Do You Have a Plan for Managing Bomb Threats?

BY BRIAN BENNETT

Your dispatch center receives a phone call reporting that a bomb has been planted at the local school. A custodian finds a message scrawled on a restroom mirror stating a bomb has been planted in the shopping center. A note is found on a subway car threatening an impending explosion. Are these scenarios hoaxes or the real thing? Can we afford to take chances and not be prepared?

Almost every department will respond to a bomb threat at one time or another. Although we have learned through experience that a great majority of the bomb threats turn out to be hoaxes, we must have a response plan for these calls to ensure our personnel’s safety and that of the general public. In today’s world, we must maintain situational awareness and always analyze each specific situation thoroughly to determine the proper response.

WHAT IS THE THREAT?

The perpetrator of a bomb threat can be anyone: a child looking to disrupt routine activities at a school, a disgruntled employee, domestic terrorist groups such as violent factions of animal rights or right-to-life activists, or international terrorist organizations such as al Qaeda.

According to Department of Homeland Security (DHS) statistics, more than 70 percent of all terrorist attacks involve the use of explosives. Yet, the number of unfounded bomb threats is significantly higher than the number of actual explosive detonations.

WHY A BOMB THREAT?

Why would someone report a bomb threat? Basically, there are five reasons:

1 Disruption of normal activity. The most common reason a bomb threat is reported is to disrupt normal activity. There are many motives for wanting to disrupt normal activity—for example, students may not want to take an examination, an employee may want to add more time to a long weekend, or a person may want to disrupt a competitor’s manufacturing production. Although many bomb threats originate with children, you cannot automatically discount them.

2 Economic loss. A disgruntled employee, a business competitor, or someone with a grudge against a business owner may report a bomb threat to cause a loss of business.

3 Knowledge of the device. In some cases, the individual who planted the explosive device may provide warning so as to limit the number of casualties. This tactic is often used when the intent is to send a message or simply to cause property damage. In some cases, an accomplice, a family member, an acquaintance, or another individual may become aware of an impending attack and does not agree with the perpetrator’s use of an explosive device and will report the information to the authorities in hopes of preventing the attack or at least minimizing casualties and property damage.

4 Start rumors. A perpetrator may want to start rumors that an organization cannot adequately secure a facility or ensure the safety of its occupants. This tactic can lead to a host of problems, including decreased business, lost productivity, and the inability to attract employees or customers.

5 Instill fear. This goal is directly related to the definition of terrorism. Terrorism is the use of violence to foster change, get people to change their daily routine, and instill fear in a population. The September 11, 2001, World Trade Center attacks are one example of how to effectively instill fear in a population. The general public was fearful of traveling in airplanes because they were worried about additional hijackings and the subsequent use of the aircraft as a weapon of mass destruction. When the U.S. airlines started flying again on September 13, air travel had decreased by approximately 20 percent. This situation was attributed directly to fear instilled by the terrorists.

A bomb threat may not be a hoax or lead to an immediate detonation. It could have a more sinister purpose. An adversary may use the bomb threat as a surveillance and planning tool to execute an attack at a later time. For example, an adversary could report a bomb threat to determine the target’s response to the threat. The bomb threat could be used as a means to assess the response of the first responders—the response routes, locations of staging areas for apparatus and personnel, the location of the incident command post, and the actions responders take on arrival at the scene. Additionally, the threat could be used to determine evacuation routes and assembly points of the target site’s occupants. Perhaps the security at the target site is substantial and an adversary would not be able to penetrate the security measures installed to execute an attack. By calling in a bomb threat that results in evacuating the target area, an adversary may now have easier access to large numbers of people grouped together in an unsecured public area where they could be targeted much more easily.

RESPONSE TO A THREAT

Use a commonsense approach when responding to a bomb threat. Assess each threat individually. Base your decision on how to respond on the information that is available and its validity. Regardless of how unlikely or how preposterous the bomb threat may seem, do not totally ignore or dismiss it until you have completed a comprehensive threat assessment and hazard and risk assessment that take into consideration and evaluate all of the information the caller provided.

