Improvised Explosive Device (IED) Guidelines For Crowded Places

Introduction
Crowded places can pose a broad range of security challenges for their owners and operators. Terrorists and other criminals have, and will continue to, see crowded places as attractive targets for attacks both in Australia and overseas. Terrorist attacks using improvised explosive devices (IEDs) often target crowded places such as public transport hubs, sporting arenas, entertainment precincts, and shopping malls. Government and private sector cooperation helps to ensure incident planning and arrangements are integrated and effective, while aiming to reduce the likelihood and impact of IED attacks. 

The Crowded Places Advisory Group (CPAG) has developed these Guidelines on behalf of the Australia New Zealand Counter-Terrorism Committee (ANZCTC), with input from the Business Advisory Group (BAG). They should be read in conjunction with Australia’s Strategy for Protecting Crowded Places from Terrorism; Active Armed Offender Guidelines for Crowded Places, Chemical Weapon Guidelines and Hostile Vehicle Mitigation Guidelines.

Purpose

Those who own or operate crowded places are responsible for providing a safe and secure environment for the general public by applying well-informed risk and emergency management
arrangements. It benefits everyone to stop or limit the consequences of an IED incident and quickly restore normal business activities.

These Guidelines help people who own or operate crowded places to be more aware of the threat posed by IEDs. They also provide guidance on the issues and options to consider during risk mitigation and contingency planning activities. Australia’s Strategy for Protecting Crowded Places from Terrorism sets out several guiding principles for public and private sector stakeholders to reduce their vulnerability to the threat of terrorism. These Guidelines supplement the Strategy with key emphasis on the following two principles:

  • Prevention and preparedness arrangements should be underpinned by an intelligence led, risk management approach; and
  • Effective security outcomes in complex environments where large crowds gather require cooperation and coordination between all stakeholders.

Glossary of terms

Critical infrastructure: Physical facilities, supply chains, information technologies and communication networks which, if destroyed, degraded or rendered unavailable for an extended period, would significantly impact the social or economic well being of the nation or affect Australia’s ability to conduct national defence and ensure national security.

Crowded Places: Crowded places are locations or environments which are easily accessible by large numbers of people on a predictable basis. Crowded places include, but are not limited to, sports stadia, transport hubs, shopping centres, pubs, clubs, places of worship, tourist attractions, movie theatres, and civic spaces. Crowded places do not have to be buildings and can include open spaces such as parks and pedestrian malls. A crowded place will not necessarily be crowded at all times: crowd densities may vary between day and night, by season, and may be temporary, as in the case of sporting events, open air festivals, or one-off events. 

Emergency management: The plans, structures and arrangements that are established to bring together government agencies, voluntary groups and private organisations in a coordinated way to deal with emergency needs, including prevention, response and recovery.

Evacuation: The process of relocating people from dangerous or potentially dangerous areas to safer areas. The purpose of an evacuation is to use distance to separate people from the danger created by the emergency.

Home Made Explosives (HMEs): Non-standard explosive mixtures/compounds that have been made or synthesised from readily available ingredients.

Improvised Explosive Device (IED): A device made or placed in an improvised way that incorporates destructive, lethal, noxious, 1 Australia’s Strategy for Protecting Crowded Places from Terrorism pyrotechnic or incendiary chemicals and is designed to destroy, incapacitate, harass or distract.

Mitigation: Measures taken before, during, or after an event to decrease or eliminate its impact on people, property or a location.

Mixed-mode attack: An attack that uses a combination of different weapons, such as a firearm and an IED, at single or multiple locations.

Person Borne Improvised Explosive Device (PBIED): An improvised explosive device worn, carried or housed by a person, either willingly or unwillingly.

Situational awareness: The ability to quickly recognise and interpret an event, make sound decisions based on those interpretations, and establish early, effective and continuous lines of communication between the incident site and the controlling agency in order to provide ongoing accurate information about the situation to responders.

Terrorist act: An act or threat committed with the intention of advancing a political, ideological or religious cause, and which is intended to coerce or intimidate an Australian government, a foreign government, or sections of the public, which causes serious physical harm or death to a person, endangers a person’s life, causes serious damage to property, creates a serious risk to the health and safety of the public, or seriously interferes with, disrupts, or destroys, an electronic system.

Vehicle Borne  improvised Explosive Device (VBIED): An improvised explosive device delivered by or concealed in a vehicle.

White level inspection: An inspection by all staff members of their respective workplace for any articles that are unusual, suspicious or unable to be accounted for. The people in the best position to conduct these inspections are the people who know and work within that area. A white level inspection is not a search for bombs. 

