1. Skyscraper Security Mgt.
Part IV- Bomb Threat Response
By, Richard Garrity

2. Skyscraper Security Mgt. Part IV
Life Safety Threats- Section II
Bomb Threat Procedures

3. Bomb Threat Response, Procedures, and
Suspicious Package Detection is part 4 of 5 in
the Life Safety- Emergency Management
training series.

4. This presentation is proprietary information and can’t be
copied or reproduced in any fashion without consent from
the publisher owner.

5. 5
Bomb Threats & Response
Bomb threats pose some unique
planning and response issues for
building owners, property
managers, security directors, and the
security personnel assigned to
protect high rise buildings. Carefully
thought out response plans to such
an incident is a priority.

6. 6
Bomb Threats & Response
Bombing and the threat of being bombed
are harsh realities in today's world. The
public is becoming more aware of those
incidents of violence that are perpetrated by
vicious, nefarious segments of our society
through the illegal use of explosives. Law
enforcement agencies are charged with
providing protection for life and
property, but law enforcement alone cannot
be held responsible. Every citizen must do
his or her part to ensure a safe
environment.

7. 7
Bomb Threats & Response
This presentation is designed to help both the
public and private sectors prepare for the
potential threat of explosives-related violence.
While the ideas set forth herein are applicable
in most cases, they are intended only as a
guide. The information provided is compiled
from a wide range of sources, including the
actual experiences of special agents of the
Bureau of Alcohol, Tobacco and Firearms

8. 8
Bomb Threats & Response
If there is one point that cannot be
overemphasized, it is the value of being
prepared. Do not allow a potential bomb
incident to catch you by surprise. By
developing a bomb incident plan and
considering possible bomb incidents in
your physical security plan, you can
reduce the potential for personal injury
and property damage.

9. 9
Could your building be a target?

10. 10
Disclosure: All types of bombing incidents are serious
and horrific as what occurred in Boston, April 2013.
However, this training segment will focus strictly on
bomb threat procedures in a building environment only.

11. 11
The Bomb itself…..
Bombs can be constructed to look
like almost anything and can be
placed or delivered in any number of
ways. The probability of finding a
bomb that looks like the stereotypical
bomb is almost nonexistent. The only
common denominator that exists
among bombs is that they are
designed or intended to explode.

12. 12
The Bomb itself…..
Most bombs are homemade and are
limited in their design only by the
imagination of, and resources available
to, the bomber. Remember, when
searching for a bomb, suspect
anything that looks unusual. Let the
trained bomb technician determine
what is or is not a bomb.

13. Bombs- both stereotypical
and the modern elaborate

14. Traditional symbolic bomb

15. Different types of
improvised bombs:

16. Standard watch
clock detonator

17. 17
Different types of improvised bombs:
Basic digital clock detonator

18. Remote bomb detonator

19. Bomb detonator wire leads

20. Bombs disguised as
a consumer product:

21. Cell phone Bombs, small
but easily concealed and
quite lethal

22. 22
Just what is in that
suspicious package?

23. 23
Pressure Cooker Bombs

24. 24

25. 25
Backpack type Bombs

26. Bomb Bag:
Bomb Bag:

27. Suitcase type bombs

28. 28
Package type bombs,
hand delivered or via mail

29. Package type bombs,
hand delivered or via mail

30. 30
Computer Printer Bomb:

31. 31
Bomb Threats & Response
First, evaluate the threat for credibility.
Ignoring a bomb threat or always evacuating
are two response strategies that can be
inherently problematic. The first has some
serious and obvious legal and liability
implications and the latter can quickly
become impractical. The best approach is to
carefully evaluate each threat using a team
approach and respond based on the merit and
circumstances of the incident.

32. 32
Bomb Threats & Response
While most occurrences of explosive
devices being found or detonated in high
rise buildings are not preceded by a
communicated threat, this should never
be the overriding determiner used in
making the final decision. In examining
any threat, the primary litmus test is in
determining the level of credibility based
on all known facts.

33. 33
Levels of threats:
Next, determine the level of threat.
A low level threat is generally nonspecific
with little or no indication of credibility.
A medium level threat includes more
specific details related to
motive, location, etc.
A high level threat would include a strong
indication that a device is on campus.

34. 34
Levels of threats:
A low level response should include
notification of staff with instructions to be
vigilant of unusual building activity or
suspicious individuals. Law enforcement
should be notified because any type of
bomb threat – regardless of degree of
credibility – is a criminal offense. While a
detailed search may not be
warranted, personnel should be alert for
any suspicious or unusual item.

