Module: Terror Threat Awareness

Terrorism is the use or threat of action, both in and outside of the UK, designed to influence any international government organization or to intimidate the public. It must also be for the purpose of advancing a political, religious, racial, or ideological cause.

Terrorism threat levels

The official source of UK Threat Levels is MI5, and their website is https://www.mi5.gov.uk/threat-levels.

As well as knowing what each level means, an operative would ideally need to know how it may impact the response level their location may have.

• Low: An attack is highly unlikely.
• Moderate: An attack is possible, but not likely.
• Substantial: An attack is likely.
• Severe: An attack is highly likely.
• Critical: An attack is highly likely in the near future.

Security operatives need to understand how the current terrorist threat level will affect them at their own place of work. This should be outlined in their assignment instructions.

Attack planning phases

Terrorist attacks typically follow a series of planning phases:

• Preliminary target selection
• Initial surveillance
• Final target selection
• Pre-attack surveillance
• Planning
• Rehearsal
• Execution
• Escape and exploitation

Current terrorist attack methodologies

Terrorists employ various methodologies to carry out attacks. Understanding these can help in identifying potential threats.

Marauding terror attack (MTA)

This type of attack could use firearms, knives, sharp objects, or blunt objects while on foot to attack people in an area.

Types of explosive devices commonly used in attacks

• IED: Improvised Explosive Device
• PBIED: Person-Borne Improvised Explosive Device
• VBIED: Vehicle-Borne Improvised Explosive Device
• LBIED: Leave Behind Improvised Explosive Device

Vehicle attacks (VAAW)

More often, vehicles can be used as a weapon. This can be known as VAAW. Vehicles are used to target crowds and ram into people to cause severe damage.

Chemical attacks

Chemical warfare was widely used in World War One, which resulted in many deaths, including those of civilians, as there was little way to control where the chemicals travelled once they were deployed. After the war, most countries agreed not to use chemical or biological weapons in future conflicts. However, terrorists can manufacture weapons using many products available over the shelf and use these against the wider population.

Biological attacks

Bioterrorism is the use of biological agents to cause illness or death in humans, plants, or animals. They can be made using viruses, fungi, toxins, or bacteria. These could be naturally occurring or man-made or man-manipulated. They can be spread through water supplies, through the air, through food, or through contaminated surfaces.

Radiological attacks

Commonly known as a "dirty bomb," these types of devices are designed to spread radioactive material across a wide area with the intent to do harm. Radioactive materials are used in many different industries, including in medicine and research laboratories, but can also be acquired by those who intend to do harm.

Nuclear attacks

Since the atomic bombs were dropped on Nagasaki and Hiroshima in 1945, no other country has used a nuclear weapon in an act of warfare. In order to produce a nuclear weapon, a significant amount of weapons-grade plutonium needs to be acquired. It is plausible that a terrorist cell or individual could purchase a ready-made nuclear weapon from a third party.

Acid attacks

Although not commonly used by terrorists, acid attacks can be used against individuals or groups of people. Sulphuric acid is very strong and and can cause major injuries and permanent damage to victims.

Cyberterrorism

This refers to unlawful attacks and threats of attacks against computers, networks, and the information stored therein when done to intimidate or coerce a government or its people in furtherance of political or social objectives. For example, hacking into computer systems, introducing viruses to vulnerable networks, website defacing, denial-of-service attacks, or terroristic threats made via electronic communication.

Insider threats

An insider threat is a person who exploits, or has the intention to exploit, their legitimate access to an organization's assets for unauthorized purposes.

This includes insider knowledge of:

• Access and egress procedures
• Access to sensitive information
• Access to computer systems and networks, etc.
• Evacuation and assembly points

Actions to take in the event of a terrorist attack

Vigilant security personnel who are confident in recognizing and reporting suspicious behaviour may not only provide early warning of an attack but may even deter an attack that is still in the early planning stages.

If an attack is underway, security operatives must act quickly to limit the risks to all concerned. This would include early reporting and also following the government's guidelines of RUN, HIDE, TELL:

• Run: Move yourself and guide others as swiftly and as safely as possible away from the danger.
• Hide: Once secured, make sure that all members of the public, as well as the team, remain out of sight of the attackers.
• Tell: Call 999 or your control room as soon as possible and give as much information as is possible to the police operator. This should include things like:
• The number of attackers involved
• The last known location of the attackers
• What weapons they appear to be carrying/nature of the attack
• Known number of casualties
• Your location and situation

Company and venue policies regarding terrorist attacks

As members of front-line security, it is vital that security operatives are well-versed and understand the policies and plans in place in the event of an attack. People will look to the security team to help and lead them during these events. Knowing these procedures will be vital in both the security operative's as well as other staff members' and customers' overall safety.

