Guidance

Mail handling

Published 2 November 2020

This guidance was withdrawn on 30 May 2022

For the latest, up to date versions of NaCTSO guidance, please visit www.protectuk.police.uk. This NaCTSO page is no longer updated.

1. Introduction

1.1 Small deliveries by courier and mail handling

Most businesses will receive a large amount of mail and other deliveries and this offers a potentially attractive route into premises for terrorists.

Go to PAS 97: 2015 Mail screening and security specification

PAS 97 is useful to those assessing the risks an organisation faces from postal threats, and implementing appropriate screening and security measures, either internally or outsourced.

1.2 Delivered Items

Delivered items, which include malicious letters, parcels, packages and anything delivered by post or courier, have been a commonly used tactic by criminals and terrorists. A properly conducted risk assessment should give you a good idea of the likely threat to your organisation and indicate precautions you need to take.

Delivered items may be explosive, incendiary, contain sharps or blades, or chemical, biological or radiological (CBR) material. The phrase ‘white powders’ is often used in the context of mail and encompasses CBR material as well as benign materials (note: such materials may not be white and may not be powders). Anyone receiving a suspicious delivery is unlikely to know which type it is, so procedures should cater for every eventuality.

A delivered item may have received some rough handling in the post and so is unlikely to detonate through being moved. Any attempt at opening it, may set it off or release the contents. Threat items come in a variety of shapes and sizes; a well-made device will look innocuous but there may be tell-tale signs.

2. Indicators

2.1 Indicators to Suspicious Deliveries/Mail

General indicators that a delivered item may be of concern include:

• an unexpected item, especially if hand delivered
• a padded envelope (‘Jiffy Bag’) or other bulky package
• an additional inner envelope or other contents that may be difficult to remove
• labelling or excessive sealing that encourages opening at a particular end or in a particular way
• oddly shaped or lopsided
• an envelope flap stuck down completely (normally gummed envelope flaps leave slight gaps at edges)
• marked ‘to be opened only by…’ ‘personal’ or ‘confidential’
• an item addressed to the organisation or a title (rather than a specific individual)
• unexpected or unusual origin (postmark and/or return address)
• no return address or return address that cannot be verified
• poorly or inaccurately addressed /address printed unevenly or unusually
• unfamiliar writing or unusual style
• unusual postmark or no postmark
• more stamps than needed for size or weight of package
• greasy or oily stains emanating from package
• odours emanating from package

2.2 Explosive or incendiary indicators

Additional explosive or incendiary indicators include:

• unusually heavy or uneven weight distribution
• small hole(s) in envelope or wrapping
• the presence of wiring

2.3 ‘White powder’ (CBR) indicators

Additional chemical, biological or radiological (CBR) indicators include:

• powders or liquids emanating from package
• wrapping stained by liquid leakage
• marked with written warning(s)
• unexpected items or materials found in package upon opening or x-raying (loose or in a container) such as powdered, crystalline or granular solids; liquids; sticky substances or residues
• unexpected odours upon opening
• sudden onset of illness or irritation of skin, eyes and nose

3. What you can do

The initial step will be recognition that an incident has occurred (e.g. using the indicators described above), though the precise nature of the incident (e.g. CBR) may not be immediately apparent. The enactment of the response procedure will follow, including communication with the emergency services who will provide the appropriate response. Detailed below are some points to consider when planning your response. Ensuring that the appropriate staff are familiar with your response procedure is key to its successful implementation.

• Ensure that forethought is put into communication with both staff and the emergency services.
• Ensure that doors can be closed quickly, if required.
• Pre-plan your evacuation routes, ensuring they do not lead building occupants through affected areas. Consider how you will communicate the evacuation routes to occupants during an incident. The level of evacuation may vary depending on the nature of an incident and may not require the evacuation of your entire building or site.
• Consult with your Building Services Manager on the feasibility of emergency shutdown or isolation of heating, ventilation and air conditioning (HVAC) systems (including local extraction systems e.g. in kitchens) and ensure that any such plans are rehearsed.

Note: Due to the complexity of HVAC systems and the variability across buildings and sites, it is not possible to provide generic advice on the alteration or otherwise of HVAC systems in response to an incident - consultation with your organisation’s building services manager and/or specialist HVAC engineers is essential.

