NaCTSO Bomb Threat Guidance June 2016

Posted on Monday 1st August, 2016 by

NaCTSO (National Counter Terrorism Security Office has issued their latest Bomb Threat Guidance for 2016.

1. Bomb threats: Procedures for handling bomb threats.
The vast majority of bomb threats are hoaxes designed to cause alarm and disruption. As well as the rare instances of valid bomb threats, terrorists may also make hoax bomb threat calls to intimidate the public, businesses and communities, to draw attention to their cause and to mislead police. While many bomb threats involve a person-to-person phone call, an increasing number are sent electronically using email or social media applications. No matter how ridiculous or implausible the threat may seem, all such communications are a crime and should be reported to the police by dialling 999. It is important that potential recipients – either victims or third-parties used to pass the message – have plans that include how the information is recorded, acted upon and passed to police.

1.1 The bomb threat message.
Bomb threats containing accurate and precise information, and received well in advance of an actual attack, are rare occurrences. Precise motives for hoaxing are difficult to determine but may include revenge, extortion, a desire to impress, or a combination of these and other less understandable motives. The vast majority of cases are hoaxes and the intent is social engineering, to cause disruption, fear and/or inconvenience the victim.

1.2 Communication of the threat.
A bomb threat can be communicated in a number of different ways. The threat is likely to be made in person over the telephone; however, it may also be a recorded message, communicated in written form, delivered face-to-face or, increasingly, sent by email or social media (e.g. Twitter or Instagram, etc.). A threat may be communicated via a third-party, i.e. a person or organisation unrelated to the intended victim and identified only to pass the message.

1.3 Immediate steps if you receive a bomb threat communication.
Any member of staff with a direct telephone line, mobile phone, computer or tablet etc., could conceivably receive a bomb threat. Such staff should, therefore, understand the actions required of them as the potential first response to a threat message.

If you receive a telephone threat you should:-
• stay calm and listen carefully
• have immediate access to a checklist on key information that should be recorded (see bomb threat checklist – Bomb Threats Form 5474)
• if practical, keep the caller talking and alert a colleague to dial 999
• if displayed on your phone, note the number of the caller, otherwise, dial 1471 to obtain the number once the call has ended
• if the threat is a recorded message write down as much detail as possible
• If the threat is received via text message do not reply to, forward or delete the message. Note the number of the sender and follow police advice
• know who to contact in your organisation upon receipt of the threat, e.g. building security/senior manager. They will need to make an assessment of the threat

If the threat is delivered face-to-face:-
• try to remember as many distinguishing characteristics of the threat-maker as possible

If discovered in a written note, letter or as graffiti:-
• treat as police evidence and stop other people touching the item

If the threat is received via email or social media application:-
• do not reply to, forward or delete the message
• note the sender’s email address or username/user ID for social media applications
• preserve all web log files for your organisation to help the police investigation (as a guide, 7 days prior to the threat message and 48 hours after)

REMEMBER Dial 999 and follow police advice. Seek advice from the venue security/operations manager as soon as possible.

2. Assessing the credibility of bomb threats.
Evaluating the credibility of a threat is a critical task, particularly if the attack being threatened is imminent. This is a tactic used to place additional pressure on decision makers. Police will assess the threat at the earliest opportunity. When specific intelligence is known to police, advice will be issued accordingly; however, in the absence of detailed information, it will be necessary to consider a number of factors:-
• is the threat part of a series? If so, what has happened elsewhere or previously?
• can the location of the claimed bomb(s) be known with precision? If so, is a bomb visible at the location identified?
• considering the hoaxer’s desire to influence behaviour, is there any reason to believe their words?
• if the threat is imprecise, could an external evacuation inadvertently move people closer to the hazard?
• is a suspicious device visible?

3. Actions to consider.
Responsibility for the initial decision making remains with the management of the location being threatened. Do not delay your decision making process waiting for the arrival of police. Police will assess the credibility of the threat at the earliest opportunity. All bomb threats should be reported to the police and their subsequent advice followed accordingly. It is essential that appropriate plans exist, they should be event and location specific. Venue options to manage the risk include:-
3.1 External evacuation.
Leaving the venue will be appropriate when directed by police and/or it is reasonable to assume the threat is credible, and when evacuation will move people towards a safer location.