Evacuation procedures may be different from fire evacuation procedures. Use your local knowledge of the area to help make dynamic decisions based on the information available to keep yourself, your colleagues, and customers safe.

The pros and cons of invacuation vs. evacuation

• Invacuation: Moving customers inside a building for safety reasons.
• Evacuation: Removing customers from a building.

When evacuating personnel out of a building for a fire, this can lead them to safety; however, it can also lead to people rushing, falling, and suffering from injuries as a result.

When invacuating personnel into a building, that can lead them out of immediate danger; however, the risk here is that people are then crowded together and could be an easy target for an attacker.

Reporting terrorist incidents to the police (999)

On contacting the police, the following information should be passed across:

• What you have seen
• What has happened
• Who you saw
• What they looked like (ethnicity, gender, height, build, clothing, etc.)
• Where the situation happened
• Where you are
• When did it happen

Security staff should be aware of the expected emergency services response times.

For non-emergency activity

The telephone number to report suspicious activity to is the Anti-terrorism hotline: 0800 789 321. This phone line is available 24/7 and is manned by specialist officers who take all reports seriously.

Public sector counter terrorist experts

• Centre for the Protection of National Infrastructure (CPNI): Are leaders in security, providing resources, guidance, and expert advice to help protect and keep businesses secure from external threats.
• The National Counter Terrorism Security Office (NaCTSO): Is a police unit that supports the 'protect and prepare' strands of the government's counter-terrorism strategy. They work directly with the Home Office.

Current initiatives

• ACT (Action Counters Terrorism): Is a government and police initiative that encourages the public to report anything that they believe to be suspicious to the police. There is a business app available as well as a free online course that all security personnel should complete.
• See Check and Notify (SCaN): Is designed to help businesses and organizations maximize their safety using their existing resources. This includes training staff to look for things such as criminal activity, unlawful protest, and terrorism.

Procedures when dealing with suspicious items

Remember the HOT Principles:

• H – Hidden: Does the item appear to be hidden?
• O – Obviously suspicious: Does the item have visible wires or other signs that look like it could be an explosive device?
• T – Typical: Is the object typical of the workplace or does it look out of place?

Remember the 4 C's:

• Confirm: Confirm that the package or bag doesn't belong to anyone nearby.
• Clear: Get people away from the area.
• Communicate: Calmly communicate with customers and staff or police.
• Control safety distance: Make sure to set a cordon a safe distance away.

Distancing vs. object size

• Suspected device in a rucksack or bag: No closer than 100m.
• Suspected device in a small vehicle: No closer than 200m.
• Suspected device in a large vehicle: No closer than 400m.

In order to better visualize the distances, remember that 100 meters is roughly equivalent to the length of a football pitch.

Important: Do not use radios or mobile phones within 15 meters of the suspected device.

Signs of suspicious behaviour

Any observed behaviour that could indicate signs of terrorism or terror-related crime.

Hostile reconnaissance is the observing of people, places, vehicles, and locations with the intention of gathering information to plan a hostile act.

This could include any of the following:

• Loitering
• Individuals taking an interest in the security of the site
• Making unusual requests for information
• Testing the security team’s response by breaching restricted areas
• Tampering with utilities
• Individuals trying to avoid security staff
• Individuals carrying out activities inconsistent with the nature of the building or environment
• Forged documents or IDs
• Inappropriately dressed for the season
• Taking photographs or drawing diagrams of the site
• Parked vehicles or unattended vehicles left for long periods of time
• Multiple sightings of the same person, vehicle, or activity over a period of time

Actions that can deter or disrupt hostile reconnaissance

• Ensuring visible presence of vigilant security personnel
• Frequent patrols that are done at irregular intervals
• Maintaining good search procedures
• Good access and egress procedures
• Secure emergency exits when not in use to prevent unauthorized entry

How to respond to suspicious behaviour

• Use customer service skills to disrupt potential hostile reconnaissance (example: approaching a person taking photographs of the site and asking them if they are okay or need any assistance with anything).
• Using positive and professional behaviour to act as a deterrent.
• Having visible security, including CCTV cameras, as well as security operatives on site.

Report all suspicious activity

• Follow your internal procedures.
• Contact the Anti-terrorism hotline (0800 789 321).
• British Transport Police (BTP) 0800 40 50 40 or text 61016.
• Non-Emergency 101.
• Active Counters Terrorism (ACT) Online report form.

In a life-threatening emergency, always dial 999.