35. 35
Levels of threats:
A medium level response would
include all of the aforementioned, as well
as a possible evacuation or relocation of
building employees or simply leaving
them in existing locations. It may involve
a general walk through of the building by
designated staff or, by necessity it may
include a room by room examination.
Some response by emergency service
providers would be expected.

36. 36
Levels of threats:
A high level response would usually
involve most of the previous mentioned
steps. However in this instance, a full
evacuation of the building would most
likely be warranted and not over
reactionary. Law enforcement would
potentially treat the building as a crime
scene. Preparations for a search of the
tower using special equipment or
resources may be necessary.

37. 37
Electronic communication:
While the chances of an electronic communication
instrument such as a cellular phone or two-way radio
detonating an explosive device is remote, it can
occur, so plan ahead related to communicating with
and between staff personnel during the event.
Security staff supervising and monitoring the
evacuation will have to be especially attentive to
building employees trying to use cellular devices and
should be prepared to seize phones if necessary.
Second, expect media attention on bomb
threats, especially with incidents where employees
are evacuated, relocated or if a suspicious item is
found.

38. 38
Bomb Threat Action Plan:
Instruct all facility personnel,
especially those at the telephone
switchboard, in what to do if a
bomb threat call is received. The
bomb threat caller is the best
source of information about the
bomb. When a bomb threat is
called in:

39. -Keep the caller on the line as
long as possible. Ask him/her to
repeat the message. Record
every word spoken by the
person (or persons).
- If the caller does not indicate
the location of the bomb or the
time of possible detonation, ask
him/her for this information.

40. -Inform the caller that the building
is occupied with workers and the
detonation of a bomb could result
in death or serious injury to many
innocent people.
- Pay particular attention to
background noises, such as
motors running, music playing, and
any other noise which may give a
clue as to the location of the caller.

41. - Listen closely to the voice
(male, female), voice quality
(calm, excited), accents, and
speech impediments.
Immediately after the caller
hangs up, report the threat to
building mgt. officials, i.e.
Security Manager, Security
Shift Supervisor, Property
Manager, etc.

42. - Report the information
immediately to the local
police department and fire
department. Notification to
the ATF, FBI, and other
appropriate state & federal
agencies should be made by
the local police department
who has primary jurisdiction.

43. Security personnel and
building mgt. officials
should not be notifying
any other state or
federal entities unless
instructed to by the
local police incident
commander.

44. When a written threat is
received, save all
materials, including any
envelope or container. Once
the message is recognized
as a bomb threat, further
unnecessary handling
should be avoided.

45. Every possible effort must
be made to retain evidence
such as
fingerprints, handwriting,
typewriting, paper, and
postal marks. These will
prove essential in tracing
the threat and identifying
the suspect writer.

46. Written Messages:
While written messages
are usually associated with
generalized threats and
extortion attempts, a
written warning of a specific
device may occasionally be
received. The warning
should never be ignored.

47. Decision Time:

48. Decision Time:
The most serious of all decisions to
be made by management in the event
of a bomb threat is whether to evacuate
the building. In many cases, this
decision may have already been made
during the development of the bomb
incident plan. Management may
pronounce a carte blanche policy
that, in the event of a bomb threat, total
evacuation will be effective
immediately.

49. This decision circumvents
the calculated risk and
demonstrates a deep concern
for the safety of personnel in
the building. However, such a
decision can result in costly
loss of time.
Decision Time:

50. Decision Time:
Essentially, there are three
alternatives when faced with
a bomb threat. They are:
1. Ignore the threat.
2. Evacuate immediately.
3. Search and evacuate if
warranted.

51. Decision Time:
Ignoring the threat completely can
result in some problems. While a
statistical argument can be made that
very few bomb threats are real, it cannot
be overlooked that bombs have been
located in connection with threats. If
employees learn that bomb threats have
been received and ignored, it could
result in morale problems and have a
long-term adverse effect on your
business.

52. Decision Time:
Also, there is the possibility
that if the bomb threat caller
feels that he or she is being
ignored, he or she may go
beyond the threat and actually
plant a bomb.

53. Decision Time:
Evacuating immediately on every
bomb threat is an alternative that
on face value appears to be the
preferred approach. However, the
negative factors inherent in this
approach must be considered. The
obvious result of immediate
evacuation is the disruptive effect
on the client’s business.

