ctisis managment

1. Module 4: Disrupting, Identifying and
Responding Early to Maritime Security
Incidents

2. Official
Aim
To provide an awareness of methods for
disrupting, identifying and responding to
maritime security incidents at an early stage.
Objectives
- Identify common phases of terrorist attacks
- Understand methods for handling hostile
reconnaissance, suspicious behaviour,
suspicious items and bomb threats
- Describe initial actions that can be taken in
response to security incidents

3. Official

4. Official
Hostile Reconnaissance
Hostile
A person who wants to attack or disrupt an
organisation for profit or to make a political or
ideological point.
Hostile Reconnaissance
A purposeful observation with the intention of collecting
information to inform the planning of a hostile attack
against a specific target.

5. Official
Objectives of Hostile Reconnaissance
Identify a target
Discover vulnerabilities
Assess the level and type of security
Consider the best method of attack
Inform the best time to conduct the attack
Assess the likelihood of success

6. Official
In Person
Lewis Ludlow travelled to London in March 2018 to carry out
hostile reconnaissance of landmarks and crowded areas,
including Oxford Street, ahead of a planned attack.

7. Official
In Person
David Headley
made nine trips to
India in two years to
carry out hostile
reconnaissance of
targets ahead of the
2008 attacks.

8. Official
Online
Computers seized
by police from Ian
Forman showed
evidence of internet
research into a
number of mosques
in Merseyside
ahead of a planned
attack.

9. Official
Insider
As a software engineer working at British Airways, Rajib Karim
was told by a member of Al Qaeda in the Arabian Peninsula
“you might be able to provide us with critical and urgent
information."

10. Official
Unmanned Aerial Systems
Brendon Tarrant used a drone to carry out hostile
reconnaissance of Masjid an-Nur in Christchurch, New Zealand,
before carrying out an attack in which 51 people were killed.

11. Official
Disrupting Hostile Reconnaissance
DENY DETECT DETER

12. Official
Identifying Suspicious Activity
People with hostile intent
may behave in a way that is
contrary to the norm.

13. Behaviour Indicators
Identifying Suspicious Activity
What is Behavioural Detection?
Capability for trained practitioners to use scientifically proven
behavioural indicators, to identify individuals who may pose a risk
to the environment in which they are operating.
To engage with anyone they have identified in a process known as
the resolution conversation, in which behaviours of the individual
are monitored throughout the conversation for indications of ill
intent.

14. Official
Identifying Suspicious Activity
Remember…
• Behavioural detection should
only be deployed as part of an
integrated security system
• Not all hostile actors will
exhibit the same cues
• It is important to understand the
baseline of what is “normal”
• Behavioural detection can lead
to “false alarms”
• Suspicions should be resolved
effectively and rapidly in a short
and friendly conversation

15. Official

16. Official
Identifying Suspicious Activity: Stade de
France, 2015

17. Official
Identifying Suspicious Items
Hidden
Obvious
Typical

18. Official
Dealing with Suspicious Items

19. Official
Minimum Safe Distances
100 METRES
200 METRES
400 METRES

20. Official
Dealing with Bomb Threats
Checklist
1. Where exactly is the bomb right now?
2. When is it going to explode?
3. What does it look like?
4. What does the bomb contain?
5. How will it be detonated?
6. Did you place the bomb? If not you,
who did?
7. What is your name?
8. What is your address?
9. What is your telephone number?
10.Do you represent a group or are you
acting alone?
11.Why have you placed the bomb?
12.Record time completed.

21. Official
Gunshot Detection Systems
Optical Sensors
Detect muzzle flash
Dual Technology
Systems
Acoustic Sensors
Detect muzzle blast
and/or projectile
shockwave

22. Official
Gunshot Detection Systems

23. Official
Reacting to a Marauding Terrorist Attack

24. Official
Raising the alarm
ISPS Code, Part A
Functional requirements
include
…1.3.5: providing means for
raising the alarm in reaction
to security threats or security
incidents.

