Destruction of Sensitive Materials Incident Management

Incident Management Guidelines

Should an evacuation of a project location occur under circumstances where materials or data must be left behind, a destruction plan will be required to ensure that commercial and operational materials are made inaccessible to persons illegally occupying or searching the location after staff has departed.

In the event that sensitive materials must be destroyed, the following immediate steps should be taken:

Action Points

1. Stand up the Incident Management and Crisis Response Teams using the SAD CHALETS system.
2. Confirm which materials cannot be saved or transferred prior to evacuation.
3. Confirm that all destruction plan participants understand what materials must be destroyed, and allocate final destruction tasks.
4. Confirm that destruction or sanitizing technologies are available to enable the destruction plan (prepare in advance where necessary).
5. Confirm any centralized destruction areas.
6. Ensure that participating managers confirm when materials have been destroyed or sanitized; record using a destruction report (see Exhibit 5.3).
7. Retain records of all materials destroyed; send to the appropriate crisis response team.
8. Report all materials that could not be destroyed, including the content as well as any business or security implications.
9. Forward all information through the correct communication channels, and update where necessary.
10. Provide an IMP Risk Assessment Report as soon as possible.
    
    
    Key People to Call (see the IMP Communications Plan)

    Group	Yes/No	Group	Yes/No
    • Medical organization		• Organic QRF
    • Military interface		• Crisis response team
    • Embassy or consulate		• Security provider (vendor)
    • Police, fire, or ambulance		• Other groups

Destruction Report—Items Sanitized or Destroyed
Material Description	Copy Type	Unit	Location	Destruction Method	Responsible	Destroyed
• Commercial Data	Soft Copy	Computer 2	Office 3	Magnetic Wipe	IT Manager	√
• Commercial Data	Soft Copy	Computer 6	Office 12	Magnetic Wipe	IT Manager	√
• Local Employment Records	Hard Copy	File Cabinet 3	Office 12	Fire Bin	HR Manager	√
• Security Plans	Hard Copy	File Cabinet 6	Office 2	Fire Bin	Security Manager	√
• Intelligence Reports	Soft Copy	Computer 9	Office 2	Magnetic Wipe	Intelligence Manager	√
• Intelligence Reports	Soft Copy	Computer 11	Office 2	Magnetic Wipe	Intelligence Manager	√
Destruction Report—Items NOT Sanitized or Destroyed
Material Description	Copy Type	Unit	Location	Risk Implications and Recommendations
• Security Plan—Site Zulu	Hard Copy	File Cabinet	Office 4	Compromise existing security—increase security posture.
• Local Employment Records	Soft Copy	Computer 1	Office 12	Risk presented to local employees—report to police.
• Commercial Data	Soft Copy	Computer 21	Office 16	Commercial espionage—report to police.
• Intelligence Report	Hard Copy	Wall	Office 14	Operating policy risk—report to military.

Suspect Letter Incident Management

Incident Management Guidelines

The mishandling of suspect mail can result in injury, death, and the loss of forensic evidence. Suspect letters may contain explosive or other hazardous substances intended to harm personnel or disrupt operations. Letters may be small, but can result in serious injuries if detonated. Letters are typically designed to detonate only when opened, as explosive mail travels through postal systems to reach an intended target. At all times, incident managers should consider the safety of the persons involved in the operation, the integrity of the evidence, the requirement not to touch the suspect letter, the need to quickly and safely clear the area, and the need to pass on information so that specialist responders can deal with the situation.