Fire department units typically respond to a bomb threat in one of two ways. The first type of response, used for low-credibility, low-threat reports, typically has only a command officer respond to the scene in a nonemergency response mode. The command officer then becomes part of the unified command system, participating in the decision-making process by providing relevant fire service information. The second type of response, used for a more credible threat or for targets that present a high life safety risk, would have fire apparatus dispatched and respond in a nonemergency response mode to a staging area a safe distance from the target. In both response modes, position all fire department apparatus and personnel a safe distance from the target area (Figure 1).

Figure 1. ATF Recommended Evacuation Distances

null

RECEIPT OF THE BOMB THREAT

A bomb threat can be reported in any number of ways: verbal, written, e-mail, fax, audio/videotape, pager, or in person. The most common method used to report bomb threats in the United States is verbally, usually a telephone call to an emergency services call taker or directly to the targeted facility. In the case of a bomb threat received by telephone, the recipient of the call should ask questions and obtain details that may be helpful. For example, the caller may state the bomb was placed on the fifth floor; however, the building does not have a fifth floor.

Bomb threats may be nonspecific or specific. A nonspecific bomb threat provides little information other than a statement that there is a bomb at some location and perhaps the time it is scheduled to detonate. An example of a nonspecific bomb threat would be as follows: “I have planted a bomb at the Washington High School, and it will go off in 10 minutes.”

A specific bomb threat contains much more detailed information, such as the exact location of the device, the type of explosive used, a description of the device, and perhaps a motive for placing the device. An example of a specific bomb threat would be as follows: “I’m a student at Washington High School. My classmates have been picking on me for the past three years. Everyone hates me, and I have no friends. I hate them and have decided to get back at them. I made a pipe bomb at home last night, using black powder and nails. I took it to school in my backpack. I put the bomb in the cabinet in the back of Mrs. Smith’s classroom. The bomb will go off at the start of fourth period when all of those jerks are seated at their desks.”

HAZARD AND RISK ASSESSMENT

Everything we do in the fire service should be predicated on a hazard and risk assessment. Incident commanders (ICs) must thoroughly analyze the hazards posed to our personnel, the level of risk, and the benefit to be gained by getting involved. This process is no different for a bomb threat.

THREAT ASSESSMENT

The threat assessment is directly related to the target’s vulnerability, meaning whether an adversary could gain access to the target with a weapon. Is the facility an open facility, such as a shopping center, which allows free and easy access to the public, or a secure facility, such as a police station, which is generally restricted from public access? The threat assessment must consider all potential adversaries and their capabilities. As mentioned earlier, you cannot dismiss even a child as a potential adversary. The Internet provides hundreds and even thousands of ways to use commonly available materials to make powerful explosive devices. There have been numerous case studies over the years where children were able to manufacture and deploy highly effective and destructive explosive devices.

There are four major considerations in a threat assessment:

1. Identify the asset at risk.

2. Identify potential adversaries.

3. Assess the capabilities and risks the adversaries pose.

4. Manage the risks.

Once you have assessed these considerations, you must make an evaluation. First, debrief the person who received the bomb threat. Collect and analyze every piece of information reported. Jurisdictions should have a procedure detailing how to collect and document bomb threat information. Many jurisdictions have developed a form on which the recipient documents critical pieces of information. Most importantly, the person who receives the threat must know to whom it should be reported and must report it in the most expeditious manner possible.

Some threat indicators that may indicate potential authenticity include the following:

• The caller reports the threat in a very deliberate manner, sometimes repeating important information.
• The caller gives a reason for the threat.
• The caller claims responsibility for other bombings.
• The caller gives the exact location of the device and the time of the scheduled detonation.
• The caller knows details of the target, such as where people and equipment are located, access routes such as elevators and stairways, security measures in place, and so on.

DETERMINING THREAT CREDIBILITY

Once all of the relevant information has been collected and assessed, determine the credibility of the threat. Threat can be defined as an adversary with both the intent and capability to do harm. The threat credibility will dictate the response. If you determine the threat to be not credible, you will need to do little in terms of response and commitment of resources. Conversely, if you determine the threat to be credible, you will have to commit significant resources. The credibility of the threat is based on a number of factors, including the following:

• The reliability of the source reporting the threat.
• The level of corroboration of the threat.
• The imminence of the threat.
• The specificity of the threat.
• The vulnerabilities of the target.
• The adverse consequences of a successful attack.

