The number and identities of people in a building along with personal data that is useful in disaster response planning are determined from a database receiving information from the building's security access card readers and from user information extracted from wireless network access points. This information is used in the event of a disaster alarm to quickly compute vulnerability indicia for each of several locations in a building and each of several buildings in a group.