In the event that a suspect mail situation occurs, the following immediate steps should be taken:

Action Points

1. Stand up the Incident Management and Crisis Response Teams using the SAD CHALETS system.
2. Do not attempt to bend the item (letter bombs are normally stiff and difficult to bend). Greasy marks and unusual odors may indicate explosive substances.
3. Do not put the item in water or in any other liquid, nor tamper or interfere with the letter in any manner.
4. Examine the item with X‐ray equipment or metal detector, if possible.
5. Put the item in a dry place, away from glass and metal (to avoid injury from flying particles if there is an explosion).
6. If a garden or adjacent spare ground is available, place the letter inside a container with a lid (if possible, both made of wood or plastic).
7. If no garden or spare ground is available, place the contained letter in an uninhabited basement. If no garden, spare ground, or uninhabited basement is available, place the item in an isolated room, preferably without windows. If the room has windows, these should be opened.
8. Persons should be prevented from approaching within 75 feet of the suspect letter, no matter where it has been placed.
   The immediate area should be cordoned using the five Cs:
9. Clear:: Clear the area to ensure the safety of personnel; no one should be in line of sight of the package. The following elements should be considered:
   1. Radio transmissions only at a safe distance (e.g., handheld, vehicle fitted).
   2. Establish an Incident Control Point to notify external agencies of location and safe route in.
   3. Wedge open doors (allow clear access and exit for personnel).
   4. Evacuate personnel to safe locations; conduct musters to identify missing persons.
10. Cordon:: Cordon off the area until emergency services arrive to assume control:
    1. Establish correct cordon distances, approximately 75 feet.
    2. Ensure all personnel, including security, are out of line of sight of the package or material.
    3. Ensure that personnel are not at risk from secondary hazards.
    4. Ensure that personnel are behind hard cover if possible (concrete walls).
    5. Ensure that personnel are not observing the incident from behind windows (blast effects).
    6. Ensure that personnel are upwind if other such hazards are likely.
11. Control:: Control the situation until relieved or the emergency services arrive:
    1. Control the scene and area.
    2. Establish safe routes and control points.
    3. Ensure that all persons are not in line of sight of the materials.
    4. Ensure that the control room is aware of any action you take; be accurate with your information.
12. Check:: Check the area for other threats as well as evidence:
    1. Check for secondary hazards.
    2. Ensure that the location is protected for police investigations.
    3. Save evidence, if any, on the site.
    4. Secure the area.
    5. Consider other potential and present hazards.
13. Coordinate:: Commercial companies will rarely manage an explosive hazard in isolation from external government or military support. Therefore, effective coordination between company and external management and response teams is critical for the safe resolution of the situation.
14. Assess any damage to the site following an explosion. Also implement the casualty response procedures.
15. Forward all information through the correct communication channels, and update where necessary.
16. Provide an IMP Risk Assessment Report as soon as possible.

Demonstrations Incident Management

Incident Management Guidelines

Many groups will use public demonstrations to gain media exposure, as well as impede business activities. Demonstrations may be singular events lasting hours, or may be protracted, lasting days to months and evolving into site occupancy (e.g., tree sitting). Demonstrations are typically nonviolent and involve chanting, banners, and costumes. Demonstrations may also involve the symbolic burning of items, or the leaving of obstructive or unpleasant items such as tree stumps or manure. In the most extreme cases, demonstrations may lead to an escalation in violence and may turn into riots.

In the event of a demonstrations incident occurring, the following points should be addressed:

Action Points

1. Stand up the Incident Management and Crisis Response Teams using the SAD CHALETS system.
2. Establish the temperament of the demonstration: Is it violent, disruptive, intimidating, or peaceful?
3. Establish the agenda and objectives of the individuals or groups: Who are they, what do they want to accomplish, and how?
4. What risks are presented to personnel directly, or as a result of secondary hazards?
5. Lock down the facility or work site; alert personnel and move employees to safe areas or safe havens if necessary.
6. Raise the alert status and security posture of the facility to the predefined planning level and mobilize security staff, closing down access control points and securing buildings.
7. Mobilize security personnel to secure access points and high‐value areas; all area movements are to stop until response measures are completed.
8. Conduct security sweeps and searches to locate any acts of sabotage, as well as search for demonstrators.
9. Alert law enforcement agencies to manage demonstrators; indicate whether any unlawful acts have been conducted and the temperament of the demonstration.
10. Cordon off the affected area or resources in order to contain the demonstration where possible and appropriate.
11. Document and photograph the demonstration in case an investigation or legal action is required post event.
12. Provide an IMP Risk Assessment Report as soon as possible.