Recognising the terrorist threat

Updated 24 March 2017

This guidance was withdrawn on

There is a serious and sustained threat from both international and Irish-related terrorism to the UK and UK interests overseas.

1. Threat levels

You can check the current threat levels:

The most significant terrorist threat comes from international terrorism. As a number of recent European attacks have showed, attacks may be mounted without warning.

Northern Ireland-related terrorism continues to pose a threat. Dissident republican terrorist groups (such as the Real IRA and the Continuity IRA) have rejected the 1998 Good Friday Agreement. They still aspire to mount attacks within the UK mainland and have conducted attacks within Northern Ireland.

2. ETHANE - Initial actions at a terrorist major incident

2.1 Exact Location

  • Confirm nearest junction or exact address
  • Geographic size of the incident

2.2 Type of Incident

  • Explosion, building collapse, firearms incident etc.

2.3 Hazards

  • Identify the hazards present or suspected (such as number of hostiles, types of weapons etc.)
  • Consider potential or secondary devices
  • Is evacuation or invacuation necessary and safe?

2.4 Access Routes

  • Update with routes that are safe to use
  • Clarify routes which are blocked
  • Nominate and search the RVP

2.5 Number of Casualties

  • List type and severity
  • Approximate number of dead, injured, survivors and witnesses

2.6 Emergency Services

  • List those Services present and those required
  • Conduct a joint dynamic hazard assessment with the emergency services

3. STAY SAFE : Terrorist firearms and weapons attacks

Firearms and Weapons attacks are rare in the UK. The ‘STAY SAFE’ principles tell you some simple actions to consider at an incident and the information that armed officers may need in the event of a weapons or firearm attack:

3.1 RUN

  • Escape if you can
  • Consider the safest options
  • Is there a safe route? RUN if not HIDE
  • Can you get there without exposing yourself to greater danger?
  • Insist others leave with you
  • Leave belongings behind

3.2 HIDE

  • If you cannot RUN, HIDE
  • Find cover from gunfire
  • If you can see the attacker, they may be able to see you
  • Cover from view does not mean you are safe, bullets go through glass, brick, wood and metal
  • Find cover from gunfire e.g. substantial brickwork / heavy reinforced walls
  • Be aware of your exits
  • Try not to get trapped
  • Be quiet, silence your phone and turn off vibrate
  • Lock / barricade yourself in
  • Move away from the door

3.3 TELL

Call 999 - What do the police need to know? If you cannot speak or make a noise listen to the instructions given to you by the call taker

  • Location - Where are the suspects?
  • Direction - Where did you last see the suspects?
  • Descriptions – Describe the attacker, numbers, features, clothing, weapons etc.
  • Further information – Casualties, type of injury, building information, entrances, exits, hostages etc.
  • Stop other people entering the building if it is safe to do so


  • Follow officers instructions
  • Remain calm
  • Can you move to a safer area?
  • Avoid sudden movements that may be considered a threat
  • Keep your hands in view


  • Point guns at you
  • Treat you firmly
  • Question you
  • Be unable to distinguish you from the attacker
  • Officers will evacuate you when it is safe to do so

You must STAY SAFE

  • What are your plans if there were an incident?
  • What are the local plans? e.g. personal emergency evacuation plan

Further advice

citizenAID is a simple, clear teaching aid for immediate actions and first aid for a stabbing, bomb incident or mass shooting. Building on Run, Hide Tell, this helps people understand what to do in the event of an attack.

4. Suspicious items - Guidance for the public

  • Do not touch
  • Try and identify an owner in the immediate area
  • If you still think it’s suspicious, don’t feel embarrassed or think anybody else will report it
  • Report it to a member of staff, security, or if they are not available dial 999 (do not use your mobile phone in the immediate vicinity)
  • Move away to a safe distance - Even for a small item such as a briefcase move at least 100m away from the item starting from the centre and moving out

Remember - If you think it’s suspicious, SAY SOMETHING

5. Suspicious items - Guidance for staff

When dealing with suspicious items apply the 4 C’s protocol:-

5.1 CONFIRM whether or not the item exhibits recognisably suspicious characteristics

The HOT protocol may be used to inform your judgement:-


  • Has the item been deliberately concealed or is it obviously hidden from view?

OBVIOUSLY suspicious?

  • Does it have wires, circuit boards, batteries, tape, liquids or putty-like substances visible?
  • Do you think the item poses an immediate threat to life?

TYPICAL Is the item typical of what you would expect to find in this location?

  • Most lost property is found in locations where people congregate. Ask if anyone has left the item

If the item is assessed to be unattended rather than suspicious, examine further before applying lost property procedures
However, if H-O-T leads you to believe the item is suspicious, apply the 4Cs

5.2 CLEAR the immediate area

  • Do not touch it
  • Take charge and move people away to a safe distance. Even for a small item such as a briefcase move at least 100m away from the item starting from the centre and moving out
  • Keep yourself and other people out of line of sight of the item. It is a broad rule, but generally if you cannot see the item then you are better protected from it
  • Think about what you can hide behind. Pick something substantial and keep away from glass such as windows and skylights
  • Cordon off the area

5.3 COMMUNICATE - Call 999

  • Inform your control room and/or supervisor
  • Do not use radios within 15 metres

5.4 CONTROL access to the cordoned area

  • Members of the public should not be able to approach the area until it is deemed safe
  • Try and keep eyewitnesses on hand so they can tell police what they saw

6. Mail handling

6.1 Small deliveries by courier and mail handling

Most businesses will receive a large amount of mail and other deliveries which offers a potentially attractive route into premises for terrorists. A properly conducted risk assessment should give you a good idea of the likely threat to your organisation and indicate precautions you need to take.

Delivered items which includes letters, parcels, packages, and anything delivered by post or courier, have been a commonly used tactic by criminals and terrorists. Delivered items may be explosive, incendiary, contain sharps, blades or chemical, biological or radiological (CBR) material. The phrase ‘white powders’ is often used in the context of mail and encompasses CBR material as well as benign materials. Be aware that such materials may not be white and may not be powders.

Anyone receiving a suspicious delivery is unlikely to know which type it is, so procedures should cater for every eventuality. Threat items come in a variety of shapes and sizes; a well-made device will look innocuous, but there may be tell-tale signs.

