The director of security at a manufacturing plant finds a suspicious package lying in the middle of a break area. The management office at a large shopping mall receives a phone call that a bomb has been planted somewhere in the five-acre facility. A hotel employee discovers a note taped to a guest room door indicating that there's a bomb inside.
Is the device a fake? The call a hoax? Or is it a terrorist plot? Reliable statistics specific to bomb threats are hard to come by. Anecdotal evidence suggests that any given threat is most likely benign, but with hundreds or even thousands of lives at stake, organizations can't afford to take chances.
And while empty threats don't harm victims, the mere utterance damages perceptions of management's ability to provide for a safe workplace.
"Most bomb threats are hoaxes," says Roy Bordes, president and CEO of security consulting firm The Bordes Group in Orlando, Fla. The culprits often turn out to be disgruntled employees, unsatisfied customers, a jilted boyfriend or girlfriend, pranksters or students looking to skip school.
What's more, serious bombers today rarely call in threats before detonating a device. While the Irish Republican Army often warned its targets about pending attacks, "that's not consistent with the current wrath of terrorists," says Jon Lusher, principal consultant at IPC International, a security firm specializing in shopping center public safety, based in Bannockburn, Ill. "They seem to be more interested in doing the damage than in warning of it. Often, they don't even take credit for it. But because nobody knows the true intentions of a bomb threat or a suspicious device, we have to take every threat seriously," he says.
Security experts offer their tips for receiving, detecting, legitimizing and acting upon a bomb threat before the police and bomb squad arrive.
1. Have a comprehensive bomb threat response plan in place.
Every building, plant and facility should have a checklist of questions and observations in place for receiving a bomb threat and contacting authorities, a plan for searching the building, a designated route to evacuate workers and guests and a procedure for searching evacuation routes and the holding area.
These procedures should be practiced through simulated drills twice each year "just so everyone knows how to react," Bordes says.
2. Educate call takers and provide a checklist.
With automated directories at the front line of most companies' phone systems and direct-dial access to anyone in the facility, a bomb threat could land on just about anyone's desk. All employees should have a bomb threat checklist on hand.
Based on recommendations from the Federal Bureau of Investigation and the Bureau of Alcohol, Tobacco and Firearms, the checklist should include the time the call was received; the actual words used by the caller; and any specific information given--such as the location of the bomb, the time it is set to explode, a description of the device or the reason for the threat. On the checklist, callers are also asked to describe the voice of the caller by approximate age and gender, as well as any background noise they may have heard, such as street noises, machinery, a motor or a public address system.
"We also encourage the [call taker] to engage with them further, by saying, 'Can you repeat that?'" says William Daly, national practice leader for security consulting at Control Risks Group, based in London. "Be sure they capture as much information as they can" and write down any phone numbers that may come up on caller ID.
While a paper checklist may be most practical, some companies offer instant access to the checklist by pressing a Function key on any employee's PC. The key also immediately alerts the security staff to the incoming threat.
Once the employee takes the call, he should immediately contact the director of security or the head of the facility, Daly says. In a plant facility, call the plant manager's office. "Make the decision quickly," he adds.
3. Determine the credibility of a threat.
Look at the specificity of the threat, the type of premises being threatened and the history of bomb threats within your industry, geographic area and staff.
Director of Security Bonnie Michelman has handled several bomb threats during her 15 years at Massachusetts General Hospital, and all have turned out to be benign. She says the caller checklist can be critical in determining the credibility of a threat.
"Sometimes it's pretty easy to [ascertain the validity of the threat] by asking the caller, 'Where is the bomb located?' If they give an area that your institution doesn't even have, or a floor that's above what you have, it's pretty clear" that it's a hoax, she says. Likewise, "if somebody gives you a very specific location" and seems to know the facility, "that's more credible and makes it a lot easier to do an initial search."
It's also important to keep a history of disgruntled employees, customers or patients to help determine who might be calling. If the caller offers a reason for the threat, such as a lost job or anger at a business practice, "we would be more concerned at that point and have a more focused investigation," Daly says.
Another rule of thumb for Daly: If there are no current labor issues, disgruntled employees or activist groups targeting the organization, the threats are treated "jaundicedly," but security personnel still discreetly walk through the facility to look for anything out of place.
If the caller claims to have left an explosive devise on the premises, consider how accessible the facility is. Is the building open to everyone or can only employees enter with proper ID? Are visitors screened? "That may give the company a better comfort level as to whether to take a general threat seriously," Daly adds.
An open facility, such as a shopping mall, hotel or hospital, offers a much greater challenge. If the threat is specific as to time and location, the call should be taken seriously and evacuation should be considered, especially if there is no time to search for a device.
4. Decide whether to evacuate.
Based on the information gathered from steps 2 and 3, the facility manager, on advice from the CSO and law enforcement, should make the decision whether to evacuate.
"Managers are fairly hesitant to call for evacuations, and I think that's appropriate because the vast majority of these calls are hoaxes," Lusher says. Formerly a security director at Pimlico Race Course in Maryland, Lusher recalls that on Preakness race day "we almost always got bomb threats. With 90,000 people there, it would be hard to evacuate them. It probably would cause a lot more damage by evacuating than not."
Especially in retail areas where the general public is involved, the decision to evacuate is a difficult one. "The security director has to be pretty active in convincing the general manager [to evacuate]," Lusher says. "There's a huge amount of second guessing and economic loss if evacuating or temporarily shutting down a shopping center. There's a sense that we had better be right to do this."
Local law enforcement will rarely make the decision to evacuate a private building unless they have specific knowledge about a plan or device.
5. Provide calm, direct assistance during the evacuation.
Once the decision has been made to evacuate an area or building, make an announcement through the company's public-address system. "Don't give too much information," Daly cautions, and don't panic people by using the word bomb. Let them know security personnel are investigating an incident and ask everyone to exit the building quickly.
Occupants may also need convincing that the evacuation is for real. The National Research Council of Canada reports that in an emergency, most people will not exit a building when they first hear a fire alarm, for instance. They will instead wait for more cues, such as smoke, before leaving. "If there is going to be an evacuation, not only do we announce it on a PA, but we have security officers and officials make sure they get that information directly to the people in the mall" and send them to the exits, Lusher says.
Studies also show that in a fire, the majority of people will go to the exit from which they came into a facility and ignore closer exits. Officials should also direct evacuees to those unused exits.
Once outside, let law enforcement and bomb squads determine whether the threat is legitimate.
Join the CIO New Zealand group on LinkedIn. The group is open to CIOs, IT Directors, COOs, CTOs and senior IT managers.