPass records placed it immediately behind that vehicle on the New Jersey Turnpike. Basim Henry later admitted that he and Hanif Thompson had gone to the mall to steal a vehicle. (New Jersey Courts)
On December 15, the group returned. Surveillance footage showed the Suburban moving through the property, waiting and searching until its occupants found the vehicle they wanted. After the shooting, the camera system recorded the Suburban and the stolen Range Rover leaving the garage at high speed. (ABC News)
This was a planned predatory operation conducted within the mall’s parking area. The offenders used that environment to search, observe, wait, approach, and escape. Their conduct unfolded over time, creating opportunities for detection and intervention.
What Went Wrong?
1. The Threat Should Have Been Understood
Four months before the murder, the Essex County Prosecutor, U.S. Attorney, Essex County Sheriff, and Newark police announced a joint campaign to address a sharp regional increase in carjackings. The Essex County Prosecutor’s Office reported that annual carjackings in the county had risen from slightly more than 200 in 2009 to more than 400. Officials also noted that these crimes often occurred at night and involved high-end vehicles.
The Mall at Short Hills was not an ordinary retail property. It drew affluent shoppers, luxury purchases and a concentration of expensive vehicles, with quick access to major highways. That did not make murder inevitable, but it made vehicle theft, robbery and carjacking clearly relevant to security planning.
Jamie Friedland’s wrongful-death complaint also alleged earlier robberies and carjacking incidents involving mall patrons, including a 2006 gunpoint carjacking and a 2009 robbery and attempted carjacking. The complaint further alleged that the mall had stopped hiring police officers for security due to cost concerns. Those were allegations, and the defendants disputed that the mall’s security posture caused the attack.
The broader question remains: was the security program calibrated to the actual threat environment or to a more comfortable perception of the property? Luxury properties can become victims of their own image. Prestige does not insulate a site from crime; sometimes it attracts offenders seeking valuable targets.
2. Surveillance Recorded the Threat but Did Not Disrupt It
The mall had cameras, and the recording from those cameras was extremely valuable after the murder. Investigators used them to identify the Suburban, reconstruct the offenders’ movements, and establish their earlier activity at the property. Within an hour, investigators were reviewing footage and issuing alerts. (New Jersey Courts)
The system helped solve the crime, but it did not help deter or prevent it.
That distinction remains one of the most misunderstood issues in physical security. A passive recording system may produce excellent forensic evidence while providing little real-time protective value. If no one is actively watching, if operators are overloaded, if suspicious behavior has not been defined, or if there is no rapid dispatch process, the system may simply document an attack.
The Short Hills Mall footage reportedly showed the offenders driving slowly through parking areas, lingering near potential targets, changing locations, returning on different days, and following selected vehicles. Cameras are sensors. They are not, by themselves, a security program.
3. The Garage Appears to Have Been Treated as Secondary Infrastructure
Shopping centers devote enormous attention to the interior customer experience. Entrances are polished, stores are brightly lit, and activity is highly visible. Then customers walk into the parking garage, where the environment changes immediately.
Garages contain columns, ramps, elevation changes, stairwells, blind corners, parked vehicles and inconsistent sightlines. Pedestrians and vehicles share confined space. Customers may be distracted by packages, keys, children or phones. A person sitting in a vehicle may not initially appear suspicious. These are predictable features of the environment, not surprises.
The Friedlands’ customer journey did not end at the mall door. The property invited them to shop and provided the garage through which they had to leave. From a risk-management perspective, the garage was part of the mall.
Yet parking facilities are still often treated as operational necessities rather than critical security zones. Officers focus on shoplifting and disorder inside. Exterior patrols may be intermittent or predictable. Camera coverage may exist, but operators focus on entrances rather than on behavior between vehicles. Management counts cameras and officers without establishing detailed requirements or testing their effectiveness.