You do not need to make any special arrangements for medical care beyond normal first aid provision. The emergency services will take responsibility for the treatment of casualties. However, the provision of materials to undertake improvised decontamination (absorbent materials and water) in a suitable location (i.e. where you would likely evacuate contaminated staff) may be appropriate.

3.1 Actions upon discovery of any suspicious delivered item

You could discover a suspicious item in a mail room, or anywhere else in the building - ensure you have appropriate emergency response plans in place.

3.2 Avoid unnecessary handling and X-raying:

If you are holding the item, put it down on a cleared flat surface

• keep it separate so it is easily identifiable
• do not move it, even to X-ray it
• if it is in an X-ray facility, leave it there

3.3 Move away immediately

• clear immediate area and each adjacent room, including rooms above and below
• if there is any suggestion of chemical, biological or radiological materials, move those directly affected to a safe location close to the incident, keep these individuals separate from those not involved
• prevent others approaching or accessing the cleared areas
• do not use mobile phones or two-way radios in the cleared area or within fifteen metres of the suspect package
• communicate regularly with staff, visitors and the public

3.4 Notify police

• if the item has been opened, or partially opened prior to being deemed suspicious, it is vital that this is communicated to the police
• ensure informants and witnesses remain available to brief the police, and that the accuracy of their observations is preserved: encourage witnesses to immediately record their observations in writing, and discourage them from discussing the incident or their observations with others prior to the arrival of the police

3.5 Additional CBR-specific actions

• if a CBR incident is suspected, then undertake improvised decontamination of contaminated individuals as quickly as possible, ideally within the first 15 minutes
• in the event of a CBR incident occurring it is advised that lifts should not be used in order to move around, or evacuate the building
• if the alteration of the HVAC system features within your response plan (see note above), this should be undertaken as quickly as possible

4. Planning your mail handling and screening procedures

Although not all suspicious items will be hazardous or malicious, you may not be able to determine this without support from the emergency services. Communication therefore with the emergency services is important in triggering the appropriate response, as highlighted above.

A risk assessment is fundamental to ensuring that any measures or procedures your organisation implements are proportional to the risk it faces. Your local police Counter Terrorism Security Advisor (CTSA) can assist with this process by providing information to support threat and impact assessments, as well as relevant mitigation measures. Take the following into account in your planning:

• Consider processing all incoming mail and deliveries at one point only. This should ideally be off-site or in a separate building, or at least in an area that can easily be isolated and in which deliveries can be handled without taking them through other parts of the building.
• Consider your organisational response should there be any changes to your organisation’s risk assessment or mail streams.
• Ensure that all staff who handle mail are briefed and trained how to recognise and respond to the threats your organisation faces. Include reception staff and encourage regular correspondents to put their return address on each item.
• Ensure all sources of incoming mail (e.g. Royal Mail, couriers, and hand delivery) are included within your overall screening process. Note that not all mail streams may require the same level of screening (e.g. if it is deemed lower risk, such as internal mail).
• At present there are no CBR detectors capable of identifying all hazards reliably. Furthermore, while X-ray mail scanners may detect devices for spreading CBR materials (e.g. explosive devices), they will not detect the materials themselves. For further advice on CBR detection, contact your local CTSA.
• Staff need to be aware of the usual pattern of deliveries and to be briefed of unusual deliveries.
• Consider the physical protective measures (e.g. blast protection, dedicated HVAC systems, specialist filtration, washing and shower facilities) you require to protect your organisation and those undertaking mail screening. These should be proportionate to the level of screening that is undertaken, but consider the highest anticipated level of screening that may be required, as physical protective measures may be challenging to alter in response to any change in threat.
• Make certain mail handling areas can be promptly evacuated. Rehearse evacuation procedures and routes as well as communication mechanisms which would be used throughout the incident.
• Staff who are responsible for mail handling should be made aware of the importance of self-isolation (in a safe location) and the mail item of concern (i.e. leave it where it is, do not transport this to another part of the building for further inspection) in reducing contamination.

If in doubt call 999 and ask for the police. Clear the area immediately. Do not attempt to open the letter or package. Avoid unnecessary handling. Keep it separate so it is easily identifiable.

Contact 999 and ask for the police

Useful Links:

Go to the CPNI Screening Mail and Courier Deliveries webpage

Go to the CPNI Mail Screening and Security Campaign webpage