Chapter 10

Counter terrorism protective security

Chapter objectives

This chapter provides guidelines for prevention measures and responses to terrorism attack.

Recent horrific terrorist incidents indicate that terrorists are targeting crowded places, and
attacks on festivals and events are a real and serious danger. Terrorists generally select
targets where they can cause most damage, inflict mass casualties or attract widespread
publicity. Terrorism also includes threats or hoaxes designed to frighten and intimidate. Any
event could be the target of a terrorist incident. This might include having to deal with a
bomb threat or with suspect items left in or around the event area. In the worst case scenario
staff and attendees could be killed or injured, and the venue destroyed or damaged in a ‘no
warning’, multiple and coordinated terrorist attack.

At all events there may be a risk of a terrorist attack either because of the nature of the event
or the number or nature of the people who host or attend it. The threat exists irrespective of
size and capacity of an event and is not specific to any particular type of event. Smaller
events in locations with limited protective security measures are possibly at higher risk than
well protected mega events such as the Olympic Games. An attack on a food fair held in a
town square is easier to accomplish than an attack on a football final in a stadium, and holds
the same potential for mass fatalities and casualties.

Attacks by international terrorists are more likely to involve the use of improvised explosive
devices, of which the three main types are, person-borne (suicide devices on the person or
bag carried device), vehicle-borne (which may be suicide or non-suicide devices), hand
delivered or placed devices (non-suicide devices initiated typically by timer or remote
control). When suicide tactics are employed they allow terrorists to deploy their device
(person or vehicle-borne) at the optimum time and place to maximise the impact in locations
where a non-suicide device might be discovered. But terrorists are innovative and their
methodology can be expected to change over time. Other means of terrorist attack (such as
chemical, biological, radiological, or firearms) are also possible and protective security
measures can help make a difference.

Terrorism risk is seen as uncontrollable (Sheppard 2011) which may add to the level of fear
experienced. Terrorism implies intentionality, vulnerability and psychological impact
(Goldstein 2005) and also includes a threat of further activity. Therefore it creates more fear
and anxiety than other emergencies that may have similar actual consequences. Fear and
misconceptions may lead people to place themselves in greater danger than that posed by
the original incident itself (Gray and Ropeik 2002).

Counter terrorism protective security advice for major events

Prevention of, and responding to, terrorism emergencies is complex and challenging. They
are low probability but high risk incidents. They often have no clear boundaries in time and
no clear zones of danger and safety. Attacks can be difficult to identify at an early
preventable stage, and may call for a large scale response and high capacity from multiple
response organisations. And often there are large gaps between advised and real behaviour
in terrorism emergencies (Rodgers et al. 2007). It is essential that protective security is
undertaken in partnership with the police and other authorities. Preparation and mitigation
calls for high level co-operation between expert agencies and experts and the event’s
security team.

The National Police Chief Council (NPCC) is a UK counter terrorism organisation that can
call on the experience of many decades in counter terrorism and protective security by UK
police that began with the bombing campaign by the IRA in the 1960s and continues today
with attacks from al Qaeda and ISIS. Its advice and guidance to public organisation is
provided through the National Counter-Terrorism Security Office (NaCTSO) website. On the
site can be found current threat levels and constantly updated advice on all terrorism
matters. The bulk of the material in this chapter is from the NaCTSO 2009/2014 publication
Counter Terrorism Protective Security Advice

Definition box 10.1: Glossary of terms

Active shooter: A person armed with a firearm who is actively engaged in killing or
attempting to cause serious harm to multiple people in a populated location.

Emergency management: The plans, structures and arrangements that are established to
bring together government, voluntary and private agencies in a coordinated way to deal with
emergency needs, including prevention, response and recovery.

Evacuation: The process of relocating people from dangerous or potentially dangerous areas
to safer areas. The purpose of an evacuation is to use distance to separate people from the
danger created by the emergency.

Mitigation: Measures taken before, during or after a disaster (emergency) to decrease or

eliminate its impact on society (people) and the environment (places).

Places of mass gathering (PMG): Are characterised by having a large concentration of

people on a predictable basis, and include a diverse range of facilities and sites such as
sporting venues, shopping/business precincts, public transport hubs and
tourism/entertainment venues.

Police first responder: The general-duties, uniformed police that often provide the initial
policing response to calls for police assistance.

Police Tactical Group (PTG): A highly trained police unit that tactically manages and resolves
high-risk incidents, including terrorist incidents.

Rapid deployment: The swift and immediate deployment of emergency services personnel to
an ongoing situation where delayed deployment could result in serious injury or death.

Situational awareness: The ability to quickly recognise and interpret an event, make sound
decisions based on those interpretations, and establish early, effective and continuous lines
of communication between the incident site and the controlling agency in order to provide
ongoing accurate information about the situation to responders.
Terrorist act: An act or threat committed with the intention of advancing a political, ideological
or religious cause, and which is intended to coerce or intimidate an Australian government, a
foreign government, or sections of the public, which causes serious physical harm or death
to a person, endangers a person’s life, causes serious damage to property, creates a serious
risk to the health and safety of the public, or seriously interferes with, seriously disrupts, or
destroys, an electronic system.

Australia–New Zealand Counter-Terrorism Committee (2015).

for Major Events. Some of the newer material is from ‘Recognising the terrorist threat’
downloaded from the [Link] website (NaCTSO/[Link] 2017). Other material is from
publications by the Australia–New Zealand Counter-Terrorism Committee, and the US
Department of Homeland Security.

Managing the terrorism risks

Not all risks or emergencies can be prevented, so the concept of prevention needs to have a
much broader meaning, and should encompass activities that may reduce the severity or
impact of the emergency. General prevention related activities can include gathering and
analysing intelligence, developing strategies to reduce the impact on life/property and
identifying or eliminating vulnerabilities at potential target event sites.