4. Suspicious Activity Did Not Become Actionable Intelligence
The December 12 observation may be the most uncomfortable part of the case. A police sergeant observed the Suburban moving suspiciously through the parking area and ran its plate. It would be unfair to suggest that the officer should have predicted a murder three days later. Suspicious driving does not automatically establish probable cause for a stop or arrest.
But what happened to the information? Was it documented in a searchable format? Was mall security notified? Did the property maintain a suspicious-vehicle log? Were subsequent shifts briefed? Could operators retrieve the vehicle’s earlier movements? Was there a process to connect police observations, security reports, and video?
Security organizations often collect information without turning it into intelligence. An officer notices something. A dispatcher records it. A guard writes a report. A camera captures the vehicle. Each fact remains isolated. No one assembles the pieces.
Effective protective intelligence at the property level does not require a national command center. It begins with disciplined reporting, video preservation, tracking suspicious vehicles, police coordination, and shift-to-shift briefings. The objective is not to treat every unfamiliar car as a threat. It is to recognize patterns before they end in violence.
5. Deterrence and Intervention Were Not Credible Enough
The offenders searched the property, returned after an earlier visit, moved through the garage, waited for targets, committed the attack, and fled in two vehicles. That behavior suggests they did not perceive a meaningful likelihood of intervention.
Security presence is not measured solely by staffing numbers. It is measured by what an offender can observe: visible yet unpredictable patrols, officers moving through every level, challenges to unusual behavior, coordinated closing-period coverage, active monitoring, and the ability to converge quickly on a specific location.
No reasonable program can promise to stop every determined offender. But offenders make decisions about risk. Surveillance, patrol, and intervention should be credible enough to increase the perceived likelihood of detection before an attack begins.
6. Emergency Access Should Have Been Resolved Before the Crisis
The wrongful-death complaint stated the ambulance was too large to enter the parking deck, forcing responders to carry Dustin on a stretcher up the ramp and bring him back down. Millburn’s police chief disputed the claim that assistance was delayed, noting a crew chief arrived within ten minutes, the first ambulance within fourteen, and Dustin was in it by 9:31 p.m. (CBS News)
It would be inappropriate to claim that a different ambulance configuration would have changed the outcome of a catastrophic gunshot wound. However, emergency-access limitations should never be discovered during an actual shooting.
Garages pose predictable response challenges: height restrictions, narrow ramps, confusing level designations, radio dead zones and limited staging space. Police, fire, EMS and property personnel should know in advance which vehicles can enter, where larger apparatus must stage, how responders will reach upper levels, who will guide them, and whether callers’ level designations match those used by emergency services.
The Central Failure: Components Without a Protective System
It is tempting to reduce the case to a single issue: too few guards, passive cameras, limited police presence, a vulnerable garage, or an ambulance-access problem. The more important lesson is that security failures rarely occur in isolation.
A property can have cameras, officers, police relationships, incident reports, and emergency plans while still lacking a functioning protective system. A protective system must connect: threat information, detection, assessment, communication, intervention, emergency response, and review.
At the Short Hills Mall, the regional threat was known. A suspicious vehicle had been observed. Cameras captured extensive evidence of offender behavior. The attackers had time to search for targets. They escaped at high speed. Responders then faced the physical limitations of the garage.
Together, those facts suggest a system better equipped to reconstruct the crime than to interrupt the chain of events leading to it.
What Modern Technology Could Change
It is important not to rewrite history using technology that was immature, unaffordable, or unavailable in 2013. It is equally important to recognize how much has changed.
Even today, no camera, analytics system, or license-plate reader can guarantee prevention. Technology does not replace capable personnel, sound procedures, or police response. But modern systems can create far more opportunities to detect, assess, and interrupt the kinds of behavior seen before the Short Hills Mall attack.
License-Plate Recognition
A properly designed ALPR system can record when a vehicle enters and exits, how long it remains, which entrance it uses, and whether it appears repeatedly. If the December 12 observation had been entered into a shared system, a return on December 15 could have triggered an alert and linked the vehicle to its earlier suspicious activity.