Threat context

Explosives remain a favoured terrorist weapon globally. Terrorists favour explosives because of their proven ability to inflict mass casualties, destroy property, cause fear and disruption, and attract media attention. Explosives are generally within the financial and technical capabilities of terrorists – IEDs can be assembled with relative ease and used remotely. Terrorist groups of concern to Australia, the Islamic State of Iraq and the Levant (ISIL), Al-Qa’ida, and supporters of these groups, have conducted explosives based attacks throughout the world. Terrorist propaganda continues to encourage individuals, particularly those based in Western countries, to conduct attacks at home. Terrorist propaganda can provide practical, easy-tofollow advice on how to prepare for an IED attack – including how homemade explosives can be manufactured from readily available materials. These instructional guides have been linked to a number of terrorist attacks and disrupted plots globally.

The Australian experience

Recent counter-terrorism arrests and prosecutions in Australia demonstrate the ongoing appeal of IEDs to Australia-based violent extremists and, accordingly, the ongoing threat of terrorism. A number of recent counter-terrorism arrests include charges related to plots involving IEDs and explosives. In December 2016, a Melbourne teenager was sentenced for his role in a disrupted May 2015 plot – at the time of his arrest he possessed IED instructions and precursors for homemade explosives. The general terrorism threat level remains PROBABLE. Further terrorist plots involving explosives could occur, and there may not be any forewarning before an attack. The current security context assessment is contained at Appendix A.

Characteristics of  LED incidents

Terrorist attacks in Western countries with similar security environments to Australia typically involve basic weapons (including vehicles and edged weapons), firearms and/ or IEDs, a small number of attackers, and relatively simple tactics. These factors are likely to feature in future attacks and disrupted plots in Australia. A terrorist IED attack in Australia is likely to below cost, simple to construct, and comprised of materials that are readily available and can be acquired without attracting undue attention. An IED attack in Australia is unlikely to require any specialised skills or training.

The principal consideration for target selection in recent IED attacks and disrupted plots in the West has been the prospect of causing mass casualties, with secondary considerations
including symbolism, media attention, and causing fear and disruption. Extremists frequently target crowded places so they can achieve the greatest impact.

General features

IED’s are physically diverse. They can be a range of shapes and sizes, can employ a number of different methods to initiate the explosion, and may be concealed in a number of different ways. They can be carried by a person or by a variety of different vehicles. They may be triggered by various methods, including radio control, timer, electronic sensors or pressure plates, trip wires, or a hand-held switch.

IEDs can explode, deflagrate (partially detonate), ignite or fail to activate. They may be triggered by various methods, including radio control, timer, electronic sensors or pressure plates, trip wires or even a handheld switch. 

Note: Suspect mail items are not addressed within these Guidelines. For information on mail bomb incidents see Bombs: Defusing the Threat, available on the Australian Federal Police website, www.afp.gov.au.

Vehicle Borne Improvised Explosive Devices VBIED’s are a widely used terrorist tactic and have been used in many attacks planned or conducted in western countries, or against western interests. VBIED’s typically contain  more explosive than PBIED’s, which potentially increases the damage caused by the attack. However, where smaller vehicles such as motorcycles are used, the amount of explosives may be comparable to a PBIED.

Implementation

The choice of vehicle is likely to be determined by the type of attack being planned and the capability of the assailant(s):

  • Larger vehicles and trucks allow for the movement and detonation of large amounts of explosives with significantly greater destructive impacts. However, larger devices can be more complex to construct and may not detonate completely.
  • The assailant(s) could also seek to acquire and operate vehicles that give them access
    to controlled areas.

Various tactics have been used to ensure VBIED’s are positioned to achieve the greatest effect. This includes using VBIED’s as secondary devices as part of complex attacks, or concealing the device so that the attack can be delayed until the appropriate time (for example, when the area is highly crowded).

Choice of explosives

The assailant(s) will generally use an explosive that they can acquire relatively easily. Within Australia, access to commercial or military explosives is strictly regulated with mandatory security requirements during production, transport and storage. Acquiring explosives through criminal or other means is possible, but risks alerting authorities. In contrast, some IED precursor chemicals have many legitimate uses, and can be acquired without arousing suspicion, with some being available for purchase at retail level. Recipes and technical instructions for manufacturing IED’s are easy to obtain online. It is anticipated terrorists planning an IED attack within Australia would favour homemade explosives (HMEs) that are relatively simple to manufacture from locally sourced materials. Australian governments, in consultation with industry, have developed a Code of Practice to improve security awareness of precursor chemicals that could be used in
the manufacture of an IED or a toxic device. For a copy of the Code and more information on chemicals of security concern, including the 15 identified as being the most high risk
precursors to HME’s, visit www.nationalsecurity.gov.au/chemicalsecurity

