Skip to content

Protective Security Guidance - Protect from Terrorist Threats

  • Knowledge Level: Intermediate
  • Protection Stage: All Stages
  • Time to read:

This series is for anyone working in the election space, including but not limited to central or local government officials, candidates, campaigners, returning officers and polling station staff

Last Updated: 24 September 2026
Share this article:

Disrupting Hostile Reconnaissance

The threats you face will vary depending on your role: polling station staff may need to consider protest activity, campaigners may need to concern themselves with the prospect of harassment and intimidation. While these threats and their aims may vary, hostiles will want to feel confident that they are going to be successful and will therefore gather information and undertake extensive planning.

Hostile Reconnaissance 

Hostile reconnaissance is the term used to describe the purposeful observation of a specific target with the intention of collecting information to inform the planning of a hostile act against it.

In the context of hostile reconnaissance, NPSA defines deterrence as: The intelligent, co-ordinated promotion of protective security provision to the hostile that results in the perception and/or assessment that the reconnaissance or the attack itself will fail. 

Hostiles will not necessarily be deterred from a target simply because it has CCTV or guards or a particular fence or lock. Instead, an organisation needs to use these security measures in an effective manner and to then communicate them to the hostile. If a hostile believes a site has excellent security measures due to what they've read online or seen on a poster or witnessed in operation, it may be enough to deter them from their target altogether. 

Deterrence measures can be cheap, relatively easy to deploy or may just involve the more targeted deployment of existing assets. The effect should be one that deters the hostile, but has a neutral or even positive effect on your employees and visitors.

See Check and Notify logoSee, Check and Notify (SCaN) is a suite of training materials that aims to help you maximise safety and security using existing resources. 

SCaN training empowers you and your staff to correctly identify suspicious activity and know what to do when it is encountered. In addition to this, the skills learned can help provide an enhanced customer experience. It helps ensure that individuals or groups seeking to cause your organisation harm are unable to get the information they need to plan their actions. 

Election staff, particularly those who are associated with a fixed location such as an office or a polling station, may find undertaking SCaN for All Staff a useful, freely available and concise training course.

If your election-related physical location controls who can visit, we advise reviewing your visitor entry processes. Both online and physical reconnaissance are common and threat actors may look for a means to physically enter in your organisation. This isn't just on the day, but in the build-up to the election. As soon as it's known that somewhere is a polling station for instance, a hostile might start their planning. Given that polling stations are often in the same place, someone might already be undertaking reconnaissance. 

Employees tasked with document verification, whether during pre-employment screening and/or during visitor entry, must be vigilant to the threat of fraudulent documentation. 

Motivated, attentive and observant security personnel will also form a highly-effective deterrent presence and final line of defence where other interventions may have failed.

For further guidance, visit Hostile Reconnaissance.

Mail Screening and Suspect Packages

Although any suspect item should be treated seriously, remember that the great majority will be false alarms and a few may be hoaxes. Try to ensure that your procedures, while effective, are not needlessly disruptive.

General Indicators

There are some general indicators that may suggest a delivered or found item could be of concern include:

  • An unexpected item, especially if hand delivered
  • A padded envelope (‘Jiffy Bag’) or other bulky package
  • An additional inner envelope or other contents that may be difficult to remove
  • Labelling or excessive sealing that encourages opening at a particular end or in a particular way
  • Oddly shaped or lopsided packages
  • An envelope flap stuck down completely (normally gummed envelope flaps leave slight gaps at edges)
  • Being marked as ‘to be opened only by…’, ‘personal’ or ‘confidential’
  • An item addressed to the organisation or a title (rather than a specific individual)
  • Unexpected or unusual origin (postmark and/or return address)
  • No return address or return address that cannot be verified
  • Poorly or inaccurately addressed or the address is printed unevenly or unusually
  • Unfamiliar writing or unusual style
  • Unusual postmark or no postmark
  • More stamps than needed for size or weight of package
  • Letters with no stamps or postage label
  • Greasy or oily stains coming from package
  • Odours coming from package

Explosive or Incendiary Indicators

Additional explosive or incendiary indictors include:

  • Unusually heavy or uneven weight distribution
  • Small hole(s) in envelope or wrapping.

"White Powder" Indicators

Additional chemical, biological or radiological (CBR) indicators include:

  • Powders, liquids emanating from package
  • Wrapping stained by liquid leakage
  • Unexpected items or materials found in package on opening or X-raying (loose or in a container) such as powdered, crystalline or granular solids; liquids; sticky substances or residues
  • Unexpected odours observed on opening
  • Sudden onset of illness or irritation of skin, eyes or nose.

Actions Upon Discovery

If a suspicious item is delivered or found anywhere else (inside or outside) around the building – make sure you have appropriate emergency response plans in place. If you discover a suspicious item, you should follow these simple steps:

Protecting Pedestrian Queues

The risk to pedestrians from Vehicle As a Weapon (VAW) attack is a realistic possibility in the United Kingdom. VAW attacks are most successful when carried out against an area with a high density of people (e.g. a crowd) and/or where people are arranged in an easy to target line (e.g. a queue). The processing of voters at an election could lead to queuing outside the polling station, which could become a target for a VAW attack.

To minimise the risk to queues of people, organisations can take practical and achievable measures to either deter or disrupt a VAW attack. Further guidance is available at Minimising Risk to Pedestrian Queues from Vehicle as a Weapon Attack..

Recognising Terrorist Threats

The threats you face may be varied and could change rapidly. It is essential that you understand the current risks associated with your site and any vulnerabilities. 

Different attackers will use different tools and methods depending on their competence, experience and what they have available to them. Physical attacks can have different levels of sophistication and could be made up of a combination of one or more different methodologies. 

Whilst there are a significant number of possible attack methodologies, there are some methods that appear frequently, both in attacks and terrorist instructional media.

Attack Methods 

This list is not exhaustive, but identifies the most common attack methods used by terrorists in the UK 

  1. Bladed Weapons
  2. Firearms
  3. Vehicle as a Weapon
  4. Fire as a Weapon
  5. Explosives
  6. Chemical, Biological and Radiological Materials

How do I protect myself?

The detailed guidance below provides a comprehensive strategy for mitigating the risks you may face. 

It is important that you have a response plan to an attack and this plan is linked to the risks you have identified for your site. It should also link to local stakeholders, including, Police, Fire and Rescue Service, Ambulance and the Local Authority as their assistance will be integral to managing the consequences of an attack. 

Know what your thresholds are for reporting, and how and where to report incidents. Three key areas to consider are suspicious items, suspicious behaviours and prohibited items.

Additional Mitigations

It is important you are alert and vigilant, looking out for unusual activity; and that you feel empowered to report concerns. Detailed guidance on all of the above subjects and more can be found at the below further guidance link. In addition, everyone can access comprehensive election security guidance on GOV.UK. Updated regularly, this guidance brings together expertise from the across the security community including the Police, the NCSC and others to help you implement quick and effective protective security measures.

Did you find this page useful?
helpfulness rating