Events differ in many ways including size, location, layout and operation. Not all will share
the same risk profile or have similar vulnerabilities, so the principle of ‘proportionality’ should
generally be applied to any prevention-related activities. This means that protective security
measures not only need to be proportionate to the level of assessed risk, but should also try
to strike a balance between the threat to public safety and the expectations of the
community. However, when measuring proportionality it should be recognised that
prevention and mitigation measures for countering terrorism will also help against other
threats, such as theft and criminal damage.

At some events there will be an expectation from the general public that security measures
will be in place. Equally, an event may take place at a location or in premises where access
control and elevated security are an unexpected and unusual (and initially unwelcome)
feature. This does not negate responsibility to ensure appropriate security measures are in
place.

Of course there is a need to make events as accessible as possible and to ensure there is a
welcoming atmosphere within event arenas. The guidance in this chapter is not intended to
create a ‘fortress mentality’. There is however a balance to be achieved and there are robust
protective security measures available to mitigate against the threat of terrorism which
should integrate wherever possible with existing security.

Protective measures
Managing the risk of terrorism is a part of an event manager’s responsibility when preparing
contingency plans in response to any incident in or near an event. In regard to protective
security, the best way to manage the hazards and risks to an event is to start by
understanding and identifying the threats to it, and its vulnerability to those threats. This will
help to decide what type of security and contingency plans need developing.

For some organised events, simple good practice – coupled with vigilance and well
exercised contingency arrangements – may be all that is needed. If, however, if there is an
assessment that the event is vulnerable to attack, appropriate protective security measures
should be applied to reduce the risk to as low as reasonably practicable.

Step one: identify the threats

Understanding the terrorists’ intentions and capabilities – what they might do and how they
might do it – is crucial to assessing threat. Seek advice from the local police Counter
Terrorism Security Advisor (CTSA) on the threat and on defensive measures. Ask the
following questions:

What can be learnt from the government and media about the current security climate, or
about recent terrorist activities?
Is there anything about the location of the event, its attendees, sponsors, contractors, and
staff, or particular activities that would particularly attract a terrorist attack?
Is there an association with high profile individuals or organisations which might be terrorist
targets?
Are procedures in place and available for deployment on occasions when VIPs attend the
event?
Could collateral damage occur from an attack on, or other incident to a high risk neighbour?
What information is available from the local police service about crime and other problems in
the area of the event?
If the pre-event consultation suggests the event is at risk of attack, perhaps because of the
nature or location of the event, then consider what others could find out about its
vulnerabilities, such as information that is publicly available, e.g. on the internet or in public
documents that identifies installations or services vital to the continuation of the event. Take
into consideration any prestige targets that may be attractive to terrorists, regardless of
whether their loss would result in event collapse or event cancellation.

Step two: protecting and identifying vulnerabilities

Priorities for protection should fall under the following categories: people (staff, attendees,
concessionaires, contractors, general public affected by the presence of the event) and
physical assets (buildings, contents, equipment).

There will be a need to develop bespoke plans for each location in a multi-venue event.
There should already be plans in place for dealing with fire and crime, procedures for
assessing the integrity of those employed or who provide contracting, and measures to
secure the event site. There should also be measures in place to limit access into service or
back of house areas, and control vehicle access into goods and service areas.

As with step one, consider whether there is an aspect of the event or activities that terrorists
might want to exploit. How stringent are the checks on the staff and volunteers, or on your
contract personnel? Are the staff security conscious? It is important that event staff can
identify and know how to report suspicious activity.
Step three: identify measures to reduce risk
An integrated approach to security is essential. This involves thinking about physical
security, information security and personnel security (i.e. good recruitment and employment
practices). There is little point investing in costly security measures if they can be easily
undermined by a disaffected member of staff or by a lax recruitment process. Before
investing in additional security measures, review what is already in place, including known
weaknesses such as blind spots in any CCTV system. Many of the security precautions
typically used to deter criminals are also effective against terrorists. So before investing in
additional security measures, review what is already in place. There may already be a good
security regime that only needs strengthening.

Step four: review security measures and rehearse and review security and contingency
plans
Rehearsals and exercises should, wherever possible, be conducted in conjunction with all
partners, emergency services and local authorities.

Make sure that all staff understand and accept the need for security measures and that
security is seen as part of everyone’s responsibility, not merely something for security
experts or professionals. Make it easy for people to raise concerns or report observations.

Threat levels
Globally, most countries have a government public access website that provides current
information about the national terrorism threat level. For example In the UK it is the MI5 –
Security Service Home Office and UK Intelligence Community websites. In the US the
Department of Homeland Security provides the same service.

Terrorism threat levels are designed to give a broad indication of the likelihood of a terrorist
attack (Table 10.1). They are based on the assessment of a range of factors including
current intelligence, recent events and what is known about terrorist intentions and
capabilities. This information may well be incomplete and decisions about the appropriate
security response should be made with this in mind.

‘Substantial’ and ‘Imminently severe’ both indicate a high level of threat and that an attack
might well come without warning.

Response levels
Response levels provide a broad indication of the protective security measures that should
be applied at any particular time. They are informed by the threat level but also take into
account specific assessments of vulnerability and risk.

Response levels tend to relate to sites, whereas threat levels usually relate to broad areas of
activity. There are a variety of site specific security measures that can be applied within
response levels, although the same measures will not be found at every location. The
security measures deployed at different response levels should not be made public, to avoid
informing terrorists about what we know and what we are doing about it.

