Location: Event Date: Point of Contact: Exercise Threat Title: HOW TO USE THIS GUIDE This guide is designed to help school administrators implement bomb threat response, guidance, and searches that utilizes the Incident Command System (ICS) and current best practices. This guide is a tool to supplement all hazards emergency plans. It is not meant to replace emergency plans or supersede the actual management of the emergency. Contents 123456789 Bomb Threat Response Chart... Bomb Threat Methods... a. Phoned Threats Checklist... b. Written Threats Checklist... c. Electronic Threats Checklist (email and social media)... d. Verbal Threats and Rumors Checklist... e. Suspicious Package / Mailing Indicators Checklist... Management & Heightened Security... Bomb Threat Search... Bomb Threat Assessment... 10 Evacuation and Secondary Attack Precautions... 11 Final Checklist and Log... 12 Resources Crisis Communications... 13 Suspect and Vehicle Description Form... 14 Bomb Threat Search Coordinator Tracking Form... 15 Bomb Threat Search Sheet... 16 Stand-Off Distances... 17 Incident Command Assignment... 18 Incident Command Chart Guide... 19
01 BOMB THREAT RESPONSE CHART THREAT ICS and HEIGHTENED SECURITY Complete relevant form (pages 2-7) Page 8 NOTIFICATIONS Page 8 SEARCH Page 9 SUSPICIOUS OBJECT NO OBJECT ASSESS HIGH SECONDARY ATTACK Page 10 DEVELOP Resource CRISIS COMMS Section STRATEGY EVACUATE MED LOW COUNTERMEASURES RESUME NORMAL OPERATIONS 1 FAMILY REUNIFICATION Page 9 Page 11 Page 11 Refer to Emergency Plan
02 BOMB THREAT METHODS When receiving any type of threat, pay careful attention to pertinent details. The person making the threat may provide enough information to reveal their identity or location, which may assist with the investigation. A bomb threat may be received by telephone, written message, email, social media, verbal, or suspicious mail/package. The majority of bomb threats are typically received by telephone, although many of the recent bomb threats have been reported from social media. TYPES OF THREATS: a Phoned Threats...Page 3 b Written Threats...Page 4 c Electronic Threats 01 01...Page 5 Emailed Threats Social Media Threats d Verbal Threats and Rumors...Page 6 e Suspicious Package / Mailing Indicators...Page 7 Determine the type of threat and fill out the corresponding bomb threat checklist. 2
a PHONED IN THREATS Place a copy of this page under your telephone NEVER HANG UP THE PHONE! QUESTIONS TO ASK: EXACT WORDING OF THE THREAT When is the bomb going to explode? Where is it right now? What does it look like? What kind of bomb is it? What will cause it to explode? Did you place the bomb? Why? What is your address? What is your name? BACKGROUND SOUNDS: Crockery PA System House Local Long-distance Voices Animals Clear Office Phone booth Sex of caller: M F Length of call: Race: Time: (AM/PM) Number at which call was received: Street ( ) Music Static Age: Date: Caller ID (if available) THREAT LANGUAGE: Motor Factory Other: Irrational Well-spoken Incoherent Foul Read by threat maker Taped Other: CALLER S VOICE WAS: Calm Slow Loud Nasal Raspy Disguised Rapid Laughing Distinct Deep Whispered Excited Crying Slurred Lisped Accented Clearing Throat Cracking voice Normal Angry Stuttering Soft Ragged Breathing Deeply Familiar If so, who did it sound like? REMARKS: WHEN THE CALLER HANGS UP, DO NOT HANG UP THE PHONE. 3 SIGNAL ANOTHER STAFF MEMBER TO CALL 9-1-1 (then, monitor their conversation, if possible)
b WRITTEN THREATS STEPS TO TAKE: SUSPECT / VEHICLE DESCRIPTIONS: Handle the note as little as possible Preserve the threat (note) or access to the scene Notify 9-1-1 (REFER TO SUSPECT DESCRIPTION FORM IN THE RESOURCES SECTION) ANY OTHER POSSIBLE WITNESSES: NOTES TO TAKE: Location of the note? Date the note was found? Time the note was found? Does the note indicate a detonation time? What will cause it to explode? Does the note indicate where the bomb is planted? Yes No If Yes, where Is the area under video surveillance? What is your name? SITUATIONS / CONDITIONS SURROUNDING THE DISCOVERY: 4 NOTIFY 9-1-1
