13 Must-haves of a Bomb Threat Policy

            For many organizations, responding to bomb threats can pose some difficult problems. It is not something that happens every day, but at the same time is not uncommon.

In light of the devastation from the bombs at the Boston Marathon, it is a good time to review your organizations’ bomb threat response plans. There are some common misconceptions and a solid bomb threat policy and procedure will help employees respond safely. It is vital to have a plan that is in sync with local police and that staff or faculty is very familiar with the procedure and know how to react.

Additional Links

http://businesskarate.blogspot.com/2011/07/responding-to-bomb-threats-part-one.html

http://businesskarate.blogspot.com/2011/07/responding-to-bomb-threats-part-two.html

 

Policy checklist – does your policy include the following elements?

From WikiCommons

1. Bomb threat received and phone check list available

2. Notification to police and ‘incident’ commander (be sure that role is identified, by title rather than name)

3. Evaluate available information to decide whether to evacuate or not

·       How specific or detailed is the threat

·       How accurate was the information provided

·       Have there been similar incidents to other businesses or offices in the area

·       Are there other risks, such as a disgruntled employee or domestic violence situation involving an employee

4. Incident command makes decision on whether to evacuate or not (consider the possibility of an explosive device around the exterior, including vehicles in the parking lot)

5. If there is no evacuation, begin a search of the entire building by the staff most familiar with their areas – keep in mind that unless a suspicious device is found, law enforcement will not normally make the decision to evacuate!

6. Search all rooms, common areas and exterior

·       Search floor to waist height

·       Search waist to eye-level

·       Search eye level to ceiling

·       Search above floating ceilings if necessary

7. Do not use cell phones or radios to communicate as that could trigger an explosive device

8. Do not touch any suspicious packages or items found

From WikiCommons

9. Notify police immediately if something suspicious is found

10. If office is evacuated consider how long the search may last and impact on associates and operations

·       How will staff get personal belongings

·       Consider bringing personal items such as purses or briefcases to avoid leaving behind more ‘suspicious’ items

·       Are office doors locked during evacuation

11. Account for all employees

12. Once the building has been searched and law enforcement agrees, allow employees to return to the building

13. Communicate event details and outcome as needed and lessons learned

Of course a great policy or procedure is only as good as the training to back it up. Since it is somewhat rare, a response plan has to be reinforced with training and practice. Different drills focusing on different parts of the policy is a good way to train and then conduct a drill from start to finish in order to test the policy and the response.

Eric Smith, CPP is the leading authority on organizational self-defense. He has extensive experience in law enforcement as well as security management. Eric is available for staff education and security awareness training as well as business coaching to help organizations provide safe workplaces. To learn more email eric@businesskarate.com.

 

 

If you would like to reprint this post, please contact Eric at eric@businesskarate.com.

Responding to Bomb Threats - Part Two

               Hollywood loves the drama of explosions, bombs counting down to zero and the last minute defusing of a bomb about to blow.  But real life bomb threats are serious business and can affect your business (see Responding to Bomb Threats – Part One).

               From the first discovery of a suspicious device or the first threatening call, employees will be distracted and have to stop their normal work to search or evacuate.  The response to a bomb threat seems simple enough on the surface, but can quickly become complicated, especially if your organization is not prepared or has not practiced.

There are two most likely ways that you may start your bomb threat response.  The first and most common, is a phone call warning that a bomb is in the facility.  This could be someone with insider information or the suspect himself.  Or a test to see the response to the threat.

The second way is for someone actually finding a suspicious device.  This is what happened with the Time Square bombing attempt.  Two vendors noticed smoke coming from a suspicious vehicle and notified police, leading to the evacuation of the area and eventually to the arrest of Faisal Shahzad. 

Numerous resources online explain what someone should do when they receive a threatening call.  In short, try to get as many details as possible about the explosives and location(s). 

The real trick comes next.  Staff must be alerted to the threat (whether a call or a suspicious device) and the emergency operations plan should be started.  This could be as simple as the incident leader with enough support to coordinate and track searches of the facility.  Also, the leader will need to coordinate with police.  Responding officers will not tell a business to evacuate based on a threat, but they can help assess how credible or likely the threat is.  If similar calls in the area resulted in explosives being found, then that certainly changes the perspective and may prompt an evacuation on a threat alone.  The incident commander will have to weigh those risks and make the final decision on evacuation unless a device has been found.  Another concern is whether or not the building needs to be locked down.  If there is a pending threat, do you want more people coming into a building that may need to be evacuated? 

If there is no reason to evacuate yet, then staff members need to conduct searches of the areas with which they are most familiar.  Before the threat ever starts, employees should be trained on search procedures, both areas that they are responsible for and how to search.  Searches need to include all areas, including restrooms, closets and remote locations.  Searches should be conducted in pairs and done methodically, starting with a search around the floor to waist height of a room then waist to eye level and eye level to ceiling.  In some cases, searches should be done above false ceilings to make certain nothing has been hidden there. 

Be prepared for a lot of suspicious items to be found.  Once people start looking for something odd or out of place, they will certainly find it, if not an actual bomb.  Incident command should be called (landline – no cell phones) and investigate with either police or security.  This can make finding any actual device a little trickier, with the wild goose chases.

During this phase of the incident, two basic things can happen.  One is that a bomb is found.  The other is that one is not found.  If one is found, the organization will have to begin its evacuation plan.  This should be part of the business continuity plan, based on any hazard damaging the facility.  Whether the evacuation is due to a bomb, tornado or utility failure, the end result is the same: operations need to be moved and critical functions continue.

