Sabotage Incident Management

Incident Management Guidelines

The sabotage of a facility or equipment can be through common vandalism damaging or making resources inoperable or faulty, or may be through focused and well‐planned activities by organized crime, insurgency, special interest groups, or terrorists. Sabotage may be dramatic in nature, resulting in catastrophic effects, or may be subtle and difficult to detect. Sabotage may place personnel at risk, may disrupt operations or may result in structural failure or other secondary risk effects.

In the event of a sabotage incident occurring, the following points should be addressed:

 Action Points

1. Stand up the Incident Management and Crisis Response Teams using the SAD CHALETS system.
2. Lock down the facility or work site, alert personnel, and move employees to safe areas or safe havens if necessary.
3. Mobilize security personnel to secure access points and high‐value areas; all area movements are to stop until response measures are completed.
4. Conduct security sweeps and searches to locate any additional acts of sabotage, as well as search for saboteurs.
5. Determine what has been sabotaged:
   • Machinery and equipment.
   • Materials and resources.
   • Structures and systems.
   • Technology and communications.
6. Are the saboteurs still on‐site? Can they be detained by security or police agencies?
7. Are the saboteurs violent? Are they armed? How will they respond if apprehended? What risks are associated with the individuals themselves?
8. Determine what risks are connected to the act:
   • Explosive
   • Failure
   • Disruptive
   • Toxic
   • Structural
   • Information
9. What risks are presented to personnel directly, or as a result of secondary hazard?
10. Raise the alert status and security posture of the facility to the predefined planning level, and mobilize security staff, closing down access control points and securing buildings.
11. Alert law enforcement agencies to investigate or prosecute groups or individuals.
12. Cordon the affected area or resources to enable an investigation to be conducted; do not contaminate the area in terms of forensics requirements.
13. Document and photograph sabotaged materials, assets, or structures.
14. Provide an IMP Risk Assessment Report as soon as possible.