c ELECTRONIC THREATS - email and social media STEPS TO TAKE: Preserve the threat (take a screen-shot if possible). DO NOT turn off the computer or close any windows. Print, photograph, or copy down the message (include the header if the threat was sent by email) If the threat was by email SAVE THE EMAIL and leave email open until assistance arrives. Date and Time threat was originally posted or sent: / Username / Handle of person who posted or sent the threat? Was the threat sent to a specific person? Yes No If yes, who? Does the note indicate where the bomb is planted? Yes No If Yes, where NOTES TO TAKE: Does the threat indicate a detonation time? Where was the threat found (in an email, social media - Facebook / Does the threat indicate what will cause it to explode? Yes No Twitter / Instagram, etc.)? Date and Time threat was found: If yes, what? If the threat was on social media, was it liked or shared by other? Yes No If Yes, who RECORD THE EXACT WORDING OF THE THREAT AS IT WAS POSTED (Remember to print off entire email with header) : 5 NOTIFY 9-1-1
d VERBAL THREATS and RUMORS REMAIN CALM EXACT WORDING OF THE THREAT STEPS TO TAKE: Project calmness; move and speak slowly, quietly, and confidently. Notify 9-1-1 when it is safe to do so. NOTES TO TAKE: if you know him or her, or if he or she gives you one? Date and Time of the threat: Where the person who made the threat is now, if known: Note the direction in which the person who made the threat leaves and report to local law enforcement: REPORT THREAT IMMEDIATELY TO THE POLICE When is the bomb going to explode? Where is it right now? What does it look like? THREAT LANGUAGE: Irrational Well-spoken Incoherent Foul Read by threat maker Taped Other: THREAT VOICE WAS: Calm Slow Loud Normal What will cause it to explode? (REFER TO SUSPECT DESCRIPTION FORM IN THE RESOURCES SECTION) Raspy Disguised Angry Nasal Rapid Laughing Distinct Stuttering ANY OTHER DISTINGUISHING FEATURES: What kind of bomb is it? NOTE THE RACE AND SEX; BODY SIZE; TYPE AD COLOR OF CLOTHING; HAIR, EYE AND SKIN COLOR, ETC. 6 NOTIFY 9-1-1 (as soon as you can safely do so) REMARKS: Deep Whispered Excited Soft Crying Slurred Lisped Ragged Accented Clearing Throat Cracking voice Breathing Deeply
e SUSPICIOUS PACKAGE / MAILING INDICATORS If your staff receives a suspicious package or letter, it is important to know how to identify, respond and report to authorities. A suspicious package is treated as an immediate danger, not a threat. IF A SUSPICIOUS PACKAGE / MAILING OR DEVICE IS FOUND: Do NOT touch, tamper with, or move the item. Immediately report item to site decision maker(s) and notify local law enforcement. Do NOT open, smell or taste. Wash your hands with soap or water if in contact. Site decision maker(s) must: Ensure area is secured and cleared of personnel. Ensure law enforcement was notified and follow police directives. Ensure emergency responders are continuously briefed. Follow Secondary Attack and Evacuation guidelines. (Page 11) 7
03 MANAGEMENT ICS (optional) The Incident Command System or ICS is an effective approach to managing complex emergencies, like a bomb threat. The key components of ICS are establishing realistic objectives (i.e. implementing Heightened Security Procedures or Determine if there is an explosive device on campus), collaborating with other stakeholders. (i.e. District and Law Enforcement) and delegating responsibilities (i.e. establishing search teams). REFER TO THE INCIDENT COMMAND ASSIGNMENT IN THE RESOURCES SECTION Heightened Security After a bomb threat has been received, restricting students to classrooms is recommended to prevent a student from accidentally or intentionally triggering an explosive device on campus. Heightened Security is a procedure to increase the security of a school without invoking the concerns of an active shooter that is associated with lockdown. Objectives: Recall all staff and students outside the school. Restrict hallway access. Order students to their next scheduled classrooms immediately Establish a command post. Secure all entrances. Establish communications with law enforcement Delegate a Staff Member/SRO to monitor entrances and parking lots (from inside). Inform staff of situation and review plans in case the situation escalates. Develop plans to accommodate persons with special needs, restroom breaks and meals in case the event lasts for over an hour. Example Language: Attention! We have an incident requiring Heightened Security. This is not a drill. Students report immediately to your scheduled class. Teachers allow students into the classroom and then restrict hallway access. Additional information will follow. Teachers and staff can be provided updates via email or in person. 04 NOTIFICATION: Effective communication and collaboration are keys to managing bomb threats. Identify all stakeholders that need to notified. STAKEHOLDER 1. 9-1-1 2. District 3. Parents NOTIFIED BY DATE / TIME 4. 5. 6. 8