Table 10.1 UK threat level definitions

Critical An attack is expected
Imminently severe An attack is highly likely
Substantial An attack is a strong possibility
Moderate An attack is possible but not likely
Low An attack is unlikely
There are three levels of response which broadly equate to threat levels as shown below:

‘Critical exceptional’: Maximum protective security measures to meet specific threats and to
minimise vulnerability and risk.
‘Severe substantial’ to ‘heightened’: Additional and sustainable protective security measures
reflecting the broad nature of the threat combined with specific business and geographical
vulnerabilities and judgements on acceptable risk.
‘Moderate low’ to ‘normal’: Routine baseline protective security measures, appropriate to the
event and location.
The counter measures to be implemented at each response level are a matter for individual
event organisations and will differ according to a range of circumstances. All protective
security measures should be identified in advance of any change in threat and response
levels and should be clearly notified to those staff who are responsible for ensuring
compliance.

Protective security planning

The following advice is generic for most events, but recognises that every event is built and
operates differently. In the UK, advice and guidance on searching should be available
through the local police security coordinator (SecCo), CTSA or police search adviser
(PolSA).

It is recognised that for many larger organised events responsibility for the implementation of
protective security measures following a vulnerability and risk assessment will fall on a
security manager within the organisation team, who must have sufficient authority to direct
the action taken in response to a security threat. Depending on the size of the event this role
may be performed by more than one person and could be referred to in different job titles.

The security manager must be involved in the planning of the event’s perimeter security,
access control, contingency plans etc., so that the terrorist dimension is taken into account.
The security manager must similarly be consulted over any temporary construction for the
event and/or liaise with security personnel for any building used for the event so that counter
terrorism recommendations, e.g. concerning surveillance, physical barriers can be factored
in, taking into account any planning and safety regulations covered in police guides as well
as any appropriate fire safety regulations.

The security manager at most organised events should already have responsibility for most
if not all of the following key areas:

the production of the security plan based on the risk assessment

the formulation and maintenance of a search plan
the formulation and maintenance of other contingency plans dealing with bomb threats,
suspect packages, protected spaces and evacuation
liaising with the police, other emergency services and local authorities
arranging staff training, including his/her own deputies and conducting briefings/debriefings
conducting regular reviews of the plans.
For independent and impartial counter terrorism advice and guidance that is site specific, the
security manager should establish contact with the local police counter terrorism security
adviser (CTSA) to assess the threat, both generally and specifically. A counter terrorism
security adviser can assist with undertaking a risk and vulnerability assessment that is
specific to the event, and identify a range of practical protective security measures
appropriate for each of the response levels.

Contact a counter terrorism security advisor (CTSA) through the local police force at the start
of the process. As well as advising on physical security, they can provide information about
professional bodies that regulate and oversee reputable suppliers. Local police security
coordinators (SecCo) may be allocated to give security advice to large events, liaising with
CTSAs for specialist advice on physical security measures.

It is important to obtain advice on physical security equipment being planned for use at the
event and its particular application to the methods used by terrorists. The CTSA will be able
to comment on its effectiveness as a deterrent, as protection and as an aid to post-incident
investigation.

The CTSA will also:

facilitate contact with emergency services and local authority planners to develop
appropriate response and contingency plans
identify appropriate trade firms for the supply and installation of security equipment
offer advice on search plans
assist contacting a police security coordinator (SecCo) for advice if appropriate.
Creating the security plan
When creating the security plan, consider the following:

details of all the protective security measures to be implemented, covering physical,

information and personnel security
instructions on briefing content to security staff including type of behaviour to look for and
methods of reporting
instructions on how to respond to a threat (e.g. telephone bomb threat)
instructions on how to respond to the discovery of a suspicious item or event
evacuation response to a major incident
event continuity plan – i.e. when to call off the event
a communications and media strategy which includes handling enquiries from concerned
family and friends.
Effective security plans are simple, clear and flexible, but must be compatible with any
existing plans for premises/locations used for events, e.g. evacuation plans and fire safety
strategies. Everyone must be clear about what they need to do in a particular incident. Once
made, the plans must be followed. Successful security measures require:

the support of senior management

staff awareness of the measures and their responsibility in making them work
a senior, identified person within the organisation having responsibility for security.
All necessary regulations will need to be met, such as local authority permissions, health and
safety and fire prevention requirements. While it is important not to delay the introduction of
necessary equipment or procedures, costs may be reduced if the premises or location to be
used already has the necessary security which can be easily integrated within the event
security plan.

Staff security awareness

The vigilance of staff (including concessionaire, cleaning, maintenance and contract staff) is
essential for protective measures. They will know their own work areas very well and should
be encouraged to be alert to unusual behaviour or items out of place. They must have the
confidence to report any suspicions, knowing that reports, including false alarms, will be
taken seriously and regarded as a contribution to the safe running of the event.

Training is therefore particularly important. Staff should be briefed to look out for packages,
bags or other items in odd places, carefully placed (rather than dropped) items in rubbish
bins and unusual interest shown by strangers in less accessible places. Review plans for
protecting staff and visitors in the event of a terrorist threat or attack.

Any lack of vigilance around pedestrian and vehicle entrances to the event and queues
forming outside the main event area affords anonymity to a potential terrorist. Security staff
deployed externally should adopt a ‘see and be seen’ approach and where possible
supervise queuing outside the event. The queue should be orderly, monitored by CCTV
operators if available and communication between attendees and staff established. This is
especially important if large numbers of persons are expected to queue to enter an event.
Consider staging the queuing process to ensure security staff are given the opportunity to
scrutinise every attendee as they enter the event site. Staff must be briefed on what to look
for and how to deal with it.

Improvised explosive devices

Improvised explosive devices (IEDs) range in size from person-borne small containers,
rucksacks and suitcases to larger devices, such as those that are vehicle-borne. The latter
may be borne by a variety of vehicles, ranging from bicycles and motorcycles through to
large goods vehicles (LGVs).

