I managed a resort property once that sat next to a popular entertainment district. Free parking at our lot. Free shuttle to the district. Free lobby bathrooms. Free lobby WiFi. We were hemorrhaging operational capacity on people who would never spend a dime with us. Our shuttle was standing room only at peak times... and half the people on it didn't have a room key. Our front desk staff spent 20% of their time giving directions to people who weren't guests. Our pool attendant was playing bouncer three days a week.

I begged ownership for a gate system. "Too unwelcoming," they said. "We want to be part of the community." Meanwhile, the guests who were paying $249 a night couldn't get a seat on the shuttle to the place they booked us to be near. That's the paradox every resort operator lives with. You want the open, welcoming vibe. But open and welcoming has a cost, and that cost shows up in guest satisfaction scores, labor hours, and amenity wear.

Disney just solved this with a sledgehammer. As of today, anyone boarding a bus or river cruise from Disney Springs to a resort hotel needs a MagicBand, a resort ID, or a confirmed dining reservation (and that reservation only gets you a two-hour window). They've added GPS geotracking on mobile ordering at deluxe resorts so day visitors can't use a food order as a backdoor past the gate. Parking at deluxe hotels now requires a digital room key or dining confirmation. This isn't a pilot program... they tested it over New Year's and Easter, and now it's permanent across every resort property. They spent $15.8 million on security back in 2018 (more than double their 2011-2015 budget), and with $60 billion earmarked for parks and experiences over the next decade, this is clearly just the beginning.

Here's the thing nobody in our industry wants to say out loud: access control is revenue protection. Disney isn't doing this because they're worried about safety (though that's the framing). They're doing this because non-resort guests were degrading the experience for resort guests... filling shuttles, crowding pools, using Disney Springs' free parking to avoid theme park parking fees. Every body on that shuttle who isn't paying $400+ a night for a deluxe room is diluting the product. Disney figured out that the "welcoming resort vibe" was actually subsidizing freeloaders at the expense of paying customers. And they stopped. Most of us can't deploy MagicBands and GPS geofencing. But the principle is universal. If you're running a resort or a full-service property near any kind of attraction, entertainment district, or public venue, you are almost certainly absorbing operational cost from people who aren't your guests. Shuttle capacity, parking, pool access, lobby congestion, front desk interruptions, housekeeping in public restrooms. None of it shows up as a line item on your P&L, but it's there... eating labor hours, accelerating wear on FF&E, and quietly eroding the experience for the people actually generating your revenue.

The uncomfortable truth is that "hospitality" and "open access" are not the same thing. Disney just drew that line publicly, at massive scale, with technology most of us don't have. But every operator can draw it with policy, signage, staffing decisions, and parking management. The question isn't whether you should. It's whether you've been honest with yourself about what open access is actually costing you.

A regular at my blues club in Chicago back in the day, managed a hotel during the first Gulf War. Not in the Middle East... stateside, in a market with a large military installation nearby. I remember the week the threat level went up and he told me he got a call from local law enforcement suggesting he "review his properties security posture." That's government-speak for "we don't know what's coming and neither do you." He had a 280-key full-service hotel, a security team of three, and a corporate office that sent a PDF about "situational awareness." That PDF didn't help him figure out what to tell his front desk team when a guest asked if the hotel was safe.

That was a vague, indirect, maybe-something-happens situation. What's happening right now in the Middle East is different by orders of magnitude. Iran's state media, directly linked to the Revolutionary Guard, published specific hotel names... including a Four Seasons and a Sheraton... and called them legitimate military targets. Their claim is that US personnel are sheltering in civilian hotels. Whether that's true, partially true, or propaganda doesn't matter to the GM running a property in the Gulf right now. What matters is that a sovereign nation just told the world it considers your building a valid thing to shoot at. And this isn't hypothetical posturing. A property in Dubai has already taken damage. Dubai's airport was hit by a drone strike two weeks ago. Eleven people have reportedly died from strikes on hotels, airports, and residential buildings in Gulf states since this conflict started February 28th.

Let me be direct about what this means beyond the Middle East. The ripple effects are already massive... 80,000 hotel bookings cancelled across the Gulf, over 20,000 flights cancelled globally, and an estimated $600 million per day in lost visitor spending across Gulf tourism markets. Per day. That number is almost incomprehensible, but it's real, and it's hitting ownership groups, management companies, and individual properties in ways that will take years to fully unwind. If you're running a hotel in Dubai, Doha, Bahrain, or anywhere in that corridor, your business didn't slow down. It stopped. And the insurance implications alone... when a government explicitly names hotels as targets, every policy in the region is about to get repriced or cancelled.

But here's what I keep thinking about, and it's the part that connects to operators who aren't anywhere near the Persian Gulf. The security conversation in our industry has been about cybersecurity, active shooters, and maybe the occasional hurricane preparedness plan for the last decade. We haven't had to think about hotels as geopolitical targets since Mumbai in 2008. That attack changed security protocols globally for about 18 months, and then most properties quietly drifted back to baseline because the threat felt distant. This conflict is going to force that conversation open again... not just for international properties, but for any hotel in a market with symbolic value, government facilities, military presence, or high-profile international guests. Your security plan, whatever it says, was probably written for a world where hotels were soft targets of opportunity. We just entered a world where a state actor is publicly declaring them hard targets of intention. That's a fundamentally different risk profile, and most of our industry isn't remotely prepared for it.

The 10-day pause on US strikes against Iranian energy infrastructure buys a little time. Maybe talks go somewhere. Maybe they don't. But the precedent is set. A government said hotels are fair game and then acted on it. That bell doesn't un-ring. Every owner with international exposure, every management company with Middle Eastern or North African properties, and every brand with flags in sensitive markets needs to be having a very different conversation this week than they were having last month. And if you're stateside thinking this doesn't touch you... the State Department issued a worldwide caution for Americans abroad on March 22nd. Your international group business, your inbound tourism from markets that now have to route around a war zone, your insurance renewals... this touches you. You just might not feel it until next quarter.