05 BOMB THREAT SEARCH Searching your campus is an important step in insuring the safety of all students, staff, and visitors. Persons conducting the search need only look for items that appear suspicious and/or look out of place. The determination as to whether an object is an explosive device is left to law enforcement experts. Should any person locate an item that is suspicios, follow the Suspicious Object Response steps below and REFER TO THE BOMB STANDOFF DISTANCES CHART IN THE RESOURCES SECTION Search Instructions The Search Coordinator should identify areas that need to be searched. Typically, teachers are asked to search their own classrooms so these search areas are limited to common areas, hallways, exits, and paths to possible evacuation rally points. Lockers are not searched during this phase. REFER TO THE BOMB THREAT SEARCH COORDINATOR AND BOMB THREAT SEARCH FORMS N THE RESOURCES SECTION GENERAL SEARCH GUIDELINES Search in two-person teams whenever possible. Divide area to be searched in half (based on content, not size). Listen for ticking or clockwork sounds**. FIRST - search your half of the room waist high (around three feet) and BELOW. SECOND - search your half of the room ABOVE waist high. **IF TICKING SOUND IS HEARD, ATTEMPT TO VISUALLY LOCATE THE ITEM. IF THE ITEM CANNOT BE LOCATED, TREAT THE SOUND AS IF YOU HAVE LOCATED A SUSPICIOUS ITEM. KEY POINTS TO SEARCH Identify all packages, boxes, briefcases, and bags. If you CANNOT identify that the item belongs in the area you are searching, treat it as a suspicious object. Desks Bookcases Filing Cabinets Air Ducts Wastebaskets Window Sills REFER TO THE BOMB THREAT SEARCH COORDINATOR AND BOMB THREAT SEARCH FORMS N THE RESOURCES SECTION IF A SUSPICIOUS OBJECT IS LOCATED Do NOT touch the object. Stop searching that area (there may be additional devices elsewhere). Notify teachers and have everyone move to the other side of the building. Persons who located the object are to report to the Facility Leader. (Facility Leader will notify the authorities and recall others search teams) Secure the area where the item was located, but do not guard it. (STAY AWAY FROM THE ITEM) If possible on the way out of the area, open doors and windows near the item. Facility Leader will determine evacuation route and rally point. Search teams will re-deploy to search evacuation routes and paths to the rally point. When routes are cleared, assist in evacuation as needed. 9
06 BOMB THREAT ASSESSMENT Assessing the Threat- Considering the totality of bomb threat and actual Improvised Explosive Device (IED) incidents, there is no single deciding factor on whether a bomb threat is legitimate or a hoax. Measure all of the facts, context, and conclude from the whole picture whether the possibility of a real threat exists. All threats should be carefully evaluated on an individual basis and called in to local law enforcement regardless of the circumstances. LOW LOW RISK LACKS REALISM: A threat that poses a minimum risk to the victim and public safety. Probable motive is to cause disruption. Threat is vague and indirect. Information contained within the threat is consistent, implausible, or lacks detail. Caller is definitely known and has called numerous times. The threat was discovered instead of delivered (e.g., written on a wall). MEDIUM MEDIUM RISK INCREASED LEVEL OF REALISM: Threat that could be carried out, although it may not appear entirely realistic. Threat is direct and feasible. Wording in the threat suggests the perpetrator has given some thought on how the act will be carried out. May include indications of a possible place and time. No strong indication the perpetrator has taken preparatory steps, although there may be some indirect reference pointing to that possibility. Indication the perpetrator has details regarding the availability of components needed to construct a bomb. Increase specificity to a threat (e.g. I know your lunch periods. ) HIGH HIGH RISK INCREASED LEVEL OF REALISM: Threat is direct, specific, and realistic; may include names of possible victims, specific time, location of devices. Perpetrator provides his/her identity. Threat suggests concrete steps have been taken toward carrying out the threat. Perpetrator makes statements indicating they have practiced with a weapon or have had the intended victim(s) under surveillance. 10