Assuming that nothing is found, the incident commander or leader still has one major task – clearing or terminating the threat.  At some point, the decision must be made that the threat was false and that the facility has been searched adequately to go back to normal.  That will be based in part on the information from the original call, law enforcement information and the search results.  The less specific the threat, a good search and no reported similar incidents combined will mean clearing the bomb threat sooner.  If it is more specific and credible, the process may take a little longer before feeling comfortable with a return to daily operations.

The proper response to bomb threats is well documented with many available resources.  One question is often left unasked.  How many would-be bombers actually call in a threat ahead of time?  In the case of the Times Square bomber, no call was made first and that is more consistent with a terrorist attack, domestic or foreign. 

So if there is no threat and no suspicious device found, then how can any organization protect itself?  The best defense in this case is a strong defense.  A good physical security program that limits access to unauthorized individuals works as a stopper to keep suspects out or at least the areas that they can reach to plant a bomb.  Terrorists usually reconnoiter a target first.  Video surveillance, security patrols, access control are some of the examples of steps that can deter or detect possible terrorist surveillance.  Staff awareness and training is perhaps the most critical element.  Alert employees may detect suspicious people in the area or be the first to notice something odd left behind.

               The key lesson is that the response to a bomb threat starts long before any incident.  Staff awareness and training is vital, as is having a response plan created ahead of time.  Being able to coordinate a search and work with local law enforcement will provide the information needed to make the right decisions.  And, of course, a continuity plan that keeps operations going during any type of crisis.

Eric Smith, CPP is the leading authority on organizational self-defense.  He spent more than a decade in law enforcement before moving into security management.  Eric has developed staff education and security awareness training programs.  As an avid writer and trainer, Eric has created a website and blog at http://www.businesskarate.com/.  The blog includes security tips and suggestions for business leaders and anyone interested in personal security.

Responding to Bomb Threats - Part One

               In the last few months, Colorado has seen several incidents involving bombs and threats at different businesses, including a hospital.  In April, Earl Moore taped two small propane canisters together and tried to ignite them with a small pipe bomb.  Fortunately, the device did not go off.  Moore is also suspected in calling in a bomb threat to a hospital in Longmont, Colorado.  The hospital locked down to keep visitors and others out while the facility was searched.

               This past weekend, another suspect, David Lawless, broke out a window at a Borders bookstore in Lakewood, Colorado and left at least two small explosive devices inside.  Police responded and the bomb team detonated the devices in the store, causing minimal damage.  Lawless had been previously arrested for setting off a homemade bomb outside a Denver strip club in 2005. 

               So far, the motives of these two suspects are unknown.  Perhaps they just liked the idea of setting off some type of explosion similar to a pyromaniac wanting to start a fire. 

               The reality is that any organization could receive a bomb threat or even a real explosive device at any time without warning.  It is not common, but it is also not unheard of.

               Many business managers or leaders have misconceptions about handling bomb threats or downplay the risk, thinking that they are not a target.  However, this mistake could be costly.  A business not prepared to deal with potential emergencies may not recover.  One study noted that 1/3 of businesses that faced an unexpected emergency causing them to shut down never opened back up.  Mishandling a bomb threat, especially a real one, could be devastating and result in avoidable injuries or fatalities to staff or customers. 

               The majority of bomb threats are false – about 98% according to some sources.  One might decide to ignore the threat.  However, that could be extremely risky if there is an actual bomb such as in the cases mentioned earlier.  Imagine how employees or customers would feel to find out that they were not warned about a possible threat.  The best option is to conduct a search whenever a threat is received. 

               Most companies will call the police upon receiving a threat and this is where one common misconception comes up.  Most people believe that once they call the police, the responding officer will tell them whether to evacuate or not.  In reality, most departments will not make that recommendation based on a threat alone, without some more credible or believable information that there is an actual bomb in the building.  The decision to evacuate or not has to be made by the leaders of the organization.  Automatically evacuating at every threat could be disruptive, especially if a disgruntled employee or even a competitor finds out that they could easily stop all work with a simple phone call threat. 

               The general rule of thumb is to evacuate if a suspicious device is found.  But before getting there, a search must be done and should be done with every threat.  Employees most familiar with an area should be the ones to conduct the searches.  They will most likely know what is out of place or what doesn’t belong.  “That’s Mary’s backpack.  She always leaves it there.” 

               Sounds pretty simple so far, right?  The trick comes after the threat comes in and a search is started.  Once people start looking for something “suspicious” they will find it.  How will the incident leader know what is really suspicious or dangerous?  Local police will respond and be able to help look at suspicious items to evaluate the risk.  Still it may be difficult to tell a real bomb apart from poorly wrapped package.  In the first case above, the bomb left in the shopping mall was two propane canisters taped together with a pipe leaking powder and several burned up matches lying nearby.  That should get anyone’s attention! 

               Once a potential bomb is discovered, law enforcement will almost certainly take charge of the scene and help coordinate an evacuation.  Bomb squads can help determine how large an area needs to be evacuated.  For most small bombs, like a pipe bomb, shrapnel is the greatest danger and can be harmful out to 100-300 feet.  However, inside a building, the walls, ceilings and floors may offer protection from shrapnel so the actual evacuation area may not have to be that large, but it is better to err on the safe side and evacuate more than necessary. 

               This is where evacuation plans and continuity plans become critical.  For some organizations, evacuation may not be that difficult.  For others, it is a major issue.  Think of the hospital that received the bomb threat in Longmont.  The suspect who called in the threat might have easily left a bomb anywhere in the building.  The evacuation could mean moving patients, including possible ICU patients, out of the area and maybe even out of the building, transporting them to another hospital.  The logistics and challenges are almost overwhelming. 

               Every organization should have a written plan requiring a search for all threats built on the understanding that it will be the employees doing the initial search in most cases.  Companies also need to develop a procedure to decide when to and how to evacuate and continue operations off-site. 

               Click here for more specifics and information on how to respond to bomb threats.