6.2 Indicators for suspicious deliveries/mail

General indicators that a delivered item may be of concern include:

  • unexpected item, especially if hand delivered
  • a padded envelope (Jiffy Bag) or other bulky package
  • additional inner envelope or other contents that may be difficult to remove
  • labelling or excessive sealing that encourages opening at a particular end or in a particular way
  • oddly shaped or lopsided
  • envelope flap stuck down completely (normally gummed envelope flaps leave slight gaps at edges)
  • marked ‘To be opened only by…’ ‘Personal’ or ‘Confidential’
  • item addressed to the organisation or a title (rather than a specific individual)
  • unexpected or unusual origin (postmark and/or return address)
  • no return address or return address that cannot be verified
  • poorly or inaccurately addressed address printed unevenly or unusually
  • unfamiliar writing or unusual style
  • unusual postmark or no postmark
  • more stamps than needed for size or weight of package
  • greasy or oily stains emanating from the package
  • odours emanating from the package

6.3 Explosive or incendiary indicators

A delivered item may have received some rough handling in the post and so is unlikely to detonate through being moved. Any attempt at opening it, may set it off or release the contents. Additional explosive or incendiary indicators include:

  • unusually heavy or uneven weight distribution
  • small hole(s) in the envelope or wrapping

6.4 CBR indicators

Additional CBR indicators include:

  • powders, liquids emanating from the package
  • wrapping stained by liquid leakage
  • unexpected items or materials found in the package on opening or x-raying (loose or in a container) such as powdered, crystalline or granular solids; liquids; sticky substances or residues
  • unexpected odours observed on opening
  • sudden onset of illness or irritation of skin, eyes and nose

6.5 What you can do

Though the precise nature of the incident may not be immediately apparent the first step will be recognition that an incident has occurred, such as through the indicators described above. The response procedure will follow including communication with the emergency services, who will provide the appropriate response. Ensuring that the appropriate staff are familiar with your response procedure is key to its successful implementation.

Some points to consider when planning your response procedure include:

  • ensure that forethought is put into communication with both staff and the emergency services
  • check that doors can be closed quickly if required
  • pre-plan your evacuation routes, ensuring they do not lead building occupants through affected areas. Consider how you will communicate the evacuation routes to occupants during an incident. The level of evacuation may vary depending on the nature of an incident and may not require the evacuation of your entire building or site
  • consult with your Building Services Manager on the feasibility of emergency shutdown or isolation of heating, ventilation and air conditioning (HVAC) systems (including local extraction systems in areas like kitchens) and ensure that any such plans are well rehearsed. Due to the complexity of HVAC systems and the variability across buildings and sites, it is not possible to provide generic advice on the alteration or otherwise of HVAC systems in response to an incident - consultation with your organisation’s building services manager and/or specialist HVAC engineers is essential

You don’t need to make any special arrangements for medical care beyond normal first aid provision, as emergency services will take responsibility for casualty treatment. However the provision of materials to undertake improvised decontamination, such as absorbent materials and water, in a suitable location, such as where you would likely evacuate contaminated staff to, may be appropriate.

6.6 Planning your mail handling and screening procedures

A risk assessment is fundamental to ensuring that any measures or procedures your organisation implements are proportional to the risk it faces. You should also consider your response should there be any changes to your organisation’s risk assessment or mail streams.

There are a number of physical protective measures, including blast protection, dedicated HVAC systems, specialist filtration, washing and shower facilities, that can be used to protect your organisation and those undertaking mail screening. These should be proportionate to the level of screening needed, but you should consider the highest anticipated level of screening that may be required, as physical protective measures may be challenging to alter in response to any change in threat.

Although not all suspicious items will be hazardous or malicious, you may not be able to determine this without support from the emergency services. Therefore communication with the emergency services is important in triggering the appropriate response, as highlighted above.

Your local police [Counter Terrorism Security Advisor CTSA can assist with this process by providing information to support threat and impact assessments, as well as relevant mitigation measures.

When planning you should consider the following measures:

  • processing all incoming mail and deliveries at one point only so deliveries can be handled without taking them through other parts of the building. This should ideally be off-site, in a separate building, or at least in an area that can be easily isolated
  • ensure mail handling areas can be promptly evacuated. Rehearse evacuation procedures and routes as well as communication mechanisms which would be used throughout the incident
  • Make sure that all staff who handle mail, including reception staff, know how to recognise a suspicious item and respond appropriately
  • If staff encounter a package containing a suspected contaminant they should understand the importance of not touching or moving the package and to isolate themselves in safe location to limit the spreading of any contamination
  • staff need to be aware of the usual pattern of deliveries and be briefed on unusual deliveries
  • ensure all sources of incoming mail, such as Royal Mail, couriers and hand delivery, are included within your overall screening process. Note that not all mail streams, such as internal mail, may require the same level of screening if it is deemed lower risk
  • encourage regular correspondents to put their return address on each item
  • currently there are no CBR detectors capable of reliably identifying all hazards. While x-ray mail scanners may detect devices for spreading CBR materials, such as explosive devices, they will not detect the materials themselves. For further advice on CBR detection, contact your local CTSA

6.7 Actions upon discovery of any suspicious delivered item:

You could discover a suspicious item in a mail room, or anywhere else in the building - ensure you have appropriate emergency response plans in place.

Avoid unnecessary handling and x-raying:

  • if you are holding the item, put it down on a cleared flat surface
  • keep it separate so it is easily identifiable
  • do not move it, even to x-ray it
  • if it is in an x-ray facility, leave it there

Move away immediately

  • clear immediate area and each adjacent room, including rooms above and below
  • if there is any suggestion of chemical, biological or radiological materials, move those directly affected to a safe location close to the incident - keep these individuals separate from those not involved
  • prevent others approaching or accessing the cleared areas
  • Do not use mobile phones or two-way radios in the cleared area or within fifteen metres of the suspect package.
  • Communicate regularly with staff, visitors and the public

Notify police

  • if the item has been opened, or partially opened prior to being deemed suspicious, it is vital that this is communicated to the police
  • ensure informants and witnesses remain available to brief the police, and that the accuracy of their observations is preserved: encourage witnesses immediately to record their observations in writing, and discourage them from discussing the incident or their observations with others prior to the arrival of the police

If a CBR incident is suspected

  • undertake improvised decontamination of contaminated people as quickly as possible, ideally within the first 15 minutes
  • Do not use lifts to move around, or evacuate the building
  • If the alteration of the HVAC system features within your response plan, this should be undertaken as quickly as possible
  • If in doubt call 999 and ask for the police
  • Clear the area immediately
  • Do not attempt to open the letter or package
  • Avoid unnecessary handling
  • Keep it separate so it is easily identifiable.