Immediate health effects

Explosions create a high-pressure blast wave that causes damage to surrounding structures and injuries to people. Secondary effects from the blast can cause further injuries to people (such as fragmentation, incendiary, and thermal injuries), as well as damage to the surrounding environment. The type of injuries and the number of people hurt will vary depending on:

  • The surrounding physical environment;
  • The amount and quality of the explosive;
  • The amount and type of fragmentation incorporated in an IED;
  • The distance and shielding between victims and the blast (see ‘stand-off distances’ on page 9); and
  • The presence of fires and/or structural failure following the explosion.

Injuries common to explosions include overpressure damage to internal organs, blunt and penetrating trauma, burns, and respiratory issues.

Primary objectives

Assessing the threat

Communicated threats can disrupt normal business activity without actually risking life or damage to property. Statistically, most threats are received by telephone so the person who answers the call has a critical role and must be prepared to effectively gather all relevant information. Written threats may be received via email, social media, fax, SMS, hand or typewritten notes. Immediate steps must be taken to preserve the integrity of the message regardless of the mode of delivery.

Deliberate false threats or hoaxes often involve claims of the placement of harmful substances, IED’s or similar, and should be assessed on a case by case basis.

A ‘bomb threat checklist’ is an invaluable tool for capturing relevant information to assess the credibility of a communicated threat and should form part of every emergency response plan. A suggested format is provided at Appendix B.

Protecting life

In most cases, an IED attack will occur without warning to inflict the greatest number of casualties. The protection and preservation of life is paramount and minimising the number of fatalities and treating the injured should be the primary objective of any plans or strategies. This is most likely to be achieved through the following activities: 

  • Initiating immediate response activities;
  • Assisting emergency responders and providing ‘situational awareness’;
  • Moving people away from danger;
  • Being aware of the potential for secondary devices; and
  • Preventing people from entering the scene.

Prevention, Preparedness, Response, Recovery (PPRR)

Australia’s National Counter-Terrorism Plan recognises the need to prevent, prepare for, respond to and recover (PPRR) from terrorist acts. The Plan can be found on ww.nationalsecurity.gov.au. The PPRR concept does not represent a consecutive set of activities and many elements of PPRR will often occur concurrently. Event organisers and owners and operators of crowded places
are strongly encouraged to ensure their own prevention, preparedness, response and recovery arrangements align with those of emergency service agencies and that they use them to inform their planning and security measures.

Prevention

Not all risks or emergencies can be prevented. The concept of prevention should therefore have a broad meaning to encompass activities that may reduce the severity or impact of the emergency event.

Not all crowded places will share the same risk profile or have similar vulnerabilities, so the principle of proportionality should generally be applied to any prevention-related activities. This means that protective security measures need to be proportionate to the level of assessed risk. These measures should protect the public and, where possible, preserve the public’s use and enjoyment of these places. When measuring proportionality it should be recognised that prevention and mitigation activities related to terrorism may also provide broader crime prevention and public safety benefits.

A building’s resilience can be enhanced through policies and procedures as well as through the design of the building itself e.g. prevention of progressive collapse, glass protection, creating stand-off and using the built and natural environment. Limiting damage to structures and people An explosive attack against a building can produce casualties associated with the harmful debris caused by fragmentation.

Crime Prevention Through Environment Design

Crime Prevention Through Environmental Design (CPTED) is a multi disciplinary approach to deterring crime through the design of the environment. Affecting the environment where an offender is intending to act can influence their decision making and, in certain designed environments, has been demonstrated to deter and even eradicate that behaviour. CPTED principles can broadly be applied to IED deterrence by making the environment either less attractive or more resilient to an IED attack.

Facades

Facades serve several important purposes, and building owners should identify construction methods and materials that not only meet energy efficiency and aesthetic needs, but also perform well when subjected to the effects of an explosion.

Glass, masonry, stone, precast concrete and architectural metals exhibit distinctive failure modes and mechanical properties when subjected to air blast pressures. For example, glass tends to break into small pieces following a blast event, which can cause lacerations and puncture wounds. Brick, on the other hand, ends to break off from a structure in larger pieces following a blast event, which can cause blunt trauma injuries.

Interior walls

Interior walls may become potentially harmful projectiles following a blast. Fragmentation can cause blunt trauma injuries and create debris that hampers access by first responders or blocks escape routes.