Once assembled, the bomb can be delivered at a time of the terrorist’s choosing and with
reasonable precision, depending on defences. It can be detonated from a safe distance
using a timer or remote control, or can be detonated on the spot by a suicide bomber.
Building a bomb requires a significant investment of time, resources and expertise. Because
of this, terrorists will seek to obtain the maximum impact for their investment.

Explosive effects of a bomb

A homemade bomb can cause havoc in large crowd, primary and secondary devices can be
devastating not just in terms of immediate damage but driving the crowd to narrow confined
spaces. When an explosion occurs at ground level there are several effects created that
cause damage and injury. The effects will depend on the power, quality, quantity and location
of the explosive material deployed. The six basic effects of an explosion are:
Blast wave: the blast wave is a very fast moving high pressure wave created by the rapidly
expanding gas of the explosion. The pressure gradually diminishes with distance but can
reflect and diffract around structures.
Fire ball: the fire ball is created as part of the explosion process and is local to the seat of the
explosion. It is generally associated with high explosives.
Brisance: this is the shattering effect, is very local to the seat of the explosion and is
generally associated with high explosives.
Primary fragments: these are parts of the device or its container (including the vehicle if
vehicle-borne) which have been shattered by the brisance effect and are propelled at high
velocity over great distances.
Secondary fragments: these are fragments that have been created by the blast wave.
Typical secondary fragments include glass, roof slates, loose gravel, timber and metal.
These can travel considerable distances.
Ground shock: this is produced by the brisance effect of the explosion shattering the ground
local to the seat of the explosion, i.e. creating a crater. The shock wave resulting from the
crater’s creation then continues through the ground.
Causes of fatalities, injuries and damage from blasts
The main causes of fatalities, injuries and damage as a result of an IED are:

direct weapon effects including primary fragments, lung blast damage, thermal burns and
ear drum rupture; secondary fragments such as glass, spall (flakes of material that are
broken off a larger solid body) and other objects thrown by the blast
structure collapse causing crush injuries
post-event falling debris (including glazing, façade, internal walls etc.), damaged equipment
and damaged infrastructure, which can hinder the speedy evacuation of buildings.
Controls
By identifying the areas that would be the most vulnerable, and therefore the most
dangerous, security specialists can highlight where additional countermeasures, surveillance
and management can be best deployed.

Ensure that all staff are trained in bomb threat handling procedures or at least have ready
access to instructions and know where these are kept. Train and rehearse your staff in
identifying suspect vehicles, and in receiving and acting upon bomb threats. Key information
and telephone numbers should be prominently displayed and readily available.

Protocols applicable to most incidents

Do not touch suspicious items.
Move everyone away to a safe distance.
Prevent others from approaching.
Communicate safely to staff, business visitors and the public.
Use hand-held radios or mobile phones away from the immediate vicinity of a suspect item,
remaining out of line of sight and behind hard cover.
Notify the police.
Ensure that whoever found the item or witnessed the incident remains on hand to brief the
police.

Site search
Searches of the event area for suspicious items should be conducted as part of a daily good
housekeeping routine. They should also be conducted in response to a specific threat and
when there is a heightened response level. As previously mentioned under Security
Planning, it is recognised that for the majority of events responsibility for the implementation
of any search planning, following a vulnerability and risk assessment, will fall upon the
security manager.

Search plans
Search plans should be prepared in advance and staff should be trained in them. The overall
objective is to make sure that the entire area, including grounds, are searched in a
systematic and thorough manner so that no part is left unchecked. After an evacuation of the
event in response to an incident or threat, there will be a need to search the event site in
order to ensure it is safe for re-occupancy.

The police will not normally search events. They are not familiar with the layout and will not
be aware of what should be there and what is out of place. They cannot, therefore, search
as quickly or as thoroughly as a member of staff or on-site security personnel. The members
of staff nominated to carry out the search do not need to have expertise in explosives or
other types of device. But they must be familiar with the place they are searching. They are
looking for any items that should not be there, that cannot be accounted for and items that
are out of place. Vehicles, packages, luggage left unattended.

Ideally, searchers should search in pairs to ensure searching is systematic and thorough.
The searchers need to get a feel for the logical progression through their designated area
and the length of time this will take. They also need to be able to search without unduly
alarming any person on site. The search plan should have a written checklist, signed when
completed, for the information of the event security manager.

For the search, divide the event site into sectors of manageable size. A site is usually
organised into entrance and walkways, auditoriums, stage and back stage areas, and
service areas. Each should be identified as separate search sectors. Include any stairs, fire
escapes, corridors, toilets and lifts in the search plan, as well as car parks, service yards and
other areas outside, including evacuation assembly areas. Temporary information stands,
concessionaires and kiosks should be searched before and after use and secured or moved
when unattended. Waste bins require particular attention.

Following the search, staff should lock unoccupied offices, rooms and store cupboards; and
place tamper-proof plastic seals on maintenance hatches.

Bomb threat
The vast majority of bomb threats are hoaxes designed to cause alarm and disruption. As
well as the rare instances of valid bomb threats, terrorists may also make hoax bomb threat
calls to intimidate the public, businesses and communities, to draw attention to their cause
and to mislead police. While many bomb threats involve a person-to-person phone call, an
increasing number are sent electronically using email or social media applications (e.g.
Twitter or Facebook). A threat may be communicated via a third-party, i.e. a person or
organisation unrelated to the intended victim and identified only to pass the message.
No matter how ridiculous or implausible the threat may seem, all such communications are a
crime and should be reported to the police. Event organisation should have a protocol on
how the threat information is recorded, acted upon and passed to police.

Suicide bomb attacks

The use of suicide bombers is a very effective method of delivering an explosive device to a
specific location. Suicide bombers may use a lorry, plane or other kind of vehicle as a bomb
or may carry or conceal explosives on their persons. Suicide attacks are generally
perpetrated without warning.

