Print out the threat report form (Annex A);
Put it in a prominent place near to publicly advertised phone lines;
Talk about it with staff who may receive a threat call; and
Use the Marauding Active Shooter Guidance (Annex B) and HOT Protocol (Annex C) to brief your staff.
Threats may be received by light rail staff, station staff or anyone connected to light rail operations. Most threats are made anonymously by telephone, (although they may be written, emailed or posted on social media). They may be received directly from the people issuing the threat or via the police or through intermediaries (e.g. the media, press agencies etc.) Recipients should try to obtain as much information as possible about the threat in order to help the police to assess it and identify the person issuing it.
Threats are usually hoaxes. Hoax telephone calls or written messages are intended to cause a nuisance, however they must be taken seriously and assessed properly, as a small number have been genuine and have preceded a terrorist or criminal act. In the first instance, we suggest you contact your police force on how to handle any threats received. Any event assessed as a deliberate hoax (physical or otherwise - see paragraph 3.6 on unattended and suspicious items) is a crime and requires investigation by police.
We recommend that any recipient of a call or message completes the Threat Report form at Annex A (which is based on the standard police threat report form) and passes it without delay to their supervisor. The supervisor should inform the police. Recipients of a written threat should keep the message and pass it to their supervisor with precise information about its discovery. Staff who are likely to receive a threat (such as customer services and sales staff), should be briefed on the possibility and what to do on taking up their duties. Supervisors should be similarly aware of what to do and of the need to relay information about any received threat to the police. These briefings should be repeated on a regular basis to maintain staff knowledge and awareness. (See Section 2 – Organisational security culture).
The BTP has developed a guidance note for the rail industry (based on advice prepared by NaCTSO) detailing what to do if there is a marauding terrorist firearms attack or active shooter incident affecting the network. This could be by a co-ordinated group of terrorists as in Mumbai, India (2008), Westgate Shopping Centre, Kenya (2013) or by a lone gunman (Norway 2011). This is not, however, a rail specific issue as it concerns any public crowded place.
The parts of the guidance most relevant are offered at Annex B for you to use if you wish, as best suits the needs and circumstances of your operation. For example, you could make it available to your staff in its entirety, or use it as a basis for staff briefings.
Response to unattended and suspicious items
Lost property is an inevitable consequence of mass transit travel. In contrast to most of the unattended items encountered daily, a small number may cause a concern because of their physical appearance, their placement, or other circumstances associated with their discovery. A suspicious item, therefore, is one that exhibits unusual characteristics (appearance or placement) and for which a legitimate purpose cannot readily be established.
Staff should have established procedures to follow for dealing with items assessed and confirmed as suspicious. The HOT protocol, developed by the BTP and described at Annex C (also see searches and checks, Chapter 4) is one example of how to assess unattended items in a safe and efficient manner. Some examples of what staff should be briefed to look out for would include unusual packages, bags or other items in odd places, or carefully placed (rather than dropped) 'heavy' items in rubbish bins. Please refer to Annex C for full details of dealing with suspicious items using HOT.
As well as hoax telephone calls or written messages, operators may also discover a hoax item. A hoax item is any object constructed or placed deliberately in such a way as to cause concern and anxiety on the part of the finder (see Annex H for a full definition). Producing a hoax device is a serious offence (and may only become apparent after police or bomb disposal action at the scene of an item declared suspicious). However, any item believed to have been placed maliciously should always be reported to police. As noted in relation to anonymous threat message scenarios and overreaction to lost property, when such incidents cause disruption and attract media coverage, they can also generate imitative behaviour (i.e. copy-cat activity).
Once an item is assessed and confirmed as suspicious, people must be moved away from the scene, out of line of sight, and police advice sought urgently. If an immediate threat to life is perceived, evacuation distances are likely to be measured in hundreds of meters.
Response to suspicious behaviour
Suspicious behaviour can be defined as any behaviour that would be perceived by a reasonably prudent individual as of a kind that ought to be investigated by a person with security responsibilities. It is important that your staff know what to do and who to report their concerns to should they notice someone behaving suspiciously or have concerns about any suspicious items. Report suspicious behaviour to supervisors and the police.
Staff should be briefed to look out for any actions which may possibly indicate potential hostile reconnaissance/activity by criminals or terrorists. This might for instance include people showing unusual interest in sensitive, important or less accessible areas and specific interest in security regimes/features.
CPNI have produced a short film entitled 'Personnel Security: Eyes Wide Open'. The film explains how to spot people acting in a suspicious manner and how to deal with the situation. To access this, and for more information on hostile reconnaissance please contact CPNI or visit www.cpni.gov.uk .