Windows

Window glazing can increase the blast resistance of glass. Although no commercially available glazing can fully mitigate the effects of a close range blast event, certain glazing systems may substantially reduce blast impact at greater distances. Window glazing can also reduce the distance that glass fragments travel. Window frames must hold glass in place long enough for the window to properly fail; otherwise a blast can cause an entire pane of glass to dislodge from its frame, becoming one large projectile. The following international standards provide useful information and advice on glazing options:

  • ISO 16933 Glass in building – explosion resistant security glazing test & classification for arena air blast loading 
  • ISO 16934 Glass in building – explosion resistant security glazing test & classification by shock tube loading.

Stand-off distances

A proven approach to reducing the threat and impact of an explosive blast is to create a ‘stand-off distance’ between the asset being protected and the area where an IED could be placed. Every metre of stand-off counts in mitigating the effects of a blast.

Defining safe stand-off distances can present significant challenges for people wo own and operate crowded places, particularly when unhindered public access to large open spaces is a common feature of such places. Where possible, it is preferable to block vehicle access to crowded places altogether. However, consideration should be given to routine and emergency services requirements, as well as surrounding traffic and transport imperatives.

Strategically placed objects such as spheres, planter boxes, seats or bollards on the pavement at entrances to crowded places can provide extra protection from unauthorised vehicle intrusion as well as increasing stand-off  distance. Guidance is available on minimum and maximum safe evacuation distances relative to the size of potential explosive devices at Appendix C.

Preventing progressive collapse. 

Preventing progressive collapse is an important part of minimising the structural effects of a blast. A building undergoes progressive collapse when a primary structural element fails, resulting in the failure of adjoining structural elements, which in turn causes further structural failure. Due to the diverse range of facilities and sites characterising crowded places, owners and operators must consider the possibility and consequence of progressive collapse on a case by case basis. For example, the use of temporary truss and frame structures will be common for many outdoor events such as festivals and concerts. In these circumstances, event organisers must strictly adhere to their respective work health and safety obligations.

The National Construction Code (NCC) is an initiative of the Council of Australian Governments (COAG) developed to incorporate all on site construction requirements into a single code. For more information visit www.abcb.gov.au. Using the built and natural environment Restrictions on public movement, or ‘compartmentalisation’ measures, can help mitigate the effects of an IED attack. This may include using barriers such as walls and fences to deter and delay unauthorised movement of people, vehicles or objects into restricted areas. Reducing the overall size of a crowded place by separating congestion points can also help lessen potential casualties. ‘Line of sight’ principles can assist when calculating safe evacuation distances. Generally speaking, the likelihood of surviving an explosive blast increases substantially when permanent structures (such as walls) or landscape features (such as clad earthworks) act as a barrier between the IED and potential victims.

Preparedness

Preparedness incorporates emergency planning, resourcing, capability development
and testing of preparedness arrangements. Some key activities include identifying and assessing suspicious behaviour or activity, having an assessment process for threats, conducting white level inspections, as well as regularly reviewing and testing policies and procedures.

Identifying and assessing suspicious objects or activity

Identifying suspicious activity is not an exact science. Nervous behaviour that appears suspicious in certain circumstances, for example in a shopping centre or restaurant precinct, may be typical in other settings, such as a job interview. Identifying suspicious behaviour is a matter of context. Make an informed assessment of suspicious activity or behaviour based on the environment,
experience, judgment, and common sense.

The suspicion of a threat may be confirmed with only one observation or it could take a series of observations. Consider these behavioural signals:

  • Continuous scanning of an area;
  • Unusual perspiration;
  • Heavy breathing;
  • Fidgeting;
  • Rubbing hands;
  • Pacing;
  • Clock watching;
  • Exaggerated yawning; and
  • Avoiding security/uniformed officers.

It is not possible to identify a potential assailant on the basis of appearance, nationality or language. However, there are behavioural clues staff can look out for when identifying potential preparatory actions for terrorism or criminal activity:

  • Unusual video recording or photography;
  • Working in groups;
  • Taking notes/drawing diagrams;
  • Taking measurements (pacing steps out);
  • Avoiding eye contact;
  • Asking about security/operations;
  • Revisiting the same location;
  • Observing but not using a public transport system;
  • Immediately fleeing the area when noticed;
  • Boundary probing; and
  • Weak cover story if questioned.

Report suspicious activities or behaviour to the National Security Hotline on 1800 123 400 as soon as practical, however if it warrants an immediate response contact the police instead
on 131 444. Inspection procedures Once a threat has been communicated, it may be necessary to inspect the venue or facility. Venue occupants or staff can conduct a general cursory or white level inspection, provided they are sufficiently trained in what to do if they discover a suspicious item (see ‘assessing unattended or suspicious items’ on page 12).