ALPR requires clear governance, including retention periods, access controls, auditing, data-sharing rules, and privacy protections. Poor governance creates risk, but operational blindness is not an acceptable alternative.
Behavioral Video Analytics
Modern analytics alert operators to behaviors like repeated circulation without parking, extended stops in travel lanes, loitering, wrong-way movement, fast exits, recurring vehicles, and activity in restricted areas, reducing the need to monitor multiple screens.
An alert would not prove criminal intent. It could, however, prompt an operator to examine the Suburban while its occupants were still searching, rather than after shots had been fired. That is the difference between forensic and protective surveillance.
Cross-Camera Tracking and Mobile Response
Modern video-management systems can help operators track a vehicle across levels and camera zones, rather than manually guessing which camera to select next. Alerts and associated video can also be sent directly to supervisors, mobile officers, or a remote security operations center.
A responding officer could receive the vehicle image, plate, location, direction of travel, and reason for the alert. That does not require placing an officer on every level; it makes available personnel better informed and more likely to arrive at the right place.
Better Imaging, Mapping and Emergency Communications
Current cameras offer better low-light performance, dynamic range, and resolution, but specifications alone are not enough. Camera design must begin with operational objectives: read a plate, identify a person at an elevator, observe activity around parked vehicles, track movement between levels, or provide responders with useful live information.
Digital maps, standardized level designations, and preplanned response routes can also improve emergency coordination. Security should be able to provide police and EMS with the correct garage, level, entrance, route, and staging location—and indicate whether emergency vehicles can physically enter.
Why Technology Alone Is Still Not Enough
A sophisticated platform can be misconfigured. An ALPR system can generate thousands of records that no one reviews. Analytics can produce so many false alarms that operators ignore them. A mobile alert can reach an officer who has not been trained to respond.
Technology creates value only when it supports a defined operating model: detect, assess, communicate, respond, document, and review.
This requires clear behavior criteria, validated coverage, trained operators, realistic staffing, police-contact thresholds, shift intelligence sharing, privacy rules, testing, quality assurance, and post-incident reviews. Without these, owners may spend heavily to modernize security’s appearance without improving its protective ability.
What Garage Owners Should Have Learned
The Short Hills Mall murder should have compelled owners and operators across the region to reassess parking facilities. Hopefully, many did. But more than a decade later, too many garages still seem to be managed as an afterthought.
The weak formula remains familiar: install cameras, upgrade a few lights, post surveillance signs, schedule occasional vehicle patrols, and assume the problem is solved.
Many garages have cameras mainly recording crimes, leaving blind spots around columns, ramps, and stairwells, with unreliable plate capture. Patrols are predictable or poorly documented, and operators lack criteria for spotting suspicious behavior. Reports aren’t compared across shifts, and police observations don’t reach property staff. Emergency plans state street addresses but not access routes to Level Three.
The property may technically have security, but it lacks security performance.
Camera Count Is Not a Security Measure
Owners still ask, “How many cameras do we have?” The better questions are: What can they detect? What can they identify? Which behaviors attract attention? Who receives an alert? How quickly is it assessed? How quickly can someone intervene? Can the system track a vehicle from entry to exit? Can it identify a vehicle that was seen three days earlier?
A garage with 300 poorly positioned, passively monitored cameras may be less secure than one with 80 well-designed cameras connected to analytics, communications, and disciplined response procedures.
Signs Are Not Deterrence
A sign stating that the premises are under surveillance may discourage some opportunistic behavior. It will not necessarily deter organized offenders who see no visible security presence, no challenge to suspicious conduct, and no indication that anyone is watching in real time.
Deterrence must be credible: visible yet unpredictable patrols, monitored help points, rapid response, and clear evidence that systems are actively managed. To an experienced offender, an unattended camera may mean only that the crime will be recorded.