Vehicle-borne improvised explosive devices (VBIEDs) are one of the most effective weapons
in the terrorist’s arsenal. They are capable of delivering a large quantity of explosives to a
target and can cause a great deal of damage. It is not just the effects of a direct bomb blast
that can be lethal, flying debris such as glass can present a hazard many metres away from
the seat of the explosion.

Controls
When considering protective measures against suicide bombers, think in terms of:

Using physical barriers to prevent a hostile vehicle from driving into the event through main
entrances, goods/service entrances, pedestrian entrances or open land.
Denying access to any vehicle that arrives at goods/service entrances without prior notice
and holding vehicles at access control points into the event until it is established that they
are genuine.
Do not allow unchecked vehicles to park within the event areas or next to public areas where
there will be large numbers of people or where there is a risk of structural collapse.
Wherever possible, establishing the vehicle access control points at a distance from the
event site, setting up regular patrols and briefing staff to look out for anyone behaving
suspiciously.
Many bomb attacks are preceded by reconnaissance or trial runs. Ensure that no one visits
the event site without proper authority and confirmed identity during the production phase.

A key strategy for minimising the effect of an attack is to prevent the attacker from reaching
the areas of the event where they can do the most harm – where the crowd is at its most
dense. The method being employed at several venues is to have the first contact with the
security personnel as far as possible from the core areas by setting a perimeter crowd
intercept fence with multiple bag and pass check gates as far as possible from the actual
venue entrance queues. Surveillance is made easier by the thinner crowds in the open
space between the perimeter fence and the venue where monitoring by CCTV and foot
patrols. It is probable that a suicide bomber will detonate his/her explosives when challenged
or detected at the check gates or in the open space, and this explosion, while devastating to
those in the immediate vicinity, will not cause the mass casualties that would ensue if they
had reached the core areas of the event.

Effective CCTV systems, especially those with an active monitoring and response, may
deter a terrorist attack or even identify planning activity. Good quality images can provide
crucial evidence in court. There is no definitive physical profile for a suicide bomber, so
monitoring staff must be vigilant and report anyone suspicious to the police.
Firearm attacks
Terrorist use of firearms has become frequent, and it is important to consider this method of
attack and be prepared to cope with such an incident. Most attacks are made using small
arms. Such attacks are popular with terrorist groups, because they are relatively easy to plan
and carry out, can cause a high number of casualties, and effectively spread terror
throughout the population.

Known terrorist groups are not the only potential source of threat. Any extremist ideology can
give rise to a lone actor, while some individuals may not be motivated by any ideology at all.
The deadliest mass casualty shooting to occur in Australia, the Port Arthur massacre in
1996, was perpetrated by an individual with no links to an extremist ideology. The Anders
Breivik terrorist attack in Norway in July 2011 demonstrates that attacks can occur without
forewarning and security services cannot guarantee alert notice of all terrorist attack
planning. It is a reminder that attacks may also be inspired by many forms of ideology and
driven by local issues.

The typical attacker, in police terminology an active shooter, will attempt to kill and injure as
many people as possible within a short period of time. This is why they generally target
places where they can achieve the greatest impact – i.e. crowded places. An active shooter
incident does not generally include a hostage situation, but can potentially transition into
one, particularly during the police resolution phase.

Most incidents can vary greatly from one attack to another. However, there are some
common elements for the majority of active shooter incidents; namely:

Incidents often occur in crowded places where the attacker can access a large number of
potential victims.
Most incidents will evolve rapidly and are often over within 10–15 minutes.
Many active shooters will continue to attempt to harm victims until confronted by law
enforcement personnel or some other type of intervention occurs.
Most incidents will not be effectively resolved through negotiation or peaceful means.
Controls
In most incidents, active shooters need freedom of movement and ready access to victims in
order to achieve their objective. Therefore, minimising the offender’s access to potential
victims should be the primary objective of any plans or strategies. This is most likely to be
achieved through the following activities:

initiating immediate response activities

minimising the duration of the incident
restricting the offender’s movements
moving people from danger
preventing people from entering the scene
helping police to locate and contain the shooter.
Shooter’s Time + Freedom of Movement = Increased Casualties
For most types of hostile attacks, prevention activities should aim to deter a would-be
attacker by providing obvious physical and electronic security measures, coupled with good
risk management practices that:

detect an intrusion – by providing alert and visual detection systems

delay or limit the intrusion for a sufficient period to allow a response force to attend – by
putting in place measures that will potentially limit the movement of the offender.
Prevention-related activities specifically aimed at mitigating or reducing the severity of the
incident should also be considered. The main focus of those activities should be on
restricting the movement of the offender/s while reducing their access to further victims. How
to best achieve this will depend on many variables, such as the physical design and security
features of the venue, the movement of the offender and the opportunities for escape/shelter
in place.

The US Department of Homeland Security has developed the Active Shooter: How to
Respond guide that is widely used internationally and outlines three key areas of focus.