54. Decision Time:
If the bomb threat caller knows that your
policy is to evacuate each time a call is
made, he or she can continually call and
force the business to a standstill. So,
yes, theoretically if you were to
evacuate on every bomb threat, there is
no doubt that is the safest measure.
However, would you be willing to
evacuate once a month? Once a week?
Everyday? Just based on a phoned in
threat and nothing to substantiate it?

55. 55
Calling in the threat….

56. Decision Time:
Initiating a search after a threat is
received and evacuating a building
after a suspicious package or
device is found is the third, and
perhaps most desired, approach. It
is certainly not as disruptive as an
immediate evacuation and will
satisfy the requirement to do
something when a threat is
received.

57. Decision Time:
If a device is found, the
evacuation can be
accomplished expeditiously
while at the same time
avoiding the potential danger
areas of the bomb. Bomb
threat “reaction” can be hit or
miss, and you never want to
miss during this type of crisis.

58. Evacuation Team:
A building evacuation unit
consisting of mgt. personnel
should be organized and trained.
The Team should comprise of
security personnel, building Mgt.
officials, building engineering, and
select tenant contacts who may
have roles as fire wardens, floor
wardens, and tenant facility
representatives.

59. Evacuation Team:
The organization and
training of this unit should
be coordinated with the
development of the internal
facility bomb incident
plan, as well as with all
tenant reps of the building.

60. Evacuation Team:
The evacuation unit should be trained
in how to evacuate the building during a
bomb threat. You should consider
priority of evacuation, e.g., evacuation
by floor level. Evacuate the floor levels
above and below the danger area in
order to remove those persons from
danger as quickly as possible. In depth
training in this type of evacuation is
usually available from the local police
dept., regional bomb squad unit, or the
local FBI field office.

61. Evacuation Team:
Volunteer building personnel should be
solicited for the function of searching
individual tenant floors. Assignment of
search wardens, team leaders, etc., can
be employed. To be proficient in
searching the building, search
personnel must be thoroughly familiar
with all hallways, rest rooms, false
ceiling areas, and every location on the
floor where an explosive or incendiary
device may be concealed.

62. When police officers or firefighters
arrive at the building, the contents
and the floor plan will be unfamiliar
to them if they have not previously
reconnoitered (inspect, observe, or
survey) the facility. Thus, it is
extremely important that the
evacuation or search unit be
thoroughly trained and familiar with
the floor plan of the building and
immediate outside areas.

63. When a room or particular
area is searched, it should
be marked or sealed with a
piece of yellow tape or other
clear marking and report to
the supervisor of that area
that it is clear.
Evacuation Team:

64. Evacuation Team:
The evacuation or search unit
should be trained only in
evacuation and search techniques
and not in the techniques of
neutralizing, removing or otherwise
having contact with the device.
If a device is located, it should not
be disturbed. However, its location
should be well marked and a
route back to the device noted.

65. Search Teams:
It is advisable to use more than one
individual to search any area or
room, no matter how small. Searches
can be conducted by supervisory
personnel, area occupants or trained
explosive search teams. There are
advantages and disadvantages to each
method of staffing the search teams.
Using supervisory personnel to search
is a rapid approach and causes little
disturbance.

66. Search Teams:
Using area occupants to search their
own areas is the best method for a rapid
search. The occupants' concern for their
own safety will contribute toward a more
thorough search. Furthermore, the
personnel conducting the search are
familiar with what does or does not
belong in a particular area. Using
occupants to search will result in a
shorter loss of work time than if all
were evacuated prior to search by
trained teams.

67. Search Teams:
The search conducted by a
trained team is the best for
safety, morale and
thoroughness, though it does
take the most time. Using a
trained team will result in a
significant loss of production
time. It is a slow operation that
requires comprehensive
training and practice.

68. Search Teams:
The decision as to who should
conduct searches or evacuate the
facility lies with building
management solely. Short of
anybody actually finding a device
or police authorities having
credible evidence that a bomb
device is in the building, property
mgt. makes the sole decision on
evacuations.

69. Search Technique:
The following room search technique is
based on the use of a two person
searching team. There are many minor
variations possible in searching a room.
The following contains only the basic
techniques. When the two person search
team enters the room to be
searched, they should first move to
various parts of the room and stand
quietly with their eyes closed and listen
for a clockwork device.