White level inspections

A white level inspection involves inspecting an area for anything unusual, suspicious, or that can’t be accounted for. Staff members who know and work within an area are best placed to do this.  Create a plan that assigns staff members certain areas,  including communal areas such as public concourses, foyers, cloakrooms, stairwells and corridors. Having a plan will assist in ensuring the white level inspection is conducted in a safe, thorough and timely manner. Pay particular attention to evacuation routes and assembly areas.

White level inspections are distinct from searches by specialist search teams involving police, security personnel or both under the command of a designated search controller.
Specialist search teams can provide a high level of staff and public safety but can be slow and are generally more disruptive to venue operations. When to undertake a white level inspection It is recommended that white level inspections are undertaken:

  • Each day upon arrival at work;
  • On a random basis; and
  • At the request of management (including in response to a received threat). When initiating a white level inspection, proportionality should be a key consideration. Generally speaking, all threats should be deemed credible until proven otherwise.

Types of white level inspection

White level inspections can be undertaken in several ways depending on the circumstances. There are two main methods for conducting a white level inspection:

  • Occupant: Generally, staff or occupants are best equipped to inspect areas because they are familiar with their surroundings. This type of inspection is relatively fast and efficient
    but may require additional training.
  • Supervisory: A supervisory inspection can be done discreetly, without alerting other staff members to the threat. Supervisors inspect their own areas of responsibility and report
    back to a chief warden or duty manager. Alternatively, a supervisory inspection can involve designated wardens to oversee and plan the inspection.

A supervisory inspection may also involve partial or full evacuation, however, before initiating such action it is important to consider:

  • Is the threat non-specific? If details are scarce or non-specific and there is nothing (other than the threat itself) to suggest that the venue is at risk, a cursory inspection may be adequate.
    Possible action: discreet supervisory inspection
  • Do you recognise the caller? If the threat is communicated by a known individual (e.g. a disgruntled ex-employee), it may suggest a hoax and the danger to staff and occupants may be negligible. Possible action: occupant inspection
  • Has specific detail been provided? If the threat contains specific information about the IED’s location, depending on the nature of the location (e.g. a school), a controlled response may be appropriate. Possible action: supervisory inspection
  • Is the threat credible? If circumstances or consultation with law enforcement deems the threat credible, and the consequence potentially catastrophic, a supervisory search involving police and security personnel may be an appropriate alternative to a white level inspection. Possible action: trained team search

Communicated threats should generally be reported to the police. It is a criminal offence for anyone to threaten to kill or cause bodily harm to any person or damage, destroy or burn property.

In order to reduce the possibility of an unattended item causing disruption at a crowded place, owners and operators should include some basic security activities as part of their day to day business. These could include:

  • Keeping communal areas tidy and emptying bins on a regular basis;
  • Keeping entrances and exits clear, especially evacuation routes;
  • Checking evacuation assembly areas are clear;
  • Ensuring that lost or stolen items are reported immediately;
  • Maintaining accurate records of assets,  plants and equipment; and
  • Ensuring staff are familiar with white level inspection processes and reporting procedures.

Assessing unattended or suspicious items

In many cases, a potential IED attack will be identified through an unattended or suspicious item. Considering the many ways an IED can be constructed and concealed, this presents real challenges for security screeners, employees, and first responders. Nevertheless, there are some basic principles to follow when identifying an unattended or suspicious item, including vehicles, which will help to avoid unnecessary isruption to day to day operations.

In most cases, unattended items or items left in conspicuous areas have simply been forgotten or discarded. To distinguish harmless items from those that should arouse suspicion, there are some basic, common sense principles to follow before undertaking any response activities.

1. Who is the owner? Every object has an owner. Interviewing people in the vicinity and reviewing CCTV footage could help to identify the owner and establish the item’s origin.
2. Is the item HOT? Under the HOT principle, anything that is Hidden, Obviously suspicious or not Typical to its environment could be deemed a security risk.

HOT is a general guide for assessing unattended or suspicious items and should be combined with broader considerations, such as the prevailing security context. Meeting one or more HOT considerations does not necessarily mean the item is an IED, nor does the absence of HOT considerations clear the item from further investigation.