Based on a thorough threat evaluation, the credibility of the threat can be classified into four categories:

• Not credible: The threat is unrealistic and poses no danger.
• Possible: The threat is reasonable.
• Likely: The threat discloses sufficient information to be of concern.
• Credible: The threat has a good chance of being successful and causing harm.

RESPONDING TO THE BOMB THREAT

If the threat evaluation indicates a response is warranted, the IC must develop an incident action plan (IAP). As part of the preemergency planning, determine when you will activate the IAP, whether on receipt of the threat or on discovery of a suspicious package in the target area.

The IAP should include the actions that you will take specific to the bomb threat. Five action options are available:

1 Do nothing. Use this option when you consider a threat “not credible.” The completion of the hazard and risk assessment and threat assessment processes indicated that no further action is required. This option also helps to avoid panic and confusion, as the occupants of the target are usually unaware that a threat has been received. It also helps prevent complacency. If multiple threats have been communicated to the target’s occupants, and a response was initiated (such as an evacuation), people will begin to assume all threats are false alarms. Another advantage is that if the perpetrator’s intent was to disrupt normal activity, he will be disappointed at the lack of disruption and might be unlikely to report future threats.

2 Search without protecting people. You can use this option when you classify a threat as “possible.” A team of trained employees or responders could surreptitiously search the target area for any suspicious packages without alerting the occupants located at the target. This action is not disruptive to normal activity and will also help to avoid complacency and additional threats.

3 Shelter in place. You can use this option for threats you classify as “likely.” The response called for in this action is to relocate selected occupants in a potential targeted area to a safe area. It is a much easier way of protecting people (as opposed to evacuation), in that it is not very personnel intensive, transportation is not required, and the occupants are not moved from a secure area to an unsecured area.

Typically, sheltering in place is used within a structure. For example, you have received a “likely” threat for a vehicle bomb parked in the street adjacent to a glass-faced high-rise building. Using the shelter-in-place method of protection, you move the occupants from the threatened area (those in close proximity to the glass windows) to the center of the building. The shelter-in-place area would preferably be without any windows or exterior doors. It is also recommended that the area not have any ventilation fans that intake or discharge to the outside environment (in case the explosive was used to disseminate a biological, chemical, or radiological agent).

4 Partial evacuation. Use this option for a “likely” or “credible” threat—evacuate by physically removing occupants from the targeted area. You may have to move large numbers of people very quickly; therefore, this is very resource-intensive. Consider the following questions before the evacuation:

• How do we inform everyone about the evacuation?
• To where do we move the evacuees?
• How do we get them there?
• How do we account for everyone?
• How do we address people with special needs?

Partial evacuation may help to avoid some of the problems identified above. Instead of evacuating all of the occupants in the target area, evacuate only the occupants in the high-risk area to a safe area. If you are evacuating, it is recommended that you do not tell the occupants the reason. This will help to eliminate panic.

When an evacuation has been called for, instruct occupants to take their belongings with them. This will expedite the search that will be conducted in that each bag and other items will not have to be checked and cleared. Stage the evacuees’ belongings (for later checking and clearance); do not have them brought to the evacuation area. This will prevent someone from inadvertently bringing an explosive device to the safe area. Instruct occupants to open windows and doors as they evacuate, to minimize the potential of blast damage from overpressurization if there is a detonation. Before starting the evacuation process, it is prudent to search the evacuation routes and safe areas for suspicious packages.

5 Full evacuation. Take this action when you must relocate all occupants in the target area to a remote, safe location because of the possibility of the high risk for injury to people or damage to structures.

SEARCHING FOR A BOMB

Who Will Perform the Search?

This is the first question to answer when a search is necessary for a suspicious package. The general rule is that personnel from the target should conduct the search with support from the emergency services, if necessary.