Escape: Building occupants should consider evacuating the facility if it is safe to do so. They
should leave behind most belongings and determine the safest escape route before
beginning to move. Maintaining concealment or cover from gunfire while moving is also
important.
Hide: If safely evacuating the venue is not possible, occupants should seek to hide in a
secure area where they can lock the door, lock or blockade the door with heavy furniture,
cover windows, turn off lights and remain silent. Mobile phones should also be turned to
silent.
Take action: If the option of hiding in place is adopted, individuals should continually
re-assess the situation and their opportunities to safely evacuate or better secure
themselves within the premises. They may also need to consider options to incapacitate the
active shooter in the event they are located. This can include using or throwing available
objects or using aggressive force when confronted. Such action should only be taken as a
last resort and in order to protect the life of the individual or others in that area.
Staff protocols for a firearms/weapons incident
Run to a place of safety.
Good cover: Bad cover:
• Substantial brickwork or concrete • Internal partition walls
• Engine blocks • Car doors
• Base of large live trees • Wooden fences
• Natural ground undulations • Glazing
Hide. Lock the doors if possible and remain quiet. As far as possible, limit access and secure
the immediate environment. Encourage people to avoid public areas or access points. Find
the best available protection from ballistics. Remember, out of sight does not necessarily
mean out of danger.
Tell. Immediately contact the police and the control room.
Report: exact location of the incident, number of gunmen, type of firearm – are they using a
long-barrelled weapon or handgun? Direction of travel – are they moving in any particular
direction?
Use all the channels of communication available to inform visitors and staff of the danger.
Police response
Due to the dynamic nature of active shooter incidents, highly trained and equipped police
tactical group operators may be unable to respond to a scene in a timely manner. As such,
uniformed, general-duties police officers will generally provide the initial response to most
active shooter situations and may potentially manage them to their conclusion. While the
specific tactics, policies and training of police first responders may vary across jurisdictions,
it is expected that the following objectives will guide their initial response activities.

Mission
The main objective of the police first responders in an active shooter incident is to save lives
and prevent further loss of life or injuries. This will generally be achieved through a rapid
deployment strategy.

The focus of a rapid deployment strategy should be to reduce or suppress the threat posed
by the active shooter as quickly as possible. Cordon, manage and negotiate strategies are
unlikely to be effective in reducing the time a shooter has to achieve their desired outcomes,
or limiting their freedom of movement. The most appropriate response to an active shooter
incident will also depend on many other factors, including available police resources, the
incident setting and the tactics or weapons involved.

Locate and isolate

Once the decision to rapidly deploy has been made, the focus will generally be on how to
reduce the offender’s area of operation and access to potential victims. This is best achieved
by quickly locating the offender and restricting their movement. To achieve this, first
responders may initially need to keep moving past casualties and panicked people to try and
reach the offender and contain the threat as quickly as possible.

Command and control

Any response to a major emergency or incident should be managed by an appropriate
command, control and coordination structure. In active shooter situations, however, this
might not be achievable in the first instance as it may affect any rapid deployment activities.
The need to establish effective command and control of the incident, including coordination
with venue management, may therefore become a secondary priority that is delegated to
subsequent responding units.

Police will conduct some form of major investigation for all active shooter incidents. This
could involve criminal and forensic investigations in relation to potential criminal offences
(including acts of terrorism), as well as coronial investigations on behalf of the coroner.
These investigation processes will need to be extremely thorough and may often be
protracted, particularly where the incident has occurred over a broad geographical area, or
involves significant forensic challenges.

During the investigation phase the police may also seek assistance from management at the
location to help identify potential sources of evidence or witnesses. This could include CCTV
footage, and radio, telephone or decision-making logs. Recovery or business continuity
plans should identify a suitable liaison officer that can work with the police to help facilitate
these types of requests.
Protected spaces
Depending on the layout of the event, in a bomb threat or firearm attack, evacuation may be
safer into windowless corridors or basements than outside the building, which is the normal
case in emergencies. Protected spaces in permanent structures may offer the best
protection against ballistics, bomb blast, flying glass and other fragments. They may also
offer the best protection when the location of the active shooter or possible bomb is
unknown, or when the threat is near the external evacuation route, or when there is an
external attack. Since glass and other fragments may kill or maim at a considerable distance
from the centre of a large explosion, moving people into protected spaces is often safer than
evacuating them onto the streets. Protected spaces should be located:

in areas surrounded by full height masonry walls e.g. internal corridors, toilet areas or
auditoriums with doors opening inwards
away from windows and external walls
away from the area in between the building’s perimeter and the first line of supporting
columns (known as the ‘perimeter structural bay’)
away from stairwells or areas with access to lift shafts where these open at ground level onto
the street, because blast can travel up them. If, however, the stair and lift cores are entirely
enclosed, they could make good protected spaces
avoiding ground floor or first floor if possible
in an area with enough space to contain the occupants.
When choosing a protected space, seek advice from a structural engineer with knowledge of
explosive effects and do not neglect the provision of toilet facilities, seating, drinking water
and communications. Try to locate vital emergency control systems in part of the event site
that offers similar protection to that provided by a protected space.

Open air events

If the event is predominantly in the open with only temporary demountable structures such
as marquees, event kiosks or simply an open space, the protected space principle is unlikely
to offer any suitable refuge and evacuation may be the only option.

Suspicious deliveries
Events often necessitate receiving a wide variety of deliveries. This offers an attractive route
into premises for terrorists. Delivered items, which include letters, parcels, packages and
anything delivered by post or courier, has been a commonly used terrorist device. Delivered
items may be explosive or incendiary (the two most likely kinds), or chemical, biological or
radiological.

Consider the need for a screening process at the delivery handling site, whether at a
temporary or permanent structure. Anyone receiving a suspicious delivery is unlikely to know
which type it is, so protocols and procedures should cater for every eventuality.

Delivered explosive or chemical devices come in a variety of shapes and sizes; a well-made
one will look innocuous but there may be tell-tale signs.

