Suspicious Packages

Suspicious Packages

Over the past week, U.S. politicians, high profile individuals, and CNN were targeted with suspicious packages/letters at their homes or places of business.  These packages, each appearing to contain a bomb, were a coordinated attempt to spread fear, injure the intended recipients, and cause destruction. Since the days of the "Unabomber" in 1978 and the anthrax containing letters sent to members of Congress in 2001, the potential dangers of threats perpetrated by mail have been realized.

What is a suspicious item?

A suspicious item is any article (e.g. package, envelope, bag, vehicle, etc.) that is reasonably believed to contain explosives, an improvised explosive device (IED), or other hazardous material that requires a bomb technician and/or specialized equipment to further evaluate it. Examples that could indicate a bomb include unexplainable wires or electronics, other visible bomb-like components and unusual sounds, vapors, mists or odors.   Anything that is Hidden, Obviously suspicious, and not Typical (HOT) should be deemed suspicious. In addition, potential indicators for a bomb are threats, placement, and proximity of the item to people and valuable assets. The term Improvised Explosive Device (IED) has long been associated with war, but easy access to instructions and ingredients has resulted in numerous incidents involving the use of IEDs in the United States. IED attacks remain the primary tactic for terrorists seeking a relatively uncomplicated, inexpensive means for inflicting mass casualties and maximum damage. A series of bombings in Seaside Park, NJ and New York City in September, 2016 targeted a charity race and a Manhattan neighborhood. Unexploded devices including a pressure cooker were found at both the New Jersey and New York City bombing sites.

Differentiating Between Unattended and Suspicious

Not all unattended items are suspicious. An unattended item is an item of unknown origin and content where there are no obvious signs of being suspicious.  If not suspicious, there is no need for facility search or evacuation. Evaluate the item using the U.S. Postal Service "Suspicious Mail" poster (below) to determine if it meets "suspicious" criteria. Consider the placement of the package and its proximity to people and valuable assets and the current threat environment. Consider the following factors: Was any suspicious activity reported when the package was left or discovered? Have any threats to the receiving organization or similar organizations been reported? Is the unattended package or bag consistent with those normally expected to be found in the building? Does the unattended package or bag have any external indicators consistent with a suspicious package? If package is not considered an immediate threat to health or safety, record the name and address of the addressee and sender; post office codes, stamps, and cancellation date; and any other markings or labels. Contact the addressee to determine if the package was expected.

Figure 1. Suspicious Mail Poster 84 (U.S. Postal Service)

Emergency Response to Suspicious Packages

If a package is deemed "suspicious," the following action should be taken: Notify security that a suspicious package has been detected. Alert everyone in adjacent areas that a suspicious letter or package has been found and direct them to clear the area.  If the suspicious item is believed to be a bomb, evacuate the building.  Anyone in contact with any powder or substance believed to have been released from the package should seek decontamination immediately and should segregate from others not exposed. Shut down the building's ventilation system if shutdown can be done safely. If package is not deemed an immediate threat to health or safety, document the reasons for identifying the package as suspicious. Without making direct contact with the suspicious item, record all available information from all sides including name and address of addressee and sender, post office codes, stamps, and cancellation date, any other markings or labels found on the item, any other peculiarities (stains, tears, tape, flaps not glued). If possible, photograph from all sides without moving. Contact the addressee to determine if package was expected. If the package cannot be verified as legitimate within a reasonable period, notify police.

Emergency operations plans should include instructions for employees as well as those responsible for managing emergencies. Procedures should be clear and concise and align with your organization's incident management system. Figure 2 is an example from Preparedness, LLC's flowchart-based emergency operations plans. Flowcharts, hazard precautions, and defined roles and responsibilities are compiled in hard-copy and digital format with hyperlinks for quick navigation to all related guidance.

Figure 2. Emergency procedures flowchart from Preparedness, LLC's emergency operations plan.