Although it may seem imprudent to have the occupants conduct the search, there are several benefits. Primarily, they are familiar with the asset and can search rapidly. They are also in the best position to know what belongs and what does not belong in a particular area. Also, concern for their own safety may cause them to search more thoroughly. Conversely, they most likely do not have a lot of training and may be less than enthusiastic in undertaking this task.

What Are You Looking For?

Explosives can be formed to look like almost any object or can be hidden inside common, everyday items. The size and shape of these weapons are limited solely by the inventiveness of the adversary and the resources available to make the devices. The most common explosive devices include the following:

• Letter bomb.
• Briefcase/backpack bomb.
• Pipe bomb.
• Vehicle bomb.
• Suicide (or more appropriately homicide) bomber.

The wild card in all of the types of explosive devices is the improvised explosive device (IED). An IED is a bomb that does not look like a bomb. For example, insurgents in Iraq have implanted explosives in animals. The terrorist group Al Aqsa has fabricated molded fiberglass wombs that women can fill with explosives and then strap onto their body.

Search Guidelines

Once the appropriate hazard and risk assessment and threat assessment have been completed, a search of the target area may be required to determine if a suspicious package is present. Before starting the search for a suspicious package, remind all participants of some basic safety rules:

• Do not touch a strange or suspicious object.
• Do not use portable radios or cellular phones.
• Search the most important areas first, then search public access areas, then search areas most related to the threat.
• Use trained/key personnel familiar with the area and its contents.

Search Techniques

Two-person teams have been found to provide the best results. To ensure a comprehensive search, use a methodical system (Figure 2). Search an area from the floor to waist area first. Conduct the second area search from the waist to the chin area. Cover the area from the chin to the ceiling in the third area search. In the fourth area search, cover hidden and enclosed areas such as closets and the area above a suspended ceiling.

Figure 2. How to Search for a Suspicious Package Source: U.S. Bureau of Alcohol, Tobacco, and Firearms, Bomb Threats and Physical Security Planning, April 1997.

null

Suspicious Object Located

If you discover a suspicious package, take the following safety precautions:

• Do not touch the object.
• Do not cover the object.
• Report the location and description of the device.
• Evacuate all personnel in the immediate area a minimum of 300 feet.
• Do not permit reentry into the area until it has been declared safe.

Secondary Devices

Secondary devices have a singular purpose—to injure and kill emergency responders. A secondary device is a second explosive device set off after the initial blast, once emergency responders have arrived in the area to treat victims and mitigate the emergency. Always be aware of the potential for a secondary device at incidents involving explosives.

THE COMMAND POST

Locate the command post (CP) in a safe area, remote from the incident. A good rule of thumb for explosive incidents is that the scene should not be visible from the CP. For a bombing incident, the use of a unified command is strongly recommended. Have the key personnel, authorized decision makers, from each stakeholder organization in the CP. Communication between the CP and field response units will be an issue, since wireless communication devices (e.g., radios and cellular phones) are not recommended when there is the possibility that an explosive device may be present. Therefore, use hard-line telephone communications or runners.

BOMB THREAT PLAN

A comprehensive bomb threat plan must cover all aspects of an incident, from the initial receipt of the threat through mitigation. It must cover all scenarios, from the suspicious package that was simply misplaced by its owner to a real device. An effective plan for dealing with bomb threats includes eight elements:

1 Designate responsibilities. Four critical positions must be filled for a bomb threat incident. The most important position is that of the IC. This person will have overall responsibility for evaluating the threat, planning search activities, ordering shelter in place or evacuation, coordinating response to suspicious objects, and determining the “all clear.” Relief ICs should be in place to provide relief coverage for long-duration events. Designate alternate ICs in case the primary IC is unavailable. The Operations Section chief is responsible for developing the tactics and supervising their implementation. The Planning Section chief will be occupied conducting the hazard and risk assessment and developing plans for sheltering in place or evacuation. The Intelligence element (a new addition to the General Staff courtesy of the National Incident Management System) will be responsible for the threat assessment. Depending on the scope and nature of the event, Intelligence may be managed at the command officer or section chief level or by establishing an Intel unit within the Planning Section. Using the concept of unified command, the IC may be law enforcement or the fire service. Operations may be the bomb squad, Planning may be the facility involved, and Intelligence may be law enforcement.

