Suspect Letter Incident Management

Incident Management Guidelines

The mishandling of suspect mail can result in injury, death, and the loss of forensic evidence. Suspect letters may contain explosive or other hazardous substances intended to harm personnel or disrupt operations. Letters may be small, but can result in serious injuries if detonated. Letters are typically designed to detonate only when opened, as explosive mail travels through postal systems to reach an intended target. At all times, incident managers should consider the safety of the persons involved in the operation, the integrity of the evidence, the requirement not to touch the suspect letter, the need to quickly and safely clear the area, and the need to pass on information so that specialist responders can deal with the situation.

In the event that a suspect mail situation occurs, the following immediate steps should be taken:

Action Points

1. Stand up the Incident Management and Crisis Response Teams using the SAD CHALETS system.
2. Do not attempt to bend the item (letter bombs are normally stiff and difficult to bend). Greasy marks and unusual odors may indicate explosive substances.
3. Do not put the item in water or in any other liquid, nor tamper or interfere with the letter in any manner.
4. Examine the item with X‐ray equipment or metal detector, if possible.
5. Put the item in a dry place, away from glass and metal (to avoid injury from flying particles if there is an explosion).
6. If a garden or adjacent spare ground is available, place the letter inside a container with a lid (if possible, both made of wood or plastic).
7. If no garden or spare ground is available, place the contained letter in an uninhabited basement. If no garden, spare ground, or uninhabited basement is available, place the item in an isolated room, preferably without windows. If the room has windows, these should be opened.
8. Persons should be prevented from approaching within 75 feet of the suspect letter, no matter where it has been placed.
   The immediate area should be cordoned using the five Cs:
9. Clear:: Clear the area to ensure the safety of personnel; no one should be in line of sight of the package. The following elements should be considered:
   1. Radio transmissions only at a safe distance (e.g., handheld, vehicle fitted).
   2. Establish an Incident Control Point to notify external agencies of location and safe route in.
   3. Wedge open doors (allow clear access and exit for personnel).
   4. Evacuate personnel to safe locations; conduct musters to identify missing persons.
10. Cordon:: Cordon off the area until emergency services arrive to assume control:
    1. Establish correct cordon distances, approximately 75 feet.
    2. Ensure all personnel, including security, are out of line of sight of the package or material.
    3. Ensure that personnel are not at risk from secondary hazards.
    4. Ensure that personnel are behind hard cover if possible (concrete walls).
    5. Ensure that personnel are not observing the incident from behind windows (blast effects).
    6. Ensure that personnel are upwind if other such hazards are likely.
11. Control:: Control the situation until relieved or the emergency services arrive:
    1. Control the scene and area.
    2. Establish safe routes and control points.
    3. Ensure that all persons are not in line of sight of the materials.
    4. Ensure that the control room is aware of any action you take; be accurate with your information.
12. Check:: Check the area for other threats as well as evidence:
    1. Check for secondary hazards.
    2. Ensure that the location is protected for police investigations.
    3. Save evidence, if any, on the site.
    4. Secure the area.
    5. Consider other potential and present hazards.
13. Coordinate:: Commercial companies will rarely manage an explosive hazard in isolation from external government or military support. Therefore, effective coordination between company and external management and response teams is critical for the safe resolution of the situation.
14. Assess any damage to the site following an explosion. Also implement the casualty response procedures.
15. Forward all information through the correct communication channels, and update where necessary.
16. Provide an IMP Risk Assessment Report as soon as possible.

Demonstrations Incident Management

Incident Management Guidelines

Many groups will use public demonstrations to gain media exposure, as well as impede business activities. Demonstrations may be singular events lasting hours, or may be protracted, lasting days to months and evolving into site occupancy (e.g., tree sitting). Demonstrations are typically nonviolent and involve chanting, banners, and costumes. Demonstrations may also involve the symbolic burning of items, or the leaving of obstructive or unpleasant items such as tree stumps or manure. In the most extreme cases, demonstrations may lead to an escalation in violence and may turn into riots.

In the event of a demonstrations incident occurring, the following points should be addressed:

Action Points

1. Stand up the Incident Management and Crisis Response Teams using the SAD CHALETS system.
2. Establish the temperament of the demonstration: Is it violent, disruptive, intimidating, or peaceful?
3. Establish the agenda and objectives of the individuals or groups: Who are they, what do they want to accomplish, and how?
4. What risks are presented to personnel directly, or as a result of secondary hazards?
5. Lock down the facility or work site; alert personnel and move employees to safe areas or safe havens if necessary.
6. Raise the alert status and security posture of the facility to the predefined planning level and mobilize security staff, closing down access control points and securing buildings.
7. Mobilize security personnel to secure access points and high‐value areas; all area movements are to stop until response measures are completed.
8. Conduct security sweeps and searches to locate any acts of sabotage, as well as search for demonstrators.
9. Alert law enforcement agencies to manage demonstrators; indicate whether any unlawful acts have been conducted and the temperament of the demonstration.
10. Cordon off the affected area or resources in order to contain the demonstration where possible and appropriate.
11. Document and photograph the demonstration in case an investigation or legal action is required post event.
12. Provide an IMP Risk Assessment Report as soon as possible.