Disrupting Hostile Reconnaissance
The threats you face will vary depending on your role: polling station staff may need to consider protest activity, campaigners may need to concern themselves with the prospect of harassment and intimidation. While these threats and their aims may vary, hostiles will want to feel confident that they are going to be successful and will therefore gather information and undertake extensive planning.
Hostile Reconnaissance
Hostile reconnaissance is the term used to describe the purposeful observation of a specific target with the intention of collecting information to inform the planning of a hostile act against it.
In the context of hostile reconnaissance, NPSA defines deterrence as: The intelligent, co-ordinated promotion of protective security provision to the hostile that results in the perception and/or assessment that the reconnaissance or the attack itself will fail.
Hostiles will not necessarily be deterred from a target simply because it has CCTV or guards or a particular fence or lock. Instead, an organisation needs to use these security measures in an effective manner and to then communicate them to the hostile. If a hostile believes a site has excellent security measures due to what they've read online or seen on a poster or witnessed in operation, it may be enough to deter them from their target altogether.
Deterrence measures can be cheap, relatively easy to deploy or may just involve the more targeted deployment of existing assets. The effect should be one that deters the hostile, but has a neutral or even positive effect on your employees and visitors.
See, Check and Notify (SCaN) is a suite of training materials that aims to help you maximise safety and security using existing resources.
SCaN training empowers you and your staff to correctly identify suspicious activity and know what to do when it is encountered. In addition to this, the skills learned can help provide an enhanced customer experience. It helps ensure that individuals or groups seeking to cause your organisation harm are unable to get the information they need to plan their actions.
Election staff, particularly those who are associated with a fixed location such as an office or a polling station, may find undertaking SCaN for All Staff a useful, freely available and concise training course.
If your election-related physical location controls who can visit, we advise reviewing your visitor entry processes. Both online and physical reconnaissance are common and threat actors may look for a means to physically enter in your organisation. This isn't just on the day, but in the build-up to the election. As soon as it's known that somewhere is a polling station for instance, a hostile might start their planning. Given that polling stations are often in the same place, someone might already be undertaking reconnaissance.
Employees tasked with document verification, whether during pre-employment screening and/or during visitor entry, must be vigilant to the threat of fraudulent documentation.
Motivated, attentive and observant security personnel will also form a highly-effective deterrent presence and final line of defence where other interventions may have failed.
For further guidance, visit Hostile Reconnaissance.
Mail Screening and Suspect Packages
Although any suspect item should be treated seriously, remember that the great majority will be false alarms and a few may be hoaxes. Try to ensure that your procedures, while effective, are not needlessly disruptive.
General Indicators
There are some general indicators that may suggest a delivered or found item could be of concern include:
- An unexpected item, especially if hand delivered
- A padded envelope (‘Jiffy Bag’) or other bulky package
- An additional inner envelope or other contents that may be difficult to remove
- Labelling or excessive sealing that encourages opening at a particular end or in a particular way
- Oddly shaped or lopsided packages
- An envelope flap stuck down completely (normally gummed envelope flaps leave slight gaps at edges)
- Being marked as ‘to be opened only by…’, ‘personal’ or ‘confidential’
- An item addressed to the organisation or a title (rather than a specific individual)
- Unexpected or unusual origin (postmark and/or return address)
- No return address or return address that cannot be verified
- Poorly or inaccurately addressed or the address is printed unevenly or unusually
- Unfamiliar writing or unusual style
- Unusual postmark or no postmark
- More stamps than needed for size or weight of package
- Letters with no stamps or postage label
- Greasy or oily stains coming from package
- Odours coming from package
Explosive or Incendiary Indicators
Additional explosive or incendiary indictors include:
- Unusually heavy or uneven weight distribution
- Small hole(s) in envelope or wrapping.
"White Powder" Indicators
Additional chemical, biological or radiological (CBR) indicators include:
- Powders, liquids emanating from package
- Wrapping stained by liquid leakage
- Unexpected items or materials found in package on opening or X-raying (loose or in a container) such as powdered, crystalline or granular solids; liquids; sticky substances or residues
- Unexpected odours observed on opening
- Sudden onset of illness or irritation of skin, eyes or nose.
Actions Upon Discovery
If a suspicious item is delivered or found anywhere else (inside or outside) around the building – make sure you have appropriate emergency response plans in place. If you discover a suspicious item, you should follow these simple steps:
- If you are holding the item, put it down on a cleared flat surface
- Keep it separate so it is easily identifiable
- Do not move it, even to x-ray it
- If it is in an x-ray facility, leave it there
It is important that once you have followed the previous actions, you move yourself and others away immediately:
- Clear the immediate area and each adjacent room, including rooms above and below
- If there is any suggestion of chemical, biological or radiological materials, move those directly affected to a safe location close to the incident, keep these individuals separate from those not involved
- Prevent others approaching or accessing the cleared areas
- Do not use mobile phones or two-way radios in the cleared area or within fifteen metres of the suspect package
Once the area is clear, you must notify the police:
- If the item has been opened, or partially opened prior to being deemed suspicious, it is vital that this is communicated to the police
- Ideally make sure informants and witnesses remain available for police, and that the accuracy of their observations is preserved. Encourage witnesses to immediately record their observations in writing, and discourage them from discussing the incident or their observations with others prior to the arrival of the Police
Visit related guidance: Mail Screening Matters and PAS 97 Mail Screening Standard
Protecting Pedestrian Queues
The risk to pedestrians from Vehicle As a Weapon (VAW) attack is a realistic possibility in the United Kingdom. VAW attacks are most successful when carried out against an area with a high density of people (e.g. a crowd) and/or where people are arranged in an easy to target line (e.g. a queue). The processing of voters at an election could lead to queuing outside the polling station, which could become a target for a VAW attack.