07 EVACUATION AND SECONDARY ATTACK PRECAUTIONS a Secondary Attack Counter-Measures ONGOING COUNTER-MEASURES Security Awareness Enforce visitor check-in policies Properly screen all deliveries Maintain access control POST-THREAT INTERIOR COUNTER-MEASURES Implement Heightened Security procedures to restrict student movement (Page 8) Prevent student access to lockers Search ( eyes open, hands in pockets ) for suspicious devices POST-THREAT EVACUATION COUNTER-MEASURES Request law enforcement of the rally point Prior to evacuation, search exits and paths to rally points Avoid parking lots and prevent access to cars Prevent groups from gathering away from rally point Prevent students from gathering near emergency response vehicles b Evacuation Select Evacuation Rally Point Enact Secondary Attack Counter-measures (below) N/A Notify Off-Site Shelter Location N / A Location name: Arrange for Transportation NOTES 11
08 FINAL CHECKLIST & LOG INCIDENT COMMANDER COMPLETE Document the Threat Yes No N/A Implement Heightened Security Yes No N/A Establish Communications o ICS Staff & School o Response Agencies o District o Parents Yes No N/A Search Conducted Yes No N/A Suspicious Object Located Yes No N/A Assess Threat Low Med High Secondary Attack Countermeasures Yes No N/A Evacuate Yes No N/A Announce all clear OR Transfer command to appropriate response agency and establish unified command. NOTES (if yes turn over command to Law Enforcement) Yes No N/A NOTES 12
RESOURCES SECTION CRISIS COMMUNICATIONS When active crisis communications are required, there are just four things your stakeholders, the public and the media want to know: 1. WHAT HAPPENED? 2.WHAT IS BEING DONE? 3.WHAT ARE YOUR NEXT STEPS? 4.WHAT CAN WE DO TO HELP? Maximum disclosure and minimum delay is always worth considering, but when and what to release is unique to each incident. In any emergency, but especially with bomb threats, all messages should be coordinated with internal (district) and external (law enforcement) release authorities. Releasing sensitive information can jeopardize lives and disseminating inaccurate information harms credibility and impacts people s confidence in the organization. When developing messages for an actual emergency, work with your response partners to provide consistent messages that target your audience and stay within your lane. Do not speculate or release unapproved information. Be sure your messages answer the four questions; this will help prevent an information vacuum. Terminology for Bomb Threats If measures were enacted to secure your school(s) consider using the term Heightened Security instead lockdown. People may associate lockdown with an active shooter-type threat. What Happened? Remember B.L.U.F. (Bottom Line Up Front). A clear, concise statement that illustrates 1 your organization understands the scope of the incident and taking appropriate actions. Rather than using the lockdown, use heightened security. EXAMPLE: A concerning social media post that referenced our school and a possible bomb was discovered today that required our school to implement heightened security procedures. 2 3 What is Being Done? Without jeopardizing operational security, privacy or ongoing investigations, provide a brief, high-level overview of actions. EXAMPLE: The school has implemented heightened security procedures and is restricting public access into the school while limiting student movement inside. Law enforcement is at the school and assisting us in our response. What Are Your Next Steps? Again, protect operational security and do not divulge too many specifics. For instance, if a school is to be evacuated, there is no need to publicly divulge where the students are being evacuated to before the site is prepared and parents have been notified. Remember, the overarching goal is to communicate you have a plan. EXAMPLE: : Our district and school have detailed emergency plans and these plans have been enacted. We will continue to work with local law enforcement to insure the safety of our students and staff. 4 What Can We Do to Help? Without jeopardizing operational security, privacy or ongoing investigations, provide a brief, high-level overview of actions. EXAMPLE: Please do not come to the school as students cannot be released until law enforcement provides an all-clear. We will provide more information through local media outlets and our messaging system as soon as it becomes available. 13
14 RESOURCES SECTION REMARKS: SUSPECT AND VEHICLE DESCRIPTION FORM
RESOURCES SECTION BOMB THREAT COORDINATOR SEARCH TRACKING FORM NOTES of Coordinator Search Tracking Form: = CLEAR = DANGER AREA TO BE SEARCHED SEARCH TEAM MEMBERS 15
