Guidance

Bomb Threats

Published 2 November 2020

This guidance was withdrawn on 30 May 2022

For the latest, up to date versions of NaCTSO guidance, please visit www.protectuk.police.uk. This NaCTSO page is no longer updated.

1. Procedures for handling bomb threats

The vast majority of bomb threats are hoaxes, designed to cause alarm and disruption and instances of valid bomb threats are rare. Terrorists and others may make hoax bomb threat calls to intimidate the public, businesses and communities, to draw attention to their cause and to mislead police.

While many bomb threats involve a person-to-person phone call, an increasing number are sent electronically using email or social media applications. No matter how ridiculous or implausible the threat may seem, all such communications are a crime and should be reported to the police by dialling 999.

It is important that potential recipients – either victims or third parties used to pass the message - have plans that include how the information is recorded, acted upon and passed to police.

1.1 The bomb threat message

Bomb threats containing accurate and precise information, and received well in advance of an actual attack, are rare occurrences. Precise motives for hoaxing are difficult to determine but may include revenge, extortion, a desire to impress, or a combination of these and other less understandable motives. Hoaxes are a form of social engineering and, whatever the motive, the intent is to cause disruption, fear and/or inconvenience the victim, i.e. to make victims work against their own best interests.

1.2 Communication of the threat

A bomb threat can be communicated in a number of different ways. The threat is likely to be made in person over the telephone; however, it may also be a recorded message (possibly using a text-to-speech synthesiser or a soundboard); communicated in written form; delivered face-to-face or, increasingly, sent by email or social media. A threat may be communicated via an independent third-party, i.e. a person or organisation unrelated to the intended victim and selected only to pass the message. However the threat is communicated, the police will need the exact wording and whatever other details are available (see the Bomb threats checklist).

1.3 Immediate steps if you receive a bomb threat communication

Any member of staff with a direct telephone line, mobile phone, computer or tablet etc., or who has any contact with the public, could conceivably receive a bomb threat. Your staff must, therefore, understand the actions required of them as the potential first response to a threat message and their duty of care to others.

If a telephone threat is received:

• stay calm and listen carefully
• have immediate access to the bomb threat checklist and the key information that should be recorded
• if practical, keep the caller talking and alert a colleague to dial 999.
• if displayed on your phone, note the number of the caller, otherwise, dial 1471 to obtain the number once the call has ended
• if the threat is a recorded message, write down as much detail as possible and retain for the police to secure
• if the threat is received via text message, do not reply to, forward or delete the message; note the number of the sender and follow police advice
• know who to contact in your organisation upon receipt of the threat, e.g. building security/senior manager, as they will need to make an assessment of the threat

Ideally, the Bomb Threats checklist should be completed as soon as possible, i.e. whilst the threat is ‘fresh’ in the recipient’s memory.

If the threat is delivered face-to-face:

• Try to remember as many distinguishing characteristics of the threat-maker as possible and try to remember exactly what was said (again, the bomb threat checklist may be a useful prompt).

If discovered in a written note, letter or as graffiti:

• Treat as police evidence and stop other people touching the item.
• If the threat is received via email or a social media application:
• Do not reply to, forward or delete the message.
• Note the sender’s email address or username/user ID for social media applications
• Preserve all web log files for your organisation to help the police investigation (as a guide, police will require data from 7 days prior to the threat message and 48 hours after).

Remember: Seek advice from the venue security/operations manager as soon as possible. All bomb threat communications are a crime and should be reported to the police by dialling 999.

2. Assessing the credibility of bomb threats

Evaluating the credibility of a threat is a critical task, particularly if the attack being threatened is imminent. Short-notice threats are a tactic used to place additional pressure on decision makers, so the better prepared you are, the quicker the police response is likely to be. Police will assess the threat and if specific intelligence is known, will give risk management advice accordingly. However, in the absence of detailed information or specific intelligence, it will be necessary for you to consider a number of factors relevant to your decision-making process:

• Is the threat part of a series? If so, what has happened elsewhere or previously?
• Can the location of the claimed bomb(s) be known with precision? If so, is a bomb visible at the location identified? Has a report of suspicious behaviour been received? Do you have CCTV coverage at/near the location specified?
• If a suspicious item is identified can anyone account for its presence? Are bomb-like characteristics visible? (e.g. wiring or a power source). Was the item located after suspicious activity was noted?
• Considering the hoaxer’s desire to influence behaviour as a form of social engineering, is there any good reason to believe their words or follow any instructions they give?
• If the threat is imprecise, could an external evacuation inadvertently move people closer to the hazard specified or to other forms of physical attack, e.g. the possibility of a vehicle as a weapon or knife attack?

3. Actions to consider

Responsibility for the initial decision making remains with the management of the location being threatened and must form part of an inclusive process for managing risk. As already noted, all bomb threats should be reported to the police and their subsequent advice followed. Police will assess the credibility of the threat not just to the building and the people within it, but also to the surrounding area. This will be done at the earliest opportunity, followed by the provision of appropriate guidance, which may inform your further options. However, do not delay your decision making process waiting for the arrival of police. It is essential that appropriate plans exist and are tested; they should be event and location specific, and accommodate foreseeable variables.

Read more about Evacuation, Invacuation, Lockdown, Protected Spaces

3.1 Checking your venue for suspicious items – search considerations

Regular searches i.e. systematic checks of your establishment, proportionate to the foreseeable and plausible risks, will enhance a good security culture and reduce the possibility of an unattended/suspicious item being placed, or remaining unnoticed for long periods. Additionally, if you receive a bomb threat - depending upon how credible it is - you may decide to conduct a ‘search’ to establish that no such item is in place.

To that end:

• Ensure plans are in place to carry out an effective search in response to a bomb threat
• Identify who in your venue will coordinate and take responsibility for conducting searches
• Initiate a search by messaging over a public address system (coded messages avoid unnecessary disruption and alarm), by text message, personal radio or by telephone cascade
• Divide your venue into areas of a manageable size for 1 or 2 searchers; ideally staff should follow a search plan and search in pairs to ensure the area is covered effectively
• Ensure those conducting searches are familiar with their areas of responsibility; those who regularly work in an area are best placed to spot unusual or suspicious items
• Focus on areas that are open to the public; enclosed areas (e.g. cloakrooms, stairs, corridors, lifts etc.) evacuation routes and assembly points, car parks, other external areas such as goods or loading bays
• Develop appropriate techniques for staff to be able to routinely search public areas without alarming any visitors or customers present
• Ensure all visitors know who to report a suspicious/unattended item to, and have the confidence to report suspicious behaviour
• Under no circumstances should any item assessed as suspicious be touched or moved in any way. Once an item is declared suspicious by a competent person, commence evacuation immediately and dial 999.

Familiarising through testing and exercising will increase the likelihood of an effective response to an evacuation and aid the decision making process when not to evacuate/invacuate.

Remember: it is vital that regular drills are carried out to ensure all are familiar with bomb threat procedures, routes and rendezvous points. Disabled staff should have personal evacuation plans and be individually briefed on their evacuation procedures. Similarly all visitors should be briefed on evacuation procedures and quickly identified and assisted in the event of a threat.

4. Media and communication

Avoid revealing details about specific incidents to the media or through social media without prior consultation with police. Do not provide details of the threat, the decision making process relating to evacuation (internal or external) or why a decision not to evacuate was taken.

• Releasing details of the circumstances may:
• be an objective of the hoaxer; publicity may enhance their credibility and lead to further hoaxing
• cause unnecessary alarm to others
• be used by those planning to target other venues
• elicit copycat incidents
• adversely affect the subsequent police investigation