  • Hidden: An unattended item that is intentionally hidden merits additional caution.
  • Obviously suspicious: An item with the characteristics of a bomb or hazardous material merits additional caution. Such characteristics may include:
    » Suspicious labelling;
    » Leakage of fuel oil;
    » Unusual smells, bulges or protruding wires;
    » Power source, such as batteries;
    » LED lights; and
    » Pieces of metal or glass (shrapnel).
  • Not typical: An item that would not typically be discarded or forgotten in that area merits additional caution.

3. Has the location received a communicated threat? If the discovery of an unattended item coincides with a communicated threat, exercise caution. See ‘Appendix B – Bomb Threat Checklist’.

4. Has the National Terrorism Threat level been elevated? The National Terrorism Threat Advisory System informs Australians about the likelihood of an act of terrorism occurring in Australia to help guide national preparation and planning. When the threat level is raised, additional precautions are required. State and territory police can provide information on how the National Threat Advisory relates to the local security context.

The system also dictates levels of precaution and vigilance to minimise the risk of a terrorist incident occurring. It has a range of five levels that communicate an assessed risk of terrorist
threat to Australia:

  • Not expected – a terrorist attack is not expected, the government has no specific concerns.
  • Possible – a terrorist attack is possible, the government has concerns a threat may exist.
  • Probable – a terrorist attack is probable, the government has concerns of a plausible threat.
  • Expected – a terrorist attack is expected, the government has concerns of a specific threat.
  • Certain – a terrorist attack is certain, the government has concerns that a terrorist attack will soon occur or is underway.

The current National Terrorism Threat level is outlined in Appendix A. Anytime the National Terrorism Threat Level increases additional vigilance is required. For more information visit the National Security website www.nationalsecurity.gov.au.

 

5. Has the item been found in a sensitive location? If an unattended item is found in a non-public or restricted area, near flammable or dangerous substances, near structural supports, critical infrastructure or near an area with the potential or mass casualties, take additional caution. Assessing unattended vehicles Unattended or suspicious vehicles warrant particular attention due to their potential to cause large numbers of casualties and significant damage to buildings and infrastructure. As with suspicious items, a vehicle could be left in a location to test response procedures and assess the viability of a VBIED attack. Depending on the chosen vehicle and environment, a VBIED may appear less suspicious than a placed IED. In assessing suspicious or unattended vehicles, the principles previously outlined for identifying suspicious or unattended items also apply. There are, however, particular indicator sunique to VBIED’s that should be considered, including:

  • Unusual items inside a vehicle (gas cylinders, petrol cans, electrical wires, leaflets, large bags or boxes, and extra batteries);
  • Indications of a triggering device (a switch, radio transmitter, timer, wires passing from the front seat to the rear of the vehicle that would be visible near the driver, under the seat or within reach);
  • Presence of the vehicle in an area where it should not be, perhaps parked illegally;
  • Recent alterations or repairs including painting or bodywork and removal of interior panels;
  • Evidence that an interior door panel has been removed or tampered with;
  • Signs that the vehicles suspension is under abnormal load;
  • Presence of powder or prills (small rounded granular material) left when explosive material was loaded into the vehicle;
  • Additional fuel tanks (may be used to secrete explosives or to provide additional gasoline to fuel the explosives);
  • Additional antenna on the car for radiocontrolled devices;
  • Licence plates inconsistent with vehicle registration; and
  • Rental vehicles with false papers.

Post-assessment guidance If the item is not suspicious:

  • Review CCTV to confirm that the abandonment of the item or vehicle was not a reconnaissance exercise by a potential offender. If suspicious activity is observed, report it to police; and
  • If an owner cannot be identified, remove the item or vehicle (if possible) and follow lost property or abandoned vehicle procedures.  if you are undecided:
  • Do not touch, tilt or tamper;
  • Do not use mobile phones, radios or flash photography within a 25 metre radius (electronic frequencies or light sources may cause a device to detonate);
  • Inform a supervisor;
  • Cordon off the area and move people away;
  • Record all relevant information (physical characteristics, shape, dimensions, construction and the exact position of the item or vehicle);
  • Advise security; and
  • Call police on ‘000’ and follow their instructions.

If the item is suspicious:

  • Do not touch, tilt or tamper;
  • Do not use mobile phones, radios or flash photography within a 25 metre radius (electronic frequencies or light sources may cause a device to detonate);
  • Call Triple Zero ‘000’ and advise security;
  • Cordon off immediate area and evacuate at least 100 metres from the item (if a vehicle, evacuate at least 500 metres);
  • Record all relevant information (physical characteristics, shape, dimensions, construction and the exact position of the item or vehicle);
  • Respond in accordance with the directions of emergency services; and
  • Gather any evidence of the placement of the item or vehicle, including CCTV showing activities of any person associated with the item or vehicle. Response

In a crowded place, the potential for, or actual explosion of, an IED may create a level of panic and chaos that is difficult to control. The main objective of any response plan should be to
minimise risk to people. Owners and operators of crowded places should do what they can to:

  • Save and protect life;
  • Facilitate the evacuation of those at risk;
  • Contain the incident or threat; and
  • Support emergency response and investigation activities.