Security Must Look for Pre-Incident Behavior
Many programs are still designed to respond only after an event: a theft, break-in, assault, or display of a weapon. By then, the protective opportunity may have passed.
A mature garage-security program should monitor repeated circulation, target selection, following, waiting near pedestrian transitions, concealment, door testing, patrol avoidance, coordinated vehicle activity, and unusual interest in high-value cars.
None of those behaviors proves criminal intent. That is why assessment and proportionate response matter. But refusing to examine pre-incident behavior leaves security reacting only after the threat has become unmistakable—possibly after the offender already has a weapon in hand.
The Failure to Learn Is Itself a Risk
Owners and operators are not expected to prevent every crime. They are expected to learn.
A major incident should prompt reassessment of assessments, budgets, policies, patrol strategies, technology standards, and emergency planning. Yet institutional memory is short. Management becomes paralyzed, fearing that any action will admit liability or demonstrate incompetence. Management changes. Budgets tighten. Recommendations are deferred. Officer staffing is reduced. Systems installed after an incident become obsolete, misconfigured, or ignored.
The emotional impact fades, but the vulnerability remains.
The most troubling possibility is not that garage owners failed to understand the lesson of the Short Hills Mall in 2013. It is that many understood it temporarily and then returned to business as usual.
The Question Owners Should Be Asking Today
The question is not whether modern technology could guarantee that the exact Short Hills Mall attack would never recur. It could not.
Would the behavior preceding the attack be more likely to attract attention today? Would repeated circulation trigger an alert? Would the December 12 observation be available to the next shift? Would a returning plate be recognized? Could an operator track it across levels? Would an officer be dispatched to observe? Could police receive a usable image and a live location before the offenders selected a victim? Would responders know exactly where to go and how to get there?
At too many properties, the honest answer may still be “no.”
The technology has changed dramatically since December 2013. The threat has not. And in far too many parking garages, the thinking has not either.
The Mall at Short Hills Today
The Mall at Short Hills is, and always has been, a safe place to visit. As could happen with any location, it was caught off guard by a very foreseeable threat during its busiest time of the year.
Today, the mall has a visible but modest guard force, an upgraded camera system, and a strong police presence from the Millburn, NJ, police. The nearby area has robust mutual aid, with support from adjacent municipalities, well-trained fire departments, and medical teams. State-of-the-art medical facilities are minutes away. As one of the few surviving malls, it appears to thrive, attracting locals and visitors from around the country and world.
Source note: This case study is based on the New Jersey court record, Essex County Prosecutor’s Office materials, public reporting by ABC News and CBS News, and allegations in the wrongful-death complaint. Allegations are identified as such and should not be treated as adjudicated findings.
About Patrick Hurley
Patrick Hurley is the Founder and Managing Principal of S6RG, an independent physical security and risk advisory firm. He brings more than 30 years of experience spanning military service, corporate risk management, public safety, security operations, and crisis management.
A graduate of the United States Naval Academy and a former U.S. Navy Naval Aviator, Patrick has worked with major financial institutions, Fortune 100 companies, and some of the country’s most recognizable properties to develop physical risk management programs for complex commercial, industrial, and residential sites.
At the time of the December 2013 Short Hills Mall carjacking, he was an elected member of the Summit, New Jersey, City Council and Chairman of Public Safety. Because Summit directly borders Short Hills, that role gave him keen insight into the incident, including the regional threat environment, local emergency response, and the incident’s broader public-safety impact.
Through S6RG, Patrick advises clients on protective risk assessments, security technology, program design, crisis management, emergency planning, project oversight, and litigation support.
About S6RG
S6RG is an independent physical security and risk advisory firm helping organizations protect people, property, operations, and reputation. The firm provides protective risk assessments, security program design, technology evaluation, crisis management, emergency planning, project oversight, value engineering, and litigation support.
S6RG brings sophisticated, enterprise-level experience to businesses, property owners, public entities, schools, houses of worship, and private clients that need practical, objective, and vendor-neutral guidance.