Further advice on screening mail and courier deliveries

7. Bomb threat guidance

The vast majority of bomb threats are hoaxes designed to cause alarm and disruption. As well as the rare instances of valid bomb threats, terrorists may also make hoax bomb threat calls to intimidate the public, businesses and communities, to draw attention to their cause and to mislead police. While many bomb threats involve a person-to-person phone call, an increasing number are sent electronically using email or social media applications.

No matter how ridiculous or implausible the threat may seem, all such communications are a crime and should be reported to the police by dialling 999

It is important that potential recipients - either victims or third-parties used to pass the message - have plans that include how the information is recorded, acted upon and passed to police.

7.1 The bomb threat message

Bomb threats containing accurate and precise information, and received well in advance of an actual attack, are rare occurrences. Precise motives for hoaxing are difficult to determine but may include revenge, extortion, a desire to impress, or a combination of these and other less understandable motives. The vast majority of cases are hoaxes and the intent is social engineering, to cause disruption, fear and/or inconvenience the victim.

7.2 Communication of the threat

A bomb threat can be communicated in a number of different ways. The threat is likely to be made in person over the telephone; however, it may also be a recorded message, communicated in written form, delivered face-to-face or, increasingly, sent by email or social media (e.g. Twitter or Instagram, etc.). A threat may be communicated via a third-party, i.e. a person or organisation unrelated to the intended victim and identified only to pass the message.

7.3 Immediate steps if you receive a bomb threat communication

Any member of staff with a direct telephone line, mobile phone, computer or tablet etc., could conceivably receive a bomb threat. Such staff should, therefore, understand the actions required of them as the potential first response to a threat message.

If you receive a telephone threat you should:

  • stay calm and listen carefully
  • have immediate access to a checklist on key information that should be recorded (see bomb threat checklist - attached)
  • if practical, keep the caller talking and alert a colleague to dial 999
  • if displayed on your phone, note the number of the caller, otherwise, dial 1471 to obtain the number once the call has ended
  • if the threat is a recorded message write down as much detail as possible
  • If the threat is received via text message do not reply to, forward or delete the message. Note the number of the sender and follow police advice
  • know who to contact in your organisation upon receipt of the threat, e.g. building security/senior manager. They will need to make an assessment of the threat

If the threat is delivered face-to-face:

  • try to remember as many distinguishing characteristics of the threat-maker as possible

If discovered in a written note, letter or as graffiti:

  • treat as police evidence and stop other people touching the item

If the threat is received via email or social media application:

  • do not reply to, forward or delete the message
  • note the sender’s email address or username/user ID for social media applications
  • preserve all web log files for your organisation to help the police investigation (as a guide, 7 days prior to the threat message and 48 hours after)

REMEMBER Dial 999 and follow police advice. Seek advice from the venue security/operations manager as soon as possible

7.4 Assessing the credibility of bomb threats

Evaluating the credibility of a threat is a critical task, particularly if the attack being threatened is imminent. This is a tactic used to place additional pressure on decision makers. Police will assess the threat at the earliest opportunity. When specific intelligence is known to police, advice will be issued accordingly; however, in the absence of detailed information, it will be necessary to consider a number of factors:-

  • is the threat part of a series? If so, what has happened elsewhere or previously?
  • can the location of the claimed bomb(s) be known with precision? If so, is a bomb visible at the location identified?
  • considering the hoaxer’s desire to influence behaviour, is there any reason to believe their words?
  • if the threat is imprecise, could an external evacuation inadvertently move people closer to the hazard?
  • is a suspicious device visible?

7.5 Actions to consider

Responsibility for the initial decision making remains with the management of the location being threatened. Do not delay your decision making process waiting for the arrival of police. Police will assess the credibility of the threat at the earliest opportunity. All bomb threats should be reported to the police and their subsequent advice followed accordingly. It is essential that appropriate plans exist, they should be event and location specific. Venue options to manage the risk include:-

External evacuation

Leaving the venue will be appropriate when directed by police and/or it is reasonable to assume the threat is credible, and when evacuation will move people towards a safer location.

It is important to appoint people, familiar with evacuation points and assembly (rendezvous) points, to act as marshals and assist with this procedure. At least two assembly points should be identified in opposing directions, and at least 500 metres from the suspicious item, incident or location. Where possible the assembly point should not be a car park. You may wish to seek specialist advice, which can help to identify suitable assembly points and alternative options as part of your planning. It is essential that evacuation plans exist; they should be event and location specific. Evacuation procedures should also put adequate steps in place to ensure no one else enters the area once an evacuation has been initiated.

The police will establish cordons depending upon the size of an identified suspect device. Always follow police directions and avoid assembly close to a police cordon.

Internal or inwards evacuation (‘invacuation’)

There are occasions when it is safer to remain inside. Staying in your venue and moving people away from external windows/walls is relevant when it is known that a bomb is not within or immediately adjacent to your building.

If the suspect device is outside your venue, people may be exposed to greater danger if the evacuation route inadvertently takes them past the device. A safer alternative may be the use of internal protected spaces. This type of inwards evacuation needs significant pre-planning and may benefit from expert advice to help identify an internal safe area within your building. These locations should be in your plans.

If the location of the device threatened is unknown, evacuation represents a credible and justifiable course of action.

Decision not to evacuate or inwardly evacuate

This will be reasonable and proportionate if, after an evaluation by the relevant manager(s), the threat is deemed implausible (e.g. a deliberate hoax). In such circumstances police may provide additional advice and guidance relating to other risk management options. It may be considered desirable to ask staff familiar with the venue to check their immediate surroundings to identify anything out of place, see search considerations below.