Initial actions to be taken should an incident occur include:

  • Assess the incident and start to build situational awareness;
  • Activate plans;
  • Tell staff and people what they should do; and
  • Provide information to police and emergency services.

Actions to be considered in the  management of the initial response to an IED incident are outlined in Appendix D.

Evacuation considerations

When responding to a communicated threat, one of the more difficult decisions or management is whether or not to evacuate. The decision to evacuate should be based on an assessment of the credibility of the threat. Planning and initiating evacuation should be the responsibility of the incident/security manager and, if possible, made in consultation with police and other emergency services. Depending on the particular size and nature of the crowded place, the plan may include:

  • Total evacuation; or
  • Partial evacuation, if the suspicious item is small and thought to be confined to one location.

If evacuation is necessary, clearly communicate instructions to staff and ensure primary and secondary routes and exits are well defined. Provide short, clear instructions and repeat
important information. The person delivering the messaging should speak firmly and calmly.

Also consider support for people with special needs. Trained staff should be used as evacuation marshals and evacuation teams should be selected and trained in conjunction with the development of an IED threat incident plan which takes into consideration:

  • In terms of communicated threats, retrieve personal belongings to reduce the number of suspicious items;
  • If an explosion occurs, evacuate as quickly as possible without stopping to retrieve personal belongings or make phone calls;
  • Before evacuating people to assembly areas, consider if secondary devices could potentially have been placed in evacuation routes and assembly points. Implement procedures to ensure these areas are kept clear;
  • Select safe and acceptable assembly areas as evacuees may be waiting for considerable periods;
  • If possible, avoid using car parks as assembly areas;
  • Make sure all employees have evacuated and implement special procedures for people with special needs; and
  • If the layout of the venue is complex or large, it may be more practical for people to gather
    at various safe points in the venue before being escorted to the exits.

Limitations of total evacuation The evacuation procedures for an IED threat do not necessarily follow those of other
emergencies. Leave doors and windows open (security of premises permitting) to lessen the
blast effects. Additionally, there are significant safety and economic factors that may weigh against an immediate and total evacuation. These include:

  • Risk of injury – often the easiest location for planting an IED is in an adjoining car park or in an area the public can easily access. Evacuation through these areas might increase the risk of injury;
  • Panic – a sudden bomb threat evacuation may cause panic and unpredictable behaviour, potentially causing injury;
  • Essential services – some evacuations may be precluded by the essential nature of operations being conducted within the building; and
  • Loss to business services – while the protection of life should outweigh any economic loss, repeated evacuation may increase loss of business and interruption of services to an acceptable level.

Advantages of partial evacuation

Partial evacuation is effective when the specific or general location of a threat or identified suspicious item is known. Partial evacuation reduces the risk of injury while allowing critical services to continue. Partial evacuation requires a high degree of planning, training, supervision and coordination. Exercising for a partial evacuation should form part of the IED threat incident plan.

Transition considerations

Responsibility for implementing and coordinating initial response activities with a crowded place will, in most instances, be assumed by the venue/facility management or security staff until emergency responders are able to take over that responsibility. A key aspect of managing the response and transitioning responsibility will be the ability to gain ‘situational awareness’.

Establishing early, effective, and continuous lines of communication from the incident site to the responding police or emergency service agency will be critical in order to accurately  inform them of the situation. Knowing or understanding the expectations of first responders will help to transition control of the incident more effectively.

Planning and staff training activities should therefore include:

  • Developing strategies that allow designated staff to safely maintain situational awareness of the incident and relay any new information to first responders; and
  • Training staff and occupants on how to respond when law enforcement or emergency services arrive on scene.

The preferred response when police arrive may vary slightly across Australian states and territories. Owners and operators of crowded places should consult with local law
enforcement agencies when developing their plans.

Emergency services response

Each jurisdiction has systems and interagency arrangements that provide the basis for emergency management and critical incident response. These are tailored to meet the
jurisdiction’s specific needs, capacities and capabilities. Commonalities across Australian
and New Zealand jurisdictions include:

  • Operational response strategies, including incident and emergency management models; and 
  • Agreed command, control and coordination arrangements.  