It is important to appoint people, familiar with evacuation points and assembly (rendezvous) points, to act as marshals and assist with this procedure. At least two assembly points should be identified in opposing directions, and at least 500 metres from the suspicious item, incident or location. Where possible the assembly point should not be a car park. You may wish to seek specialist advice, which can help to identify suitable assembly points and alternative options as part of your planning. It is essential that evacuation plans exist; they should be event and location specific. Evacuation procedures should also put adequate steps in place to ensure no one else enters the area once an evacuation has been initiated.

The police will establish cordons depending upon the size of an identified suspect device. Always follow police directions and avoid assembly close to a police cordon.

3.2 Internal or inwards evacuation (‘invacuation’).
There are occasions when it is safer to remain inside. Staying in your venue and moving people away from external windows/walls is relevant when it is known that a bomb is not within or immediately adjacent to your building.

If the suspect device is outside your venue, people may be exposed to greater danger if the evacuation route inadvertently takes them past the device. A safer alternative may be the use of internal protected spaces. This type of inwards evacuation needs significant pre-planning and may benefit from expert advice to help identify an internal safe area within your building. These locations should be in your plans.

If the location of the device threatened is unknown, evacuation represents a credible and justifiable course of action.

3.3 Decision not to evacuate or inwardly evacuate.
This will be reasonable and proportionate if, after an evaluation by the relevant manager(s), the threat is deemed implausible (e.g. a deliberate hoax). In such circumstances police may provide additional advice and guidance relating to other risk management options. It may be considered desirable to ask staff familiar with the venue to check their immediate surroundings to identify anything out of place, see search considerations below.

3.4 Checking your venue for suspicious items – Search Considerations.
Regular searches of your establishment, proportionate to the risks faced, will enhance a good security culture and reduce the risk of a suspicious item being placed or remaining unnoticed for long periods. Additionally, if you receive a bomb threat and depending upon how credible it is, you may decide to conduct a ‘search’ for suspicious items. To that end:-
• ensure plans are in place to carry out an effective search in response to a bomb threat
• identify who in your venue will coordinate and take responsibility for conducting searches
• initiate a search by messaging over a public address system (coded messages avoid unnecessary disruption and alarm), by text message, personal radio or by telephone cascade
• divide your venue into areas of a manageable size for 1 or 2 searchers. Ideally staff should follow a search plan and search in pairs to ensure nothing is missed
• ensure those conducting searches are familiar with their areas of responsibility. Those who regularly work in an area are best placed to spot unusual or suspicious items
• focus on areas that are open to the public; enclosed areas (e.g. cloakrooms, stairs, corridors, lifts etc.) evacuation routes and assembly points, car parks, other external areas such as goods or loading bays
• develop appropriate techniques for staff to be able to routinely search public areas without alarming any visitors or customers present
• under no circumstances should any suspicious item be touched or moved in any way. Immediately start evacuation and dial 999
• ensure all visitors know who to report a suspicious item to and have the confidence to report suspicious behaviour

Remember: it is vital that regular drills are carried out to ensure all are familiar with bomb threat procedures, routes and rendezvous points. Disabled staff should have personal evacuation plans and be individually briefed on their evacuation procedures. Similarly all visitors should be briefed on evacuation procedures and quickly identified and assisted in the event of a threat.

Familiarising through testing and exercising will increase the likelihood of an effective response to an evacuation and aid the decision making process when not to evacuate/invacuate.

4. Media and Communication.
Avoid revealing details about specific incidents to the media or through social media without prior consultation with police. Do not provide details of the threat, the decision making process relating to evacuation (internal or external) or why a decision not to evacuate was taken.
Releasing details of the circumstances may:-
• be an objective of the hoaxer and provide them with a perceived credibility
• cause unnecessary alarm to others
• be used by those planning to target other venues
• elicit copycat incidents
• adversely affect the subsequent or investigation

For further information visit or

Comments are closed.