Checking your venue for suspicious items - Search considerations

Regular searches of your establishment, proportionate to the risks faced, will enhance a good security culture and reduce the risk of a suspicious item being placed or remaining unnoticed for long periods. Additionally, if you receive a bomb threat and depending upon how credible it is, you may decide to conduct a ‘search’ for suspicious items. To that end:

  • ensure plans are in place to carry out an effective search in response to a bomb threat
  • identify who in your venue will coordinate and take responsibility for conducting searches
  • initiate a search by messaging over a public address system (coded messages avoid unnecessary disruption and alarm), by text message, personal radio or by telephone cascade
  • divide your venue into areas of a manageable size for 1 or 2 searchers. Ideally staff should follow a search plan and search in pairs to ensure nothing is missed
  • ensure those conducting searches are familiar with their areas of responsibility. Those who regularly work in an area are best placed to spot unusual or suspicious items
  • focus on areas that are open to the public; enclosed areas (e.g. cloakrooms, stairs, corridors, lifts etc.) evacuation routes and assembly points, car parks, other external areas such as goods or loading bays
  • develop appropriate techniques for staff to be able to routinely search public areas without alarming any visitors or customers present
  • under no circumstances should any suspicious item be touched or moved in any way. Immediately start evacuation and dial 999
  • ensure all visitors know who to report a suspicious item to and have the confidence to report suspicious behaviour

Remember: it is vital that regular drills are carried out to ensure all are familiar with bomb threat procedures, routes and rendezvous points. Disabled staff should have personal evacuation plans and be individually briefed on their evacuation procedures. Similarly all visitors should be briefed on evacuation procedures and quickly identified and assisted in the event of a threat.

Familiarising through testing and exercising will increase the likelihood of an effective response to an evacuation and aid the decision making process when not to evacuate/invacuate.

7.6 Media and communication

Avoid revealing details about specific incidents to the media or through social media without prior consultation with police. Do not provide details of the threat, the decision making process relating to evacuation (internal or external) or why a decision not to evacuate was taken.

Releasing details of the circumstances may:

  • be an objective of the hoaxer and provide them with a perceived credibility
  • cause unnecessary alarm to others
  • be used by those planning to target other venues
  • elicit copycat incidents
  • adversely affect the subsequent police investigation

8. Vehicle-borne improvised explosive devices (VBIED)

VBIEDs can be highly destructive. Not only can the bomb blast be lethal, but flying debris, such as glass, can present a hazard.

VBIEDs can carry a large quantity of explosives to a target and cause a great deal of damage. The device can be delivered at a time of the terrorist’s choosing, with reasonable precision (depending on defences). It can be detonated from a safe distance using a timer or remote control, or can be detonated on the spot by a suicide bomber.

The UK has a history of VBIED-based terrorist attacks which used fertiliser-based explosives dating back to the early 1970s. In 1998 in Omagh a device containing agricultural fertiliser (ammonium nitrates) was detonated, killing 29 people and injuring hundreds. In 1996 in Manchester, a device made from a mixture containing agricultural fertiliser devastated the city.

Find out more about how to store hazardous materials safely and how to Secure your fertiliser.

8.1 Planning

Vehicle access controls

Use robust physical barriers to keep all but authorised vehicles at a safe distance. You should ensure you have effective controls, particularly at goods entrances and service yards:

  • do not allow unchecked vehicles to park in underground car parks or service areas directly below public areas or where there is a risk of structural collapse
  • demand that details be provided in advance for any contract vehicles and the identity of the driver and passengers coming to your goods or service areas
  • deny access to any vehicle that arrives without prior notice

Ask your local CTSA for advice on further measures, such as electronic surveillance (for example, automatic number plate recognition software) or options for protection from flying glass.

Physical security

Do what you can to make your premises blast resistant - paying particular attention to windows. You could have the structure checked by a qualified security or structural engineer.

You will need to balance the installation of physical barriers (for example, bollards) against safety requirements. Check your fire safety risk assessment and the planning regulations.

Personnel security

Organise and rehearse bomb threat and evacuation drills. In a VBIED incident, windowless corridors or basements may be safer than outside assembly points.

Train and rehearse staff in identifying suspect vehicles, and in receiving and acting upon bomb threats. Key information and telephone numbers should be prominently displayed and readily available.

The CPNI provides advice on hostile vehicle mitigation and has published Integrated Security: a public realm guide for hostile vehicle mitigation.

9. Hostile vehicle mitigation (HVM)

9.1 Introduction to vehicle borne threats.

The threats range from vandalism to sophisticated or aggressive attack by determined criminals or terrorists.

  • Vehicles offer a convenient method to deliver a bomb, known as a vehicle borne improvised explosive device (VBIED)
  • A vehicle can also be used as a weapon to ram and damage infrastructure or to injure and kill people

9.2 VBIEDs

The effects from a VBIED include the blast, fireball, primary, and secondary fragmentation and ground shock. Blast stand-off (the distance between the explosive and the asset) is the single most important factor in determining the extent of damage that can be caused. This is site specific, it is important to maximise this distance.

There are five main attack types when using a Vehicle Borne Improvised Explosive Device (VBIED):

  • Parked: A VBIED may be parked close to an asset that is the terrorist’s target. The blast effects are far greater when the VBIED is closer to the asset
  • Encroachment: A hostile vehicle may be able to exploit gaps in perimeter protection, or tailgate a legitimate vehicle through a single layer Vehicle Access Control Point (VACP). Alternatively a hostile can tamper with an active vehicle security barrier to open it in advance of an attack
  • Penetrative: A vehicle may be used to weaken and/or breach a building or physical perimeter. A penetrative attack could result in an IED detonating inside a weakened structure
  • Deception: A hostile vehicle may be modified to replicate a legitimate vehicle (i.e. “Trojan horse” vehicle), be an ex-fleet vehicle or the occupant(s) of a vehicle may use pretence to gain site access
  • Duress: A security officer could be forced to open a vehicle access control point (VACP) or a legitimate driver could be forced to take an IED within their vehicle in to a vulnerable location Other VBIED attack methods may be a combination of the above to get a VBIED closer to a terrorist’s target; this is known as a layered attack

9.3 Vehicle as a weapon (VAAW)

A vehicle by itself can also be used with hostile intent to breach a perimeter, ram and damage infrastructure, or as a weapon to injure and kill people. This is referred to as a ‘vehicle as a weapon’ attack. The use of VAAW has been used by terrorists to target crowded places. A broad range of vehicles can cause significant loss of life and serious injury.

9.4 Mitigating a vehicle borne attack

Threats from vehicles can be mitigated by installing physical measures (including blending into the landscape or streetscape) which may be passive (static) or active (security controlled). These measures can be installed either on a permanent or temporary basis. All such measures should meet appropriate standards in terms of their vehicle impact performance, design and installation. The nature and extent of mitigation will dependent upon a risk assessment and operational requirement specific to that site or event.