25. • It is 1900hrs
• The EURORO, a car
transporter, has just
come alongside
• A security guard has
noticed a large fire has
broken out on the vessel
• The security guard saw
two individuals dressed
in hoodies running away
from the vessel

27. Official
Discussion: Raising the alarm
What information would the Security
Guard send from the incident?
How would the Security Guard
communicate this information?
To whom would the Security Guard communicate
this information?
What further communication would take
place?
10 minutes

28. Official
Raising the alarm
Mass notification systems Push-to-talk Audible warning devices
Visual warning devices Body worn cameras Personal safety apps

29. Official
Public Announcement – Voice Alarm
(PAVA) Systems
Live
Intelligent
Automated
PAVA
Pre-
R ed
ecord
Hybrid

30. Official
Raising the alarm: Public Announcements
The type of
threat
The attack
location
The
number of
attackers
Action to be
taken
Police
messages Repetition

31. Official
A very low pitched voice is
difficult to understand when
transmitted by radio
Raising the alarm
Rhythm
Speed
Volume
Pitch
Speak in a consistent rhythm
Speak slowly enough to be
clearly understood
Normal conversational volume
is required

32. Official
Raising the alarm
C Clarity
A Accuracy
B Brevity

33. Official
Additional security measures
ISPS Code, Part B
At security level 3, the port facility
/ ship should comply with the
instructions issued by those
responding to the security
incident or threat thereof.
The PFSP / SSP should detail the
security measures which could be
taken by the port facility / ship in
close cooperation with those
responding.

34. The alarm has been raised by
the security guard and the
security control room is now
aware of the incident
The ship has 4000 vehicles on
board, including 300 electric or
hybrid cars
There are 21 crew members on
board

36. Official
Discussion: Initial actions
What initial actions would the security
control room take?
What actions would be taken relating to
the port?
What actions would be taken relating to
ships?
10 minutes

37. Official
Additional security measures - Port
Increased
surveillance
Evacuation
Limiting
access
Additional
restricted
areas
Increasing
security
patrols
Altering
port
operations
Direction of
vessel
movements
Enhanced
screening
Full
illumination

38. Official
Additional security measures - Ship
Limiting access to
a single,
controlled access
point
Granting access
only to those
responding to the
security incident
Directions of
persons on board
Suspension of
embarkation or
disembarkation
Suspension of
cargo handling
operations,
deliveries etc
Evacuation of the
ship
Movement of the
ship
Preparing for a full
or partial search of
the ship

39. Official
Active Delay Systems

40. Official
Active Delay Systems
Lockdown at facilities

41. Official
Manchester Arena Bombing, 2017 Consider
opportunities to prevent or disrupt the attack

42. Official
Manchester Arena Bombing, 2017
18/05/17 18:36:06
Attacker

43. Official
Manchester Arena Bombing, 2017
21/05/17 18:57:46
Attacker

44. Official
Manchester Arena Bombing, 2017
22/05/17 18:30:28
Attacker

45. Official
Manchester Arena Bombing, 2017
20:51:35 22/05/17
Attacker
Security

46. Official
Manchester Arena Bombing, 2017

47. Official
Manchester Arena Bombing, 2017
22:14:49, 22/05/17
Security
Witness

48. Manchester Arena Bombing, 2017
22:30:39 22/05/17
Official
Security
Attacker

49. Official
Manchester Arena Bombing, 2017
Discuss opportunities to prevent or
disrupt the attack

50. Official
Manchester Arena Bombing, 2017
Opportunities to Prevent or Disrupt the Attack
• Identifying hostile reconnaissance – See, Check and Notify
• Positioning of the security perimeter further from the concert hall
• Establishing CCTV coverage to remove blind spots
• Identifying and investigating suspicious behaviour (e.g. repeat visits, heavy
backpack, loitering in a CCTV blind spot)
• Maintaining a security presence in accordance with operational plans
• Performing security patrols in accordance with operational plans
• Ensuring procedures and equipment for reporting security incidents are in place
• Providing security training for all security personnel
• Implementing additional security measures in response to attack indicators

51. Official
Conclusion
• Maintain vigilance for hostile reconnaissance
• Implement protocols and equipment to deal
with suspicious behaviour, suspicious items
and bomb threats
• Act early during terrorist attacks to
—Communicate with the public
—Communicate with the emergency services
—Instigate additional security measures
➢Save Lives

52. OFFICIAL