70. Search Technique:
Frequently, a clockwork
mechanism can be quickly
detected without use of special
equipment. Even if no
clockwork mechanism is
detected, the team is now
aware of the background noise
level within the room itself.

71. Search Technique:
Background noise or transferred
sound is always disturbing during a
building search. If a ticking sound is
heard but cannot be located, one
might become unnerved. The ticking
sound may come from an unbalanced
air conditioner fan several floors away
or from a dripping sink down the hall.
Sound will transfer through air
conditioning ducts, along water
pipes, and through walls.

72. Search Technique:
The individual in charge of the
room searching team should look
around the room and determine
how the room is to be divided for
searching and to what height the
first searching sweep should
extend. The first searching sweep
will cover all items resting on the
floor up to the selected
height. You should divide the room
into two virtually equal parts.

73. In conclusion, the following steps
should be taken in order to search
a room:
1. Divide the area and select a
search height.
2. Start from the bottom and work
your way up.
3. Start back-to-back and work
toward each other.
4. Go around the walls and
proceed toward the center of
the room.

74. Suspicious object located:
It is imperative that personnel involved
in a search be instructed that their only
mission is to search for and report
suspicious objects. Under no
circumstances should anyone
move, jar, or touch a suspicious object
or anything attached to it. The removal
or disarming of a bomb must be left to
the professionals in explosive ordnance
disposal. When a suspicious object is
discovered, the following procedures
are recommended:

75. Suspicious object located:
1. Report the location and an
accurate description of the object
to the appropriate property mgt.
official, floor warden or security
officer. This information should be
relayed immediately to the temp.
command center, which will, notify
the police and fire departments,
and rescue squad. These officers
should be met and escorted to the
scene by building security.

76. Suspicious object located:
2. If absolutely
necessary, place sandbags or
mattresses, never metal
shields, around the
suspicious object. Do not
attempt to cover the object.
3. Identify the danger area, and
block it off with a clear zone of
at least 300 feet, including
floors below and above the

77. Suspicious object located:
4. Check to see that all doors
and windows are open to
minimize primary damage from
blast and secondary damage
from fragmentation.
5. Evacuate the building.
6. Do not permit re-entry into
the building until the device
has been removed/
disarmed, and the re-entry.

78. 78
Airgas-Lifegas oxygen tanks

79. Explosive Tanks on site:
Airgas tanks that hold explosive
oxygen, carbon dioxide, soda
ash, sodium hypo-chlorite, and aqua
ammonia type gases can be a huge
target for a bomber, weather they are
domestic or foreign. If your property has
these type of tanks with any of those
gases, they should be inspected &
checked daily. To go a step further, a
pelco type stationary camera should be
fixed on them at all times.

80. Handling the News media:
It is of paramount importance
that all inquiries from the news
media be directed to one
individual appointed as a
spokesperson. All other
persons should be instructed
not to discuss the situation
with outsiders, especially the
news media.

81. Handling the News media:
The purpose of this provision
is to furnish the news media
with accurate information and
to see that additional bomb
threat calls are not precipitated
by irresponsible statements
from uninformed sources.

82. 82
The Bomb Threat Checklist:

83. 83
The Bomb Threat Checklist:

84. The Bomb Threat Checklist:
Security personnel who answer any
type of telephoned bomb threat shall
always, always have their Bomb Threat
checklist at the ready. This critical
form should be in plain sight near the
phone system for easy access when
receiving such a call. The bomb threat
checklist shall never be filed away in
some binder or in a filing cabinet. This
form must be VISIBLE to the security
staff at all times!!

85. The source of Bomb Threats:

86. Traditionally and
historically, telephoned bomb
threats have sourced from public
pay phones. Sometimes from a
payphone right in front of the
targeted building itself. Tracing
the call before caller ID or
enhanced 911 was nearly
impossible. But with public
payphones becoming a thing of
the past, cell phones are now the
common tool used for bomb
threats and very easily traceable.

87. 87
Bomb Threat Incidents-
Suffolk County, Boston 1976

88. Bomb Threat Incidents-
Suffolk County Boston 1976 :
The United Freedom Front (UFF) was a small
American Marxist organization active in the
1970s and 1980s, and its members became
known as the Ohio 7 when they were brought
to trial. Between 1975 and 1984 the UFF
carried out at least 20 bombings and nine
bank robberies in the northeastern United
States, targeting corporate
buildings, courthouses, and military facilities.
22 people were injured in one 1976 bombing
at the Suffolk County Courthouse in
Boston, including a courthouse worker who
lost a leg. The complex itself sustained
serious damage.