Hostile Vehicle Mitigation (HVM) and Vehicle Security Barriers (VSBs)

HVM uses a blend of traffic calming measures to potentially slow down hostile vehicles and vehicle security barriers to stop those hostile vehicles progressing further. There are a variety of HVM and VSB option to assist reduce or mitigate the threat from vehicles.

These include:

  • Total traffic exclusion from an area, using VSBs
  • Traffic exclusion using VSBs, but with screening of all vehicles entering the area (with suitable VACP, preferably two layers of active VSB to prevent vehicle tailgating)
  • Traffic inclusion/free flow within an area but with all critical / vulnerable assets within that area protected with VSBs
  • Temporary/supplementary barriers installed at times of heightened threat or when a secure event is present in the area

The range of Vehicle Security Barriers includes:

  • Bollards (active retractable and passive static)
  • Gates
  • Planters and strengthened street furniture such as seating

Landscaping options include:

  • Ditches, bunds and berms

The best form of HVM is total traffic exclusion from an area, which should be enforced by appropriately rated and correctly installed VSBs. A deployment of VSBs that restricts traffic (vehicles, pedestrians or both) requires an Anti-Terrorism Traffic Regulation Order (ATTRO) which is recommended to the traffic authority by the Chief Officer of Police.

Installing a static VSB system at a suitable standoff distance from a site will negate deception and duress styles of attack. It can also mitigate tampering and tailgating, which are forms of an encroachment attack.

If frequent vehicle access is required into a site, then active solutions should be considered. Manual barriers require subsequent resourcing in terms of staffing and automated barriers require both proactive maintenance and reactive callout procedures. These solutions are generally more expensive and less secure than a static security barrier system for the reasons outlined above.

If sites are occasionally accessed by vehicles, then it may be more cost effective to use plant-removable barrier systems (for example a socketed bollard) rather than installing fully automated active.

9.5 Temporary options

Temporary VSBs include:

Modular wall units and portal and gate units that can be interlinked to provide a surface mounted (gravity/free standing) or pinned solutions. Some systems can have pedestrian fences mounted on them to give dual purpose protection. Sites or police forces can rent VSBs on a temporary basis. To access these assets you should consult with your local (CTSA)](

Vehicle as a barrier

Following an appropriate risk assessment, you may consider the use of a vehicle as a barrier as possible mitigation against a vehicle as a weapon (VAW) attack. This should only be utilised following advice from a SecCo or CTSA. Such a deployment may impact upon the safety of the event e.g. emergency access, crowd flow rates, evacuation routes and the safety and security of the vehicle drivers must also be considered.

9.6 Contingency barrier schemes

Repeated renting of temporary barriers is expensive; sites should therefore consider a contingency barrier scheme. These are typically pre-installed gated VSBs in the relevant areas, which can be closed just prior to the event or pre-installed foundation sockets in to which passive or active VSBs are slotted. This avoids the loss of lane availability during the installation of temporary barriers on the days/nights prior to an event, which can bring benefits to the communities and transport authorities.

9.7 Standards and testing

The impact test standards for VSBs are IWA14–1 and PAS68, both of which include a range of test vehicles ranging from 1.5t cars, through 2.5t 4x4s, 3.5t vans, 7.2/7.5t trucks to 30t trucks. The results of the tests are classified in terms of how far the vehicle penetrated beyond the VSBs. This penetration distance is crucial, particularly when sites have limited standoff between the VSB and asset. Temporary barriers tend to displace more than permanently installed VSBs, as they do not have the benefit of a structural foundation.

Not all sites require protection from the largest or fastest vehicle-borne threats as the local topography or threat assessment may preclude them. Police CTSAs or skilled security consultants including the Register of Security Engineers and Specialists (RSES) with access to CPNI materials can assess the maximum impact speeds, by carrying out a vehicle dynamics assessment; these should be used to scope the most suitable VSBs, and/or quantify the residual risks.

The CPNI offer a range of HVM advice.

10. Suicide attacks

Suicide bombing is a very effective method of delivering an explosive device to a specific location. Suicide bombers may use a vehicle as a bomb or may carry or conceal explosives on themselves. The most likely targets are symbolic locations, key installations, VIPs or crowded places.

Explosions using homemade explosive devices have caused fatalities, injuries, and damage on a massive scale. The suicide bombers in the 2005 London attacks used precursor chemicals (in particular peroxide-based explosives) and killed 52 people and injured hundreds, many severely.

10.1 Planning

When planning protective measures for your site, you should consider:

  • placing your vehicle access control point at a distance from the site
  • briefing staff to look out for anyone behaving suspiciously or for suspicious-looking vehicles
  • ensuring that all visitors have their identities checked
  • installing a CCTV system

11. Chemical, biological and radioactive threats

There have only been a few examples of terrorists using CBR materials. The most notable were the 1995 sarin gas attack on the Tokyo subway and the 2001 anthrax letters in the United States. In 1996 in the US, an al-Qa’ida operative was sentenced for conspiracy to murder for his part in planning attacks using ‘dirty bombs’, which contained radioactive material.

The impact of a CBR attack would depend heavily on the success of the chosen method and the weather conditions at the time of the attack. The first indicators of a CBR attack may be the sudden appearance of powders, liquids or strange smells within the building, with or without an immediate effect on people.

Remember to apply personnel security standards to contractors, especially those with frequent access to your site.

12. Insider threat

Occasionally threats to companies and organisations come from within. Whether it is from a disaffected member of staff or an employee that has misrepresented themselves, there is more opportunity to disrupt or cause damage (whether physical or reputational) from the inside.

The risks posed by the insider threat can be lessened by carrying out thorough pre-employment checks and by having a strong security culture. The CPNI provides detailed guidance on personnel security.

13. Introduction Personnel Security Training

Following a risk assessment you can evaluate if it is necessary to employ a guard force as part of your security plan. It is important that security staff understand their roles and responsibilities and are properly tasked, trained and participate in rehearsal exercises. It is desirable that individuals working in the security industry undergo a structured training program that results in a recognised qualification, in some sectors training is a mandatory requirement.