Indicators of suspicious deliveries/mail

It is unexpected or of unusual origin or from an unfamiliar sender.
There is no return address or the address cannot be verified.
It is poorly or inaccurately addressed e.g. incorrect title, spelt wrongly, title but no name, or
addressed to an individual no longer with the company.
The address has been printed unevenly or in an unusual way.
The writing is in an unfamiliar or unusual style.
There are unusual postmarks or postage paid marks.
A Jiffy bag, or similar padded envelope, has been used.
It seems unusually heavy for its size. Most letters weigh up to about 28g or 1oz, whereas
most effective letter bombs weigh 50–100g and are 5mm or more thick.
It is marked ‘personal’ or ‘confidential’.
It is oddly shaped or lopsided.
It has an unusual smell.
It is tightly taped or tied (however, in some organisations delicate equipment is often well
wrapped as standard procedure).
Controls
Although any suspect item should be taken seriously, remember that most will be false
alarms, and a few may be hoaxes. Try to ensure that procedures, while effective, are not
needlessly disruptive, take the following into account in planning:

Consider processing all incoming mail and deliveries at one point only. this should ideally be
off-site or in a separate building, or at least in an area that can easily be isolated and in
which deliveries can be handled without taking them through other parts of the event or site.
Ensure that all staff who handle deliveries are briefed and trained.
Make certain that delivery opening areas can be promptly evacuated. Rehearse evacuation
procedures and routes.
Prepare signs for display to staff in the event of a suspected or actual attack.

Chemical, biological or radiological material attacks

Terrorists may seek to place chemical, biological or radiological (CBR) materials into the
event site. There have only been a few examples of terrorists using CBR materials. The
most notable were the 1995 sarin gas attack on the Tokyo subway and the 2001 anthrax
letters in the United States. In 1996 in the US, an Al-Qaeda operative was sentenced for
conspiracy to murder for his part in planning attacks using ‘dirty bombs’, which contained
radioactive material.

The impact of a CBR attack would depend heavily on the success of the chosen method and
the weather conditions at the time of the attack. The first indicators of a CBR attack may be
the sudden appearance of powders, liquids or strange smells within the building, with or
without an immediate effect on people.

It is difficult to provide a full list of possible CBR indicators because of the diverse nature of
the materials. At present, there are no CBR detectors capable of identifying all hazards
reliably. However, some of the more common and obvious are:

unexpected granular, crystalline or finely powdered material (of any colour and usually with
the consistency of coffee, sugar or baking powder), loose or in a container
unexpected sticky substances, sprays or vapours
unexpected pieces of metal or plastic, such as discs, rods, small sheets or spheres
strange smells, e.g. garlic, fish, fruit, mothballs, pepper – however, some CBR materials are
odourless and tasteless
stains or dampness on the packaging.
sudden onset of illness or irritation of skin, eyes or nose.
CBR devices containing finely ground powder or liquid may be hazardous without being
opened.

Controls
The precise nature of the incident (chemical, biological or radiological) may not be readily
apparent. Keep the response plans general and wait for expert help from the emergency
services. A full site evacuation may not be the best solution. Be guided by the emergency
services.

Staff who are responsible for delivery handling should be made aware of the importance of
isolation in reducing contamination. Where a hazard can be isolated by leaving the
immediate area, do so as quickly as possible, closing doors and windows.

Move those directly affected by an incident to a safe location as close as possible to the
scene of the incident, so as to minimise spread of contamination. Separate those directly
affected by an incident from those not involved so as to minimise the risk of inadvertent
cross-contamination. Provide washing facilities in which contaminated staff could be isolated
and treated.

Heavy vehicle attacks

A recent appalling addition to the weapons in the terrorist’s arsenal is the simple act of
driving a heavy vehicle at speed through a crowd. This type of attack usually occurs at open
events conducted on streets or pedestrian malls.

Controls
If there is a plausible threat, institute effective vehicle access controls, particularly at goods
entrances and service areas. Insist that contractor delivery vehicles and the identity of the
driver and any passengers approaching the goods/service areas are authorised in advance.
Consider a vehicle search regime at goods/service entrances that is flexible and can be
tailored to a change in threat or response level. Be suspicious of delivery vehicles or other
trucks attempting to access the main driveway to the event at the wrong time or outside of
normal hours.

Consider using robust physical barriers to keep all but authorised vehicles at a safe distance.
Wherever possible, establish the vehicle access control points at a distance from the event
site, and brief staff to look out for anyone behaving suspiciously.

Establish roadblocks along the outskirts of the event, which could cause any vehicle
attempting to breach security to crash and any other structural measures that prevent
access to, or close proximity of, unscreened vehicles to the event space, and that reduce the
speed of vehicles, such as bends or chicanes. So-called ‘hostile vehicle mitigation’ has
already seen airport approach roads rerouted away from terminal entrances, installation of
concrete bollards on sidewalks and the introduction of checkpoints away from busy
terminals.

It should be emphasised that the installation of physical barriers needs to be balanced

against the requirements of safety and should not be embarked upon without full
consideration of planning regulation and fire safety risk assessment.

A spike strip (also known as traffic spikes, or tire shredders), can be used to impede or stop
the movement of wheeled vehicles by puncturing their tyres. Generally, the strip is
composed of a collection of long metal barbs, teeth or spikes pointing upward designed to
puncture tyres when a vehicle is driven over them. There are two sizes – portable strips that
can be quickly positioned by two people are suitable for impeding cars and light vehicles,
and heavy duty strips that require installation and are intended to hinder larger vehicles.
However, the strips are only a partial control device as vehicles can still be driven on wheel
rims, albeit at a lower speed with less steering control.

It is hoped that a relatively simple technology can provide a solution. A British firm has
developed a system that can disable the engines of moving targets such as boats or cars by
emitting radio frequency pulses that overload the sensors in a vehicle’s electronic controls.
For as long as it emits the pulses, the engine cannot be restarted. The RF Safe-Stop system
created by e2v Technologies uses blasts of electromagnetic pulses to remotely shut off any
car engines that are targeted by the device. The transmitter must be mounted beside or
above a roadway and can be triggered up to 50 metres distance from the suspicious vehicle.