Despite many similarities, there are still several differences in emergency management arrangements, processes and terminology across the states and territories and, in some  instances, across agencies. The responsibility for incident management control can potentially alternate between fire agencies and the police, depending on jurisdictional arrangements. It is therefore critical that owners and operators of crowded places and major event stakeholders develop a firm understanding of the emergency service plans and arrangements that apply to their jurisdiction. Information on arrangements in each state and territory can be found at www.nationalsecurity.gov.au/WhatAustraliaIsDoing/Pages/StatesandTerritories.aspx. 

Response priorities

In the event of an IED incident, the initial priorities for responding police or fire service may include: 

  • Establishing an incident command post and staging areas for responding agencies;
  • Determining safe inner and outer cordons; 
  • Gathering immediate information on what has occurred and what is being done or considered by the venue management;
  • Initiating or providing advice on full or partial evacuations;
  • Arranging for specialist support to search and assess the scene;
  • Rendering safe any unexploded or suspect items;
  • Fire suppression;
  • Medical triage and treatment; and
  • Crime scene and evidence recovery activities.

The best way to provide timely information and support to the emergency service agencies during these activities is to appoint an emergency services liaison officer to act on behalf of the venue/facility.

Recovery

To ensure a smooth transition from response to recovery, gradually devolve and integrate response arrangements. This includes media and information management, impact
assessment, rehabilitation of the built environment and restoring community and staff confidence. While many recovery-related matters will be similar for the majority of emergency events, significant or traumatic events such as terrorist acts or IED incidents may add extra complexity to normal recovery procedures.

Key recovery considerations following an IED incident may include:

  • Public information and community confidence;
  • Scene preservation and investigation activities; and
  • Business continuity challenges.

Public information

Media or public information activities must support operational policies and actions. To achieve this, develop public messaging in coordination with senior operational personnel and experienced media managers. This is particularly important in situations where an offender has been taken into custody or charged with offences relating to the incident, as information released may interfere with pending legal proceedings.

Provide information regularly to keep the public informed and only restrict it in the interests of safety or operational security. Clearly separate information relating to consequence management, such as providing assistance to victims, from the actual incident or security issue. As a general rule:

  • An agency must only release information for which it has responsibility; and
  • A log of all public information activities and decisions should be maintained.

Crime scene and investigation

Police will conduct some form of major investigation for all IED incidents. This could involve criminal and forensic investigations in relation to potential criminal offences, as well as coronial investigations on behalf of the coroner. These investigative processes will be extremely thorough and may be protracted, particularly where the incident has occurred
over a broad geographical area, or involves forensic challenges. During the investigation phase the police may seek assistance from management at the location to help identify potential sources of evidence or witnesses. This could include CCTV footage and radio, telephone or decision making logs. Recovery or business continuity plans should identify a suitable emergency services liaison officer that can work with the police to help facilitate these types of requests.

Business continuity

The ability of owners and operators of crowded places to return to business as usual following a terrorist attack, or other disaster, depends on how effectively they can devise and implement their business continuity arrangements.

Through their contact with investigating police, the nominated liaison officer will generally be in a position to obtain  information about the likely duration of the scene examination, allowing the venue to start implementing their business continuity arrangements. While the actual process may not change significantly, the amount of time it takes often will.

Useful links
Australian national security: www.nationalsecurity.gov.au

Emergency management section on the AGD website: www.ag.gov.au/
EmergencyManagement ASIO Business and Government Liaison Unit:
www.bglu.asio.gov.au
Trusted Information Sharing Network: www.tisn.gov.au
Contacts
National contact information In the event of an emergency (police, ambulance, fire) 000
To report possible signs of terrorism National Security Hotline 1800 123 400
for TTY users: 1800 234 889  Email: hotline@nationalsecurity.gov.au Crime Stoppers 1800 333 000
Australian Federal Police www.afp.gov.au/policing AFP Hotline (after hours contact) 1800 813 784 Urgent police assistance at major Australian airports 131 237 (131 AFP)
State and Territory Contacts Contact details for police in each state and territory can be found at www.nationalsecurity. gov.au/CrowdedPlaces. Version control This document is endorsed by the AustraliaNew Zealand National Counter-Terrorism Committee (ANZCTC) and maintained by
the Attorney-General’s Department (AGD). AGD is responsible for the version control of this document. To preserve the integrity and currency of this document:

  • major amendments must be endorsed by the ANZCTC; and
  • Minor amendments, for example to correct spelling or grammar, should be documented and forwarded to AGD to be implemented and then a revised version sent to the Crowded Places Advisory Group (CPAG) to be endorsed before it is distributed. 3635