Supervision of staff is fundamental in order to be effective and deliver your intended outcomes. Capability, capacity, competence and reliability of staff are particularly important in relation to counter-terrorism. Within this guidance we have identified some of the skills staff require to remain alert, communicate effectively, patrol effectively, respond to suspicious items, bomb threats, hostile reconnaissance and firearms and weapons attacks for example. A strong security culture within your organisation, beginning at Senior Management level, will assist your staff to not only disrupt terrorist attack planning but also prepare them should an incident occur.

It is vital that security staff patrol regimes for sites and events are also outwardly facing, look beyond the perimeter before the event, during and post event. The security patrol regime will complement the deterrence communication messaging and search planning. Supervisors are key to ensure levels of vigilance are maintained throughout the life cycle of any event. See CPNI Professionalising security.

13.1 Key principles of training, developing and maintaining an effective workforce

The majority of personnel will not retain all the information provided to them, with many retaining as little as a 5% of the information within the immediate 24 hour period. Therefore it is important that training and briefings are regular, clear and appropriate to reinforce key messages and instructions. Skills and knowledge in relation to security can then be developed and maintained (this need is supported by academic research on information retention). For this purpose a blended style of training is shown to be more effective. Begin with a training needs analysis followed by individual training, collective training and rehearsal exercises. Collective training will make the whole greater than the sum of the parts. Competent people and effective teams are the bedrock of a reliable incident response and adapting flexibly to the unexpected.

As an organisation you should have identified the people or department responsible for the development of your security plan. All staff not just those responsible for security should have a clear understanding how the elements of security will better protect your business.

13.2 Training a workforce to deliver protective security

You should consider the following elements to deliver an effectively trained workforce in relation to security:

  • Training should be based upon the current policy and standards
  • Assess your training requirements
  • Appropriately tailored security training is provided to all staff as part of the organisation wide security responsibility and culture
  • Ensure you provide leadership, management, mentoring and communication training for supervisors to facilitate on going staff development
  • Staff turnover should be taken into account in detailed training plans, to ensure that new staff are trained and existing staff receive appropriate refresher training
  • Prepare a training plan for the following 12 months, building in a time line for refresher training
  • Training activity should be flexibly delivered in various formats such as formal classroom, online off shift on staffs personal IT, online during shift with support, face to face debriefs post incident or through the organisations intranet
  • Ensure staff are trained before you put them through rehearsal and validation exercises
  • Include counter terrorism awareness training on the induction programme, for larger organisations, this may involve the local Counter Terrorism Security Advisor or Counter Terrorism Awareness Advisor
  • Provide briefings to all personnel on organisational security updates
  • Training should be provided on a continuous basis to prepare staff
  • Ensure security awareness is included on your staff induction day. Set your intention out from the commencement of employment and create a strong security culture and positive reporting culture in the organisation

Depending upon their responsibilities an effective security guard must be able to demonstrate they can respond effectively to a number of scenarios including:

  • initial actions at a terrorist incident, see ETHANE
  • ensure you maintain your search and patrol regime for the lifecycle of the event including prior to the commencement, during and post event
  • the different terrorist threat levels, building response levels and different activities required should there be an increase in threat
  • hostile reconnaissance, how to patrol effectively to disrupt activity, identify and respond to suspicious behaviour
  • suspect items, the ‘four Cs’ protocols and the HOT principles
  • chemical, biological and radiological incidents, how to recognise and respond using STEPS 123
  • a firearms and weapons attacks and the Run, Hide, Tell principles
  • evacuation, invacuation and lockdown procedure demonstrating knowledge of the emergency assembly points
  • how to search a site effectively
  • the basic principles of good housekeeping and how it reduces the opportunities for an attack
  • how to respond appropriately to a bomb threat
  • how and when to report incidents either to the internal security team, calling police using 999, 101 or call the Anti-Terrorist Hotline 0800 789 321. Staff should understand the reason why they use either 999 or Anti-Terrorist Hotline
  • using emergency equipment such as defibrillators etc. as trained
  • use of incident logs and checklists that facilitate an effective response to incidents such as terrorist incidents, bomb threats etc.

(Integrating the CPNI staff vigilance campaign supplies organisations with materials to facilitate internal policies and procedures)

13.3 Supervisors training and role in quality assurance and development of the workforce

Security supervisors are key enablers to ensure you have a motivated effective guard force that perform to the required standards and achieve the security aims and objectives of the organisation. Effective leadership by individuals during recent terrorist attacks has saved lives. The following factors should be considered when training your security supervisors.

13.4 Supervisors training

  • Allocate time to allow supervisors to actively supervise and engage with their staff.

By providing sufficient time to supervisors they will develop a knowledge of their team and their individual and collective capability

  • Provide supervisors with the right information and materials to continually develop and reinforce learned behaviours, knowledge and skills of their allocated staff

On-going reinforcement of competencies is required for all staff to achieve and maintain standards.

  • The organisation should provide leadership, management, mentoring and communication training for supervisors

Leadership and management training will facilitate the development of a diverse workforce and may improve retention rates and absentee levels

  • Have a training programme for supervisors to regularly attend counter terrorism awareness training such as ACT Awareness and Project Argus

By providing the on-going up skilling and current counter terrorism information to supervisors, they will be able to support the skills and knowledge of their staff

  • Ensure supervisors have access to useful information from the NaCTSO, CPNI and MI5 websites

Supervisors can share the latest information and guidance with their staff as part of briefing activity to keep them up to date

  • Security supervisor should quality assure and develop the guard force

Supervisors are well placed to understand the skill set of their staff and identify opportunities for development

13.5 Supervisors role to quality assure and develop the workforce

  • Ensure staff outline their roles and responsibilities from a counter terrorism safety and security perspective

Clear definition of roles will support the right person to take the lead role when dealing with incidents and facilitate the delivery of the incident management plan. Where staff have attended rehearsal exercises their understanding of their role and responsibility and confidence to respond increases

  • Ensure staff regularly use training materials, including online to improve their knowledge and understanding

By using these materials during the induction process, staff will have a better understanding of the organisations security plan and receive practical guidance how to respond effectively to security issues

  • Supervisors should have a full understanding and record of the qualifications their staff have obtained and should review the competencies

By reviewing these competencies achieved in the qualifications staff knowledge is reinforced and retained

  • Ensure your staff regularly receive of counter terrorism awareness training such as ACT Awareness

We know personnel require a regular reminder of principles in order that they will become confident and competent in the identification, challenge and reporting of suspicious behaviour

  • Following appropriate training ensure rehearsal exercises prepare staff for the identification and response to incident such as suspicious behaviour, suspicious items (IEDs, mail, chemical biological radioactive material) etc.