To minimise the risk to queues of people, organisations can take practical and achievable measures to either deter or disrupt a VAW attack. Further guidance is available at Minimising Risk to Pedestrian Queues from Vehicle as a Weapon Attack..
- Work with near neighbouring premises to develop a plan for queues.
- Move queues to areas where there are usually no vehicles.
- Avoid creating long straight queues and, if possible, keep them short.
- Place “Do not join the queue” signs when its length or position increases the risk to people.
- Queues should be oriented so that they are perpendicular to potential vehicle attack routes; avoid positioning queues parallel to potential vehicle attack routes. If this is not possible, street furniture should be placed between the queue and traffic wherever possible.
- Queues should not be positioned near live traffic i.e. roads. If this cannot be avoided, they should be moved away from the kerb edge, towards the far side of the pavement.
- Where possible, orientate queues so that people within them are facing oncoming traffic and can see hazards/danger approaching.
- Consider fast dispersal/escape routes for pedestrians.
- Reducing vehicles in the areas of queues will make it safer for pedestrians.
- Where possible, prevent vehicular access to shared areas when queues are present.
- In car parks, create a vehicle safety zone by preventing or limiting parking next to queues of people. Consider enforcing ‘no parking’ near to the queues with cones or, ideally, a more robust barrier.
- Where vehicle/queue segregation in a car park is not possible, traffic calming measures, including reduced speed limits, should be introduced.
- Wherever possible, queues should be positioned behind existing rated vehicle security barriers (ISO22343-1, IWA-14, PAS68 and NPSA VADS Standard).
- Street furniture should be utilised, where possible, to provide a degree of protection. Do NOT remove any security features / useful street furniture items without considering their potential protective security benefit.
- If footway widening is implemented to allow additional queuing capacity, the inclusion of temporary rated vehicle security barriers should be considered.
- Where long or multiple queues form, consideration should be given to deploying vehicle barriers along the footway to prevent a vehicle from being driven down the queue’s length.
- Raise awareness of the full range of safety risks to the public through staff briefings.
Visit related guidance:
Recognising Terrorist Threats
The threats you face may be varied and could change rapidly. It is essential that you understand the current risks associated with your site and any vulnerabilities.
Different attackers will use different tools and methods depending on their competence, experience and what they have available to them. Physical attacks can have different levels of sophistication and could be made up of a combination of one or more different methodologies.
Whilst there are a significant number of possible attack methodologies, there are some methods that appear frequently, both in attacks and terrorist instructional media.
Attack Methods
This list is not exhaustive, but identifies the most common attack methods used by terrorists in the UK
- Bladed Weapons
- Firearms
- Vehicle as a Weapon
- Fire as a Weapon
- Explosives
- Chemical, Biological and Radiological Materials
How do I protect myself?
The detailed guidance below provides a comprehensive strategy for mitigating the risks you may face.
It is important that you have a response plan to an attack and this plan is linked to the risks you have identified for your site. It should also link to local stakeholders, including, Police, Fire and Rescue Service, Ambulance and the Local Authority as their assistance will be integral to managing the consequences of an attack.
Know what your thresholds are for reporting, and how and where to report incidents. Three key areas to consider are suspicious items, suspicious behaviours and prohibited items.
The presence of suspicious items can be a pre-attack indicator; items such as bags which are hidden from view or give off unusual odours. Anything which is not typical of what you would expect to find in your location.
The behaviour of individuals or groups prior to an attack may give an indication of their intentions and provide opportunities for disrupting their plans. Behaviours may include wearing bulky or non-typical clothing, carrying unusual items, or driving erratically.
It is an offence to carry certain items in public without relevant licences. This includes some sharp or bladed weapons, improvised weapons, firearms and certain hazardous chemicals. If you see anyone carrying one of these you should report it to the police immediately.
For more on related threats, visit:
Additional Mitigations
It is important you are alert and vigilant, looking out for unusual activity; and that you feel empowered to report concerns. Detailed guidance on all of the above subjects and more can be found at the below further guidance link. In addition, everyone can access comprehensive election security guidance on GOV.UK. Updated regularly, this guidance brings together expertise from the across the security community including the Police, the NCSC and others to help you implement quick and effective protective security measures.