2 Determine procedures for handling threat calls. Develop a checklist to guide call takers in collecting information when a threat is received. Clearly state what they should do with the threat information they have collected: to whom they should give it and the actions for which the decision maker is responsible.

3 Determine procedures for evaluating threat calls. Coordinate with the appropriate law enforcement agencies to properly determine the validity of the threat.

4 Identify the CP. Consolidate all command and control functions in the CP as soon as possible. It would be particularly helpful if a portable ICS kit were available. It should contain all of the pertinent information that may be needed, such as emergency contacts, preemergency plans, and so on. Identify alternate CPs in the plan in case the situation warrants moving from the original predesignated location. Sweep the primary and alternate CPs for secondary devices before the command and general staff occupy them.

5 Develop a search and protection plan. There are three options when identifying who will search for a suspicious package. The first option is to use personnel from the target area to search. The second option is to use the facility’s emergency response team or internal security force. Typically, these groups have more training and are generally more effective than having employees conduct the search. The third option is to team law enforcement and/or fire department members with personnel from the target. This option provides the best of both worlds—a team that is highly trained and very familiar with the surroundings. Regardless of which option you chose, it is imperative to remember that the sole purpose of the search team is to provide a reconnaissance and report the findings. The search teams are not expected to, and should not, disturb a suspicious package. The search plan should include the exterior, public common areas, and all else.

You must also develop shelter-in-place and evacuation plans. They should be general in nature and outline how to implement the plan and who is responsible for completing its various elements. Key aspects of the plan include the following:

• Instructions for notifying people in the target area to shelter in place or evacuate.
• Details of how to transport people back and forth from the shelter-in-place or evacuation area and the target area.
• Securing an area for personnel’s belongings (briefcases, purses, etc.) that will have to be searched.
• Personal needs, such as sanitation and emergency medical services.
• Moving people with special needs.
• Preidentifying evacuation centers.

Develop specific plans for key assets likely to be the target of a bomb threat.

Arguably, the toughest decision for the IC will be what to do if the threat is considered viable but nothing suspicious has been detected. How does he ensure the target site is safe to allow people back into it?

6 Establish a response plan. Implement the response plan as soon as a suspicious item is found. The primary activity at this point would be to evacuate the immediate area and secure it from further entry. Convey specific information concerning the suspicious package to the bomb squad immediately. Also, have plans in place to continue the search in other sections of the target area, as there may be multiple devices.

In addition, there must be a contingency plan for addressing the actions to take if the device explodes—rescue, building collapse operations, triage and treatment, and firefighting. Consider whether the device has been used to spread a chemical, biological, radiological, or nuclear agent.

7 Test the plan. Conduct periodic exercises of the plan to test it. An annual exercise is highly recommended. As always, all stakeholders should participate in the exercise. The purpose of the exercise should be to identify the plan’s strengths and weaknesses. The overall goal is to improve the plan. Develop a formal exercise plan with an appropriate scenario. An improved plan should be the end result of the exercise.

8 Improve the plan. Thoroughly evaluate and implement the recommendations identified in the exercise. After you have revised the plan, begin the process again—test and further improve the plan.

•••

Although most of us respond to bomb threats on a frequent basis, we have not always developed appropriate plans and procedures. The most common reason for this is complacency. We have responded many times over the years, and they have all been false alarms. With the current status of world events, we cannot assume that this will always be the case. We have seen too many instances of children detonating devices in schools, disgruntled employees targeting their workplaces, domestic terrorists using explosives to further their causes, and international terrorists posing the threats of IEDs and suicide bombers. Now is the time to develop your plan.

BRIAN BENNETT, PhD, CFO, a 26-year veteran of the fire service, is chief of the Iselin (NJ) Volunteer Fire Company #1. He has three engineering degrees and is a NJ-certified instructor level 2, fire official, and fire officer I.

More Fire Engineerimg Issue Articles