Integrating the CPNI staff vigilance campaign supplies organisations with materials to facilitate staff training

  • Ensure training and rehearsal exercises are regular

Regularly training and rehearsal exercises you will prepare staff in identifying and responding to critical incidents such as a terrorist attack, communicate and respond more effectively. Staff gain confidence to become effective during an attack and remain vigilant for a longer periods of time

  • Provide first aid training to your staff

By providing first aid training, staff will be responsive to the use of emergency equipment e.g. defibrillators, and will be first responders to any injured personnel

  • Train and rehearse you staff in your emergency plan with personnel which supports an evacuation, invacuation and lockdown procedure

By creating and sharing the emergency plan staff should identify all assembly points and procedures in the event of an evacuation, understand where the protected spaces are located during an invacuation, be familiar with their site to marshal and support an evacuation, invacuation and understand how to lockdown a facility or event

  • Are staff trusted to use their judgement based upon the information they have?

It is essential that staff understand their roles and responsibilities. Supervisors who are part of the design of the security plan will be best placed to respond during the threat. Regular training and rehearsal exercising activity will support the decision making process for all staff.

  • Ensure the organisations’ security plan, policies and changes in procedures are shared by supervisors

Supervisors can mentor and coach staff to reinforce positive behaviours within the context of the organisation security plan.

14. Cyber threat

In the 21st century, one of the greatest threats to a company or organisation is from cyber attacks. The effects can often be devastating: the loss of crucial data, or a reduction in operating efficiency, or even closure.

Your senior management must assess the risk appetite of the company or organisation. But it is vital that everyone in your workplace understands the risks posed by cyber attacks.

A cyber attacker may not reveal themselves or even the nature of the attack. An attack may have no obvious adverse effects, but will extract information or data from your networks.

Read the advice on Cyber essentials, visit the CPNI website or The National Cyber Security Centre website.

15. Guidance for drivers and businesses operating commercial vehicles, public service vehicles, heavy goods vehicles and vehicle hire companies

Significant numbers of public service vehicles (PSV) and heavy goods vehicles (HGV) are stolen every year. A third are stolen for their loads and a third are stolen from the owner’s premises. The primary reason is crime, however there is a crossover with terrorism where vehicles can be used as a weapon or funds from criminal activity can be used to finance terrorism.

Most instances of crime are opportunist, however even simple precautions can make a difference. It’s important that a senior manager in a company has responsibility for security.

Companies hiring vehicles must also be responsible for ensuring they maintain the highest standards for verifying the identities of any business or drivers using their vehicles. Always examine the driving licence and ensure the photograph matches the driver, the licence is valid and in date. Two forms of identification are preferable. Take a copy or details of the licence (i.e. driver number) where possible.

Report all suspicious behaviour to the police

The following advice is recommended to help detect, deter or deny those considering using a vehicle for criminal or terrorist purposes.

15.1 Assess your risk

It’s important that you, your colleagues, and your employees understand the threat and recognise situations where you are vulnerable both in the UK and travelling abroad. Drivers are potentially vulnerable when parked off the road. There are many creative ways and means to target drivers, passengers, vehicles and their loads. The objective may be to steal the vehicle or its load; cause specific loss to a business or its reputation; or to use the vehicle as a weapon.

15.2 Recruitment

  • Always check a driver’s references and previous five to ten year employment history
  • Always speak to previous employers (Do not rely on phone numbers given by the driver)
  • Inform applicants that false details on application forms may lead to dismissal
  • Check driving licenses are valid and look for endorsements before you employ someone, and then at six-monthly intervals afterwards. Drivers should tell you of any changes to their license
  • Check if the applicant has any prosecutions pending or is waiting for sentencing by a court
  • For agency drivers, ensure that the agency has carried out all of these checks including criminal records checks
  • Use only reputable agencies that are affiliated with a recognised UK trade organisation

15.3 Company policy and procedures

Build security duties and responsibilities into your company’s contract of employment. Contracts should make clear that drivers will face disciplinary proceedings if they fail to carry out these duties.

Your company should:

  • Include your company’s security instructions in the driver’s induction and driver’s handbook
  • Use photo identification cards for your company’s driver’s
  • Keep copies of all drivers document for your personnel records
  • Conduct due diligence checks on the identity of anyone hiring a vehicles, for HGVs and PSVs always insist on an operator’s license where appropriate
  • Adopt a low tolerance approach to overdue rentals and hiring, report these to police at the earliest opportunity
  • Ensure drivers communicate delays in arrivals to their destinations within agreed timeframes
  • When drivers and staff leave ensure that they no longer have access to IT, keys, and information, change lock passcodes at regular intervals
  • Have you a social media policy that outlines what staff, drivers and passengers can place on social media platforms

Consider using the Road Haulage Association’s Security Audit Service.

15.4 Social Media

Posting information can put your personal safety at risk. If you provide too much information and do not have the appropriate privacy settings applied, your business or social network accounts can be a veritable ‘gold mine’ for those intent on building up a picture of your travel plans, business and other subjects that they may seek to exploit in the future.

Internet-based social networking sites such as Facebook, Twitter, LinkedIn and lnstagram are popular applications that allow individuals to create a profile containing personal information and interact with other users. Review your privacy settings otherwise some or all of your on-line social media profiles can be seen by a large audience.

Drivers and passengers should consider if it is appropriate to provide ‘live time’ information about their activity that would allow them to be targeted. If required, it is always better to post information after the activity has taken place.

Location-based information can be posted on social networks, especially from GPS-enabled mobile devices, which tells others exactly where you are or have been. This information is not secure and could be viewed by anyone, including those who may want to harm you or your family, friends and colleagues. The responsibility rests with you to ensure that no-one is put at risk due to what is disclosed.