RESOURCES SECTION BOMB THREAT SEARCH SHEET MAKE ADDITIONAL COPIES OF THIS PAGE AS NEEDED This form is to be provided to persons being asked to search for suspicious devices. GENERAL SEARCH GUIDELINES Search in two-person teams whenever possible. Divide area to be searched in half (based on content, not size). Listen for ticking or clockwork sounds**. FIRST - search your half of the room waist high (around three feet) and BELOW. SECOND - search your half of the room ABOVE waist high. **IF TICKING SOUND IS HEARD, ATTEMPT TO VISUALLY LOCATE THE ITEM. IF THE ITEM CANNOT BE LOCATED, TREAT THE SOUND AS IF YOU HAVE LOCATED A SUSPICIOUS ITEM. NAME OF PERSON(S) CONDUCTING THE SEARCH 1 2 AREAS TO BE SEARCHED Complete Complete Complete Complete Complete Complete Complete Complete Complete Complete KEY POINTS TO SEARCH Identify all packages, boxes, briefcases, and bags. If you CANNOT identify that the item belongs in the area you are searching, treat it as a suspicious object. Desks Bookcases Filing Cabinets Air Ducts Wastebaskets Window Sills IF A SUSPICIOUS OBJECT IS LOCATED Do NOT touch the object. Stop searching that area (there may be additional devices elsewhere). Notify teachers and have everyone move to the other side of the building. Persons who located the object are to report to the Facility Leader. (Facility Leader will notify the authorities and recall others search teams) Secure the area where the item was located, but do not guard it. (STAY AWAY FROM THE ITEM) If possible on the way out of the area, open doors and windows near the item. Facility Leader will determine evacuation route and rally point. Search teams will re-deploy to search evacuation routes and paths to the rally point. When routes are cleared, assist in evacuation as needed. 16
17 RESOURCES SECTION
RESOURCES SECTION 08 INCIDENT COMMAND ASSIGNMENT N / A (Optional) Use the Incident Command System (ICS) to help delegate authority and achieve the Incident Objectives. Not every ICS position that is listed below has to be staffed and people can fill more than one assignment. Assignments should be prioritized based on the Incident Objectives. I.C.S. CHART INCIDENT COMMANDER PUBLIC INFORMATION SAFETY COORDINATOR PLANNING & INTELLIGENCE OPERATIONS LOGISTICS FINANCE/ADMIN DOCUMENTATION TRANSPORTATION EMERGENCY TEAM FIRST AID/MEDICAL STUDENT TRACKING SECURITY PSYCHOLOGICAL FAMILY REUNIFICATION TRANSFER OF COMMAND SCHOOL/DISTRICT INCIDENT COMMANDER NEW INCIDENT COMMANDER Agency Rank / New Assignment? NOTES Time REMEMBER ICS Staffing is based on incident objectives and available resources. YOU ARE NOT REQUIRED TO FILL ALL ICS POSITIONS. 18
RESOURCES SECTION INCIDENT COMMAND CHART GUIDE This I.C.S. Chart is optional. If your district or school has not received formal Incident Command System (I.C.S.) training, you are strongly encouraged to complete the FEMA IS-100.SCa (ICS for Schools) course. I.C.S. CHART GUIDE INCIDENT COMMANDER (I.C.) (MANDATORY) This is the person in charge of the drill (or response in an actual emergency). The I.C. can change as the emergency changes or as more qualified people arrive; this is called Transfer of Command (Section 8). For transfer command to law enforcement. PUBLIC INFORMATION (OPTIONAL) A member of the Command Staff responsible for interfacing with the public and media or other agencies with incident-related information requirements. SAFETY COORDINATOR (OPTIONAL) A member of the Command Staff responsible for monitoring and assessing safety hazards or unsafe situations, and for developing measures for ensuring personnel safety. PLANNING AND INTELLIGENCE (RECOMMENDED) Responsible for the collection, evaluation, and dissemination of information related to the incident, and for the preparation and documentation of Incident Action Plans. 1. DOCUMENTATION (Student Accountability) OPERATIONS (MANDATORY) Responsible for implementing all aspects of the emergency response and meeting the objectives set by the I.C. 1. EMERGENCY TEAM (School Safety or Crisis Teams fall under Operations) 2. SECURITY (Security officers report to Operations during the emergency) 3. FIRST AID & MEDICAL (First aid teams are under Operations) 4. FAMILY REUNIFICATION (Implementing renunciation falls under Operations) 5. MENTAL HEALTH (Mental health services are coordinated through Operations) i. Other ii. Other iii. Other LOGISTICS (OPTIONAL) Provides resources and other services to support incident management. 1. TRANSPORTATION FINANCE AND ADMIN (OPTIONAL) Responsible for all incident costs and financial considerations. TRANSFER OF COMMAND When command is transferred, the process must include a briefing that captures all essential information for continuing safe and effective operations. 19