Suspicious Vehicles

It's been three days since the Christmas morning bombing in Nashville, a city, for obvious reasons, that is near and dear to my heart.

As we learn more about the incident, it becomes clear that some of the witnesses were keen to report certain suspicious indicators about the vehicle. So, in keeping with that, I'd like to introduce a little playbook on identifying suspicious packages and vehicles, and steps you can take to protect your facility. At the end of each segment is a handy little table for you to reference.

A suspicious package is an unattended item of unknown origin.  To determine if a package is suspicious, consider its origin:

• Observe intentional, or seemingly accidental or neglectful placement of the item in a well-trafficked or crowded area (like a food court), or by a sensitive site (such as a gas main).  
• Observed behavior of individuals with backpacks, suitcases, briefcases, and shopping bags that are for stores that are not in the mall:
• If an individual wears sunglasses and a hat or hood inside while carrying a heavy backpack
• Is looking for cameras or monitoring security patrol routes and timing and when the mall is most crowded, he or she may be conducting a rehearsal or even executing a suspicious package or bomb/IED attack.
• If the individual heads directly and deliberately for a crowded area.

If a suspicious package is observed or reported, security personnel should immediately investigate, isolate, and cordon off the area until it has been confirmed to be a non-issue, using the following steps:

• Utilize CCTV to observe the package and surrounding area, if possible.
• Upon observance or report of a suspicious package, the nearest officer will respond to the scene to confirm its presence.
• A second officer will help secure the location and alert leadership.
• Upon arrival, responding officers will clear out a small area around the package and, most importantly, NOT TOUCH IT UNDER ANY CIRCUMSTANCES.
• Maintain a safe distance and visually search for wires and odd lumps, wetness, or signs of tampering.  Use the CCTV system to enhance the image, if possible.
• Record odd smells and attempt to determine its origin through interviewing potential witnesses and bystanders.

Do not use cell phones or radios in the immediate area.  I cannot stress this enough.

If the package remains suspicious in nature (such as the owner of a backpack not returning to pick it up or calling into security or concierge for the lost and found, or wires and/or odd protrusions are found), dispatch will call 9-1-1 and the security leadership will notify facility management immediately.

• Call 9-1-1 from a landline, if possible.  This allows emergency services to locate your position faster if you are unable to give the address. Additionally, it goes to the local switching network, run by the police department or county sheriff, while calls made from a mobile phone are normally routed through the highway patrol or state troopers and could trigger a detonation by hitting the right frequency.
• Available officers will report to the scene and cordon off the area.
• The facility manager must order an immediate evacuation of the affected area, or a general evacuation of the facility.

Avoid possible trip-wires, pressure plates, and other victim-based triggers by moving people in the following way:

• A deliberate, controlled manner,
• Through the widest paths and doors,
• Avoiding turns, blind-spots, and locked doors.

Bad news doesn't age well, so the building manager should notify his or her supervisor immediately.

• Security officers shall evacuate all patrons and employees from the affected area(s) without undue risk to safety.
• If possible, utilize building maintenance and cleaning personnel to assist in guiding tenants, guests, and/or employees out of the facility.
• If evacuating isn't safe, conduct the proper shelter-in-place procedures. Stay away from windows and glass sculptures, 85% of all civilian casualties of bombings are due to glass fragments.
• Security officers shall escort evacuees to designated safe areas.
• Facility managers must then inform their immediate supervisor of the completion of evacuation.

Incident Management

In the event that this escalates from a report to a definite incident, as opposed to a non-issue, all employees must relocate to safe area (primary, secondary, or alternate safe area) if necessary to establish an incident command post. We can go into incident management and integrating your team into unified command on another post.

If possible, give your first responders access to CCTV. There are a myriad of ways to do that.

Help resolve the incident faster by providing first responders with as much detail as possible:

• Location of the package(s)
• Description of package(s)
• Color
• Size
• Container (backpack, garbage bag, etc.)
• Scent(s) if any
• Exposed wires
• Lumps, bumps and other protrusions
• Electronics (cellphone, antenna, watch or timer)
• Identify the individual(s) who left the suspicious package
• Number of observed persons involved
• Description of individual(s)
• MALE  / FEMALE
• Clothing
• Race/Ethnicity
• Approximate age
• Physical attributes (facial hair, tattoos, piercings, hair color/style)
• Equipment
• Visible weapons (handgun/rifle/shotgun – type, if known; knives or clubs)
• Identifiable explosives (grenades, molotov cocktails etc.)
• Electronic equipment (cell phones, radios, remotes)
• Other observations
• Last known location
• Direction of travel (FROM) / (TO)

Suspicious Vehicles

When faced with a suspicious vehicle, the same steps in managing the incident listed above apply, however there are additional pieces of information to gather. Note, not every suspicious vehicle is going to be a car bomb, or vehicle-borne improvised explosive device. Sometimes, a dingy car is a dingy car. Other times, it could be used for scouting for other, more "quotidian" crimes like robberies, kidnappings, etc. The same principles apply, though.

• Location of the vehicle (s)
• Description of vehicle(s)
• Make
• Model
• Color
• Year (if known)
• License plate state and number
• Aftermarket parts (e.g. rims, spoilers, extra lighting)
• Unusual Features
• Dents, scratches, and other body damage
• Exposed wires
• Weighted down (riding unusually low)
• Visible packages or unusual containers
• Smells
• Smoke or flame
• Timer sound or connected phone?
• Is the vehicle occupied?
• Identify individuals possibly associated with the vehicle
• Number of persons involved
• Description of individual(s)
• MALE  / FEMALE
• Clothing
• Race/Ethnicity
• Age
• Physical attributes (facial hair, tattoos, piercings, hair color/style)
• Equipment
• Visible weapons (handgun/rifle/shotgun – type, if known; knives or clubs)
• Identifiable explosives
• Electronic equipment
• Other
• Last known location
• Direction of travel (FROM)_____________________(TO)_____________________
• Activity (observation, phone calls, radios, praying, video games, etc.)
• Known hazards to first responders (live wires, spills, active kitchen areas)