15.5 Drivers should always:

  • Lock and secure their vehicle whenever they leave the cab and, keep the keys with them (including when unloading and loading)
  • If possible always refuel on site before beginning a journey
  • Plan routes before beginning a journey
  • Avoid taking the same routes or stops for breaks. These routines make vehicles an easier target for those with criminal intent or conducting hostile reconnaissance
  • Comply with procedures to authorise changes to a delivery destination
  • Never pick up unauthorised passengers/hitch hikers
  • Report any irregularity in loading, locking, sealing or documentation
  • Check their vehicle is correctly loaded
  • Protect documents such as shipping orders and consignment notes. These can be used by criminals to steal valuable loads
  • Avoid talking about loads or routes with other drivers or customers (including over radios and telephones)
  • Report suspicious behaviour. In an emergency call the police on 999. For a non-emergency call 101

If you suspect it, report it to the Anti-terrorist Hotline on 0800 789 321

15.6 Secure Working Practices

Security culture must be part of everyone’s daily working practice. Businesses should restrict knowledge of loads and routes to those who need to know. The pre-loading of vehicles, should be kept to a minimum. When pre-loading is necessary, always keep the vehicle on secure premises. If the driver keeps the keys to their vehicle when they are not at work, advise them to:

  • Keep them secure at all times
  • Never leave them where they can be copied
  • Ensure that the keys do not obviously identify the vehicle

If vehicle keys are kept at the operating centre:

  • Identify keys control and security measures for vehicles and premises
  • Keep them in a secure and locked location, out of sight and reach of strangers
  • Never use a hiding place such as a wheel arch or a peg system that identifies the vehicle

Be alert to any visual changes to your vehicle. If you notice a suspicious object on or near the vehicle, do not approach or enter the vehicle. Contact the police and give them the location and registration number of your vehicle.

15.7 Overnight Parking

Make sure you know where your drivers are parking overnight. Instruct drivers to use pre-planned overnight parking facilities, particularly those that are members of the police Safer Parking Scheme.

15.8 Driver Contact

Keep in regular contact with drivers to identify/confirm routes, stops and estimated times of arrival.

15.9 Protest at premises or towards drivers

It is possible that a company’s business association with an organisation could lead to individuals gathering and protesting at your premises or premises to which you make deliveries. Protesters may assemble close to the boundary of the work place or target staff and vehicles.

If this happens:

  • Stay calm, individuals may intimidate, but this will not necessarily lead to a physical threat
  • Remain in your vehicle or in the property. Close and lock doors and windows and draw the curtains blinds to premises and vehicles as appropriate
  • Inform the police immediately calling 999 and await their arrival
  • Inform your workplace/colleagues
  • Do not, in any way, respond to, or antagonize, those protesting. Avoid confrontation
  • If someone attempts to confront you, stay in your vehicle. Keep the engine running and if you need to (and it is safe to do so), reverse to get away
  • If possible, note descriptions of individuals and vehicles present
  • If you have a CCTV system fitted that has recorded images, you should hand footage over to the police; it may assist with identification or evidence, where offences are committed
  • Postpone any expected visitors to your site
  • Know exactly where the perimeter of your site is should there be a demonstration

If you think you are being followed in your vehicle:

  • Try to stay calm
  • Keep the vehicle moving, even if only slowly
  • Close all windows and ensure the cab is secure
  • Contact the police immediately calling 999
  • If you can, make your way towards the nearest open police station
  • Record the registration number of any suspicious vehicle

15.10 Vulnerable/Dangerous loads

Operators should alert drivers to vulnerable loads or high-consequence dangerous goods and issue them with a vulnerable load/high-consequence dangerous goods card for these loads.

  • If a vehicle is stopped by uniformed officers in a marked police vehicle or Driver and Vehicle Standards Agency (DVSA) officers, drivers should display the card and follow the instructions on the reverse of the card to verify the identity of officers from the police and DVSA
  • During security alerts, operators and drivers should follow the advice given to them by their local police force. (Keep up to date using news media, the MI5 website and relevant associations)

15.11 Secure Vehicles

Remember vehicles can be stolen, whatever their load might be, to be used for criminal, including terrorist purposes.

  • Use and maintain security equipment as it will make your vehicles less attractive to thieves. Discuss options with your insurers, including goods in transit insurers, vehicle dealers and security equipment manufacturers
  • Each vehicle will need different levels and types of security equipment, depending on its use
  • Install vehicle immobilisation, if not already fitted by the manufacturer
  • Consider the use of telematics equipment which can remotely trigger an alert if a vehicle deviates from its intended route

Your local police crime prevention officer and insurer will give you specific security advice. See Sold Secure for advice on tested security products and approved installers.

15.12 Premises Security

A third of stolen trucks are taken from the owners’ premises, which is why premises security is vital. Consider the following areas when planning your security:

  • Perimeter protection (fences)
  • Site access and its control (gates)
  • Surveillance (lighting and effective CCTV)
  • Guards
  • Intruder detection
  • Visitor control
  • Limiting the number of key holders
  • Vehicle key storage
  • Controlled access to loading bays and control systems
  • Personnel and vehicle search procedures
  • Always make sure that any tools or equipment that may help criminals to steal trucks or loads are securely locked away when not in use

15.13 Roof Markings

The National Police Chief Council (NPCC) has approved the wider use of roof markings on HGVs, to help police air support units to identify vehicles if they are stolen. HGVs, particularly those that regularly carry vulnerable or dangerous loads, should use roof markings.

15.14 International Hauliers

When travelling abroad all hauliers, drivers and operate must have effective systems to protect their vehicle. Following a simple vehicle security checklist and securing your vehicle reduces delays and possible penalties. Simple steps can make a difference.

You should always:

  • Get a checklist and vehicle security instructions from your employer
  • If possible, watch the vehicle being loaded to ensure that no one enters who should not
  • Secure your load with a tilt cord and use strong padlocks or seals for load doors and panniers. (They can be glued or pinned together to show they have not been tampered with)
  • Check the wind deflector and axles
  • Check the fabric, roof and security devices of the vehicle for damage If there is evidence of damage or tampering check the load and load space and re-apply security devices. Record the checks made on the checklist, at loading, after every stop and before arriving at the border

Be vigilant and speak to a UK Border Agency officer or the police if you suspect that someone has entered or tampered with your vehicle.

15.15 Prevention of Illegal immigration

People attempting to gain illegal entry to the UK will look for HGVs etc. which they believe are heading for the UK. An effective way to deter people is to park facing away from the port, on the other side of the road. This gives the appearance the vehicle is travelling away from the UK and will therefore be less appealing.

To reduce the risk of delay and a possible penalty from the UK Border Agency, make sure that you read and follow the guidance contained in these UK Border Agency documents:

16. Further information and advice