89. 89
Bomb Threat Incidents-
Los Angeles, CA. 1910

90. Bomb Threat Incidents-
Los Angeles, CA. 1910
A massive deliberate explosion
destroyed the Los Angeles Times building
in the city's downtown area, killing 21 and
injuring many more. Since Los Angeles
Times publisher Harrison Otis, a virulent
opponent of unions, believed that the
bomb was directed at him, further
investigation uncovered 3 men to the
union and were convicted.

91. Identifying Suspicious
Packages, baggage or Mail:

92. “Just what is in that package”

93. Suspicious White Powders:

94. 94
Suspicious White Powders:
Suspicious white powders or any
suspect powder like substance can
be completely harmless or quite
lethal. There are lengthy & detailed
emergency procedures for trained
first responders on how to deal with
suspect substances sent via the US
mail system or other carriers.

95. 95
Suspicious White Powders:
With that knowledge, we must
reiterate to the security personnel
and employees that upon first
discovering a suspicious powder or
similar substance, remember to take
the first initial steps to contain a
possibly volatile situation-

96. 96
Suspicious White Powders:
DON’T PANIC!!
PUT THE LETTER DOWN!!
DO NOT INVOLVE OTHERS!
DO NOT MOVE IT UNLESS
ABSOLUTELY NECESSARY!!
NOTIFY YOUR SUPERVISOR
IMMEDIATELY!!!

97. How to Recognize Suspicious
Packages and Mail:

98. Suspicious packages , parcels, or
backpacks demonstrate a prime
example of an unwelcome
“entity” entering your
facility, thus a breach of access
control. Potentially explosive
parcels or ones laden with a
biological hazard like Anthrax
pose a serious threat to all
concerned in your building
environment.

99. It is critical for all security
staff members as well as
building occupants to remain
alert for the tell-tale signs of
potentially dangerous mail
and packages. Security
personnel must also
remember the basic SOP
procedures for handling an
item that has come under
scrutiny or suspicion.

100. 100
How to Recognize Suspicious
Packages and Mail:
Possible Indicators:
 Excessive postage
 Misspelled common words
 No return address or strange return address
 Restrictive markings, such as “personal”
“confidential,” ”do not pre-screen” or “do not
x-ray”
 Postmarks that do not match return
addresses

101. 101
Other indicators of suspicion:
 Powdery white substances felt
through or appearing on the
package or parcel.
 Oily stains or discolorations
on the exterior.
 Strange odors emanating from
the package

102. 102
Other indicators of suspicion:
Excessive packaging
material, like tape or string
 Ticking
sounds, protruding
wires, exposed aluminum

103. 103
Always remain calm!
Do not open the letter or package (or open
any further), do not shake it, do not show it to
others, or empty its contents.
Leave the letter or package where it is or
gently place it on the nearest flat surface
possible.
If possible, gently cover the letter (use a trash
can, article of clothing, etc.)
Shut off any fans or equipment in the area
that may circulate the material

104. 104
PRIORITY: Alert employees and
visitors nearby to relocate to an area
away from the site of the suspicious
item without causing alarm or panic.

105. 105
Responding to
Suspicious Packages:
 Relocate to your office’s designated
room-area or if instructed to do
so, proceed to your designated exterior
rally-meeting point. Take essential items
with you.
 Stay in the designated area until
instructed otherwise by the local Police
and or lobby security personnel- property
management staff.

106. When you have received an external
bomb threat who is the first person you
are notifying? 911? Fire Dept.? the
Police? or the Property Manager?

107. The answer to that question would be
unequivocally your property manager.
Allow me to explain why…….

108. Generally, during a
telephoned bomb threat
who makes the final
decision to evacuate the
building, before, during, o
r after a search? The Fire
Dept.? The Police Dept.?
The FBI? The Security
Manager?

109. 109
The Property Management Team!

110. Bomb threat response and suspicious package
detection usually starts in the front lines of high
rise access control- the lobby front desk.
Therefore it is vital that those reception staff &
security personnel are the most trained and most
knowledgeable about these procedures.

111. Building employees, fellow employees,
property management, and the visitors all
count on YOU to know exactly what to do
in a crisis situation and above all to not fail
in a leadership role when one develops.

112. Thank you for attending
today’s presentation on
bomb threat procedures