Hostile reconnaissance
Terrorist operatives may visit potential targets a number of times prior to the attack. Hostile
reconnaissance is used on potential targets during the preparatory and operational phases
of terrorist operations. It is conducted to obtain a profile of the target location, determine the
best method of attack and the optimum time to conduct the attack. Where pro-active security
measures are in place, they pay particular attention to any variations in security patterns and
the flow of people in and out. Reconnaissance trips may be undertaken as a rehearsal to
involve personnel and equipment that will be used in the actual attack.

The ability of the event’s security staff to recognise those engaged in hostile reconnaissance
could disrupt an attack.

What to look for

significant interest being taken in the outside of the event site including parking areas,
delivery gates, doors and entrances
groups or individuals taking significant interest in the location of CCTV cameras and
controlled areas
people taking pictures, filming, making notes or sketching of the security measures around
events
strangers walking around the perimeter of the event and being over attentive to
surroundings, persons loitering around area for a prolonged amount of time
vehicles parked outside buildings of other facilities, with one or more people remaining in the
vehicle, for longer than would be considered usual
a person parking, standing or loitering in the same area on numerous occasions with no
apparent reasonable explanation
a person asking unusual questions about number and routine of staff/VIPs visiting the site or
event
individuals asking questions regarding the identity or characteristics of individual visitors,
groups of visitors, or the jobs or nationalities of visitors, that attend or may visit the event
persons asking questions regarding security and evacuation measures
persons asking questions regarding event staff hangouts
people attempting to gain entry to the event site during the production phase using
suspicious, counterfeit, altered passes or documents etc.
non-co-operation with police or security personnel.
Those engaged in reconnaissance will often attempt to enter premises to assess the internal
layout and in doing so will alter their appearance and provide cover stories. In the past
reconnaissance operatives have drawn attention to themselves by asking peculiar and in
depth questions of employees or others more familiar with the environment.

Controls
Sightings of suspicious activity should be passed immediately to security management for
CCTV monitoring, active response where possible and the event recorded for evidential
purposes. Suspicious activity that does not require an immediate response, should be
immediately reported to the anti-terrorist hotline; for any incident that requires an immediate
response call police.

Summary
Any event could be the target of a terrorist attack. Smaller events in locations with limited
protective security measures are possibly at higher risk than well protected mega events
such as the Olympic Games.
Terrorist attacks are low probability but high risk incidents.
Attacks by international terrorists are more likely to involve the use of improvised explosive
devices, firearms or heavy vehicles.
Attacks can be difficult to identify at an early preventable stage, and may call for a large
scale response and high capacity from multiple response organisations.
Prevention of, and responding to, terrorism emergencies is complex and challenging. They
often have no clear boundaries in time and no clear zones of danger and safety.
It is essential that protective security is undertaken in partnership with the police and other
authorities and high level co-operation between expert agencies and experts and the event’s
security team.
General prevention related activities can include gathering and analysing intelligence,
developing strategies to reduce the impact on life/property and identifying or eliminating
vulnerabilities at potential target event sites.
Most countries have a government public access website that provides current information
about the national terrorism threat level.
For independent and impartial counter terrorism advice and guidance that is site specific, the
Security Manager should establish contact with the local police Counter Terrorism Security
Advisor (CTSA) to assess the threat, both generally and specifically.
The vigilance of staff (including concessionaire, cleaning, maintenance and contract staff) is
essential for protective measures. Staff should be briefed to look out for packages, bags or
other items in odd places, and unusual interest shown by strangers in the site security
arrangements.
Depending on the layout of the event, in a bomb threat or firearm attack, evacuation may be
safer into windowless corridors or basements than outside a building, which is the normal
case in emergencies.
Bibliography
Australia–New Zealand Counter-Terrorism Committee (2015) Active Shooter Guidelines for
Places of Mass Gathering. Attorney-General’s Department Commonwealth of Australia.

Bellavita, C. (2007) ‘Changing Homeland Security: A strategic logic of special event

security’, Homeland Security Affairs, 3(3), 1–23.

Department of Homeland Security (2016) Active Shooter: How to Respond Guide.

Washington, DC. Online. Available HTTP:
<[Link]

Emergency Management Australia (2004) Multi-Agency Incident ManagementManual

Number 17. Australian Emergency Manuals Series. Commonwealth of Australia.

Emergency Management Australia (2004) Emergency PlanningManual Number 43.

Australian Emergency Manuals Series. Commonwealth of Australia.

Goldstein, B. D. (2005) ‘Advances in risk assessment and communication’, Annual Review

of Public Health, 26(1), 141–163.

Goss, B. D., Jubenville, C. B. and MacBeth, J. L. (2003) Primary Principles of Post-9/11

Stadium Security in the United States: Transatlantic Implications from British Practices.
Murfreesboro, TN: Middle Tennessee State University. PRTM.

Gray, G. M. and Ropeik, D. P. (2002) ‘Dealing with the dangers of fear: The role of risk
communication’, Health Affairs, 21(6), 106–116.

NaCTSO (2009) (Partial review: 2014) Counter Terrorism Protective Security Advice for
Major Events. London: Association of Chief Police Officers of England and Wales and
Northern, Ireland (now National Police Chief Council).

NaCTSO/[Link] (2017) ‘Recognising the terrorist threat’. Online. Available HTTP:

<[Link]
-terrorist-threat>, accessed 10 May 2017.

Rodgers, M. B., Amlot, R., Rubin, G. J., Wessely, S. and Krieger, K. (2007) ‘Mediating the
social and psycological impacts of terrorist attacks: The role of risk perception and risk
communication’, International Review of Psychiatry, 19(3), 279–288.

Sheppard, B. (2011) ‘Mitigating terror and avoidance behavior through the risk perception
matrix to augment resilience’, Journal of Homeland Security Emergency Management, 8(1),
1547–7355.
U.S. Army (2008) How to Survive an Active Shooter, Fort A.P. Hill, VA: U.S. Department of
Homeland Security.