Defining Prevention and Response Actions For

Business

Denver UASI Presents “Shared Strategies for Homeland Security”

Presented By:

Detective Joe Tennant – Denver Police Bomb Squad

Prevention

Protection of our citizens and CIKR is the responsibility of everyone!

Partnerships must be formed and strategies shared.

Who’s responsibility is it?

Prevention

Prevention starts with knowledge, understanding, and preparation

“It is said that if you know your enemies and know yourself, you will

not be imperiled in a hundred battles…”

Sun Tzu

Prevention

Know your enemy’s intent.

“Kill the Americans and their allies, civilian and military. It is an individual duty for every Muslim who can do it in any country in which it is possible to do it.”

Osama bin Laden

Terrorism Awareness

Terrorist Groups

– International

– Domestic

– Right Wing

– Left Wing

– Special Interest Groups

– State Sponsors

– Lone Wolves, etc.

Terrorism Awareness

Key Points – Jihadist movement is always evolving– al-Qaeda to the Lone Wolf– Effects of the Internet– Difficult for counterterrorism efforts, but not

futile!– Terrorists are patient and meticulous planners

Terrorism Awareness

We know who wants to harm us.

We know their intent.

What does a terrorist look like?

Terrorism AwarenessWhat Does a Terrorist Look Like?

– BehaviorNervous Anxious/Excited Profuse sweatingHesitationLyingHidden gestures and signals

Avoiding eye contactPhysical avoidanceMental stressMumblingPraying

Terrorists can look like anyone!!! Look for suspicious behavior, appearances,

and activity…

Identifying a Terrorist– Appearance

Doesn’t fit time, story, and/or eventNot dressed for climateMultiple sets of clothingCarrying oversized bag/multiple bags on streetModifications to bagsElectrical components coming from bag to hand

– ActivityInterest in security measuresExtended amount of time in areas that are unusualConstantly looking aroundTaking unusual photos and or videoAvoidance of security and/or law enforcement

The ThreatHow Will They Attack?

Explosives are still the terrorist’s weapon of choice. Why?– Easy to acquire/make– Easy to move and place– Can be used remotely to avoid capture– Low cost– High Yield– Difficult to detect

Execution of Threat

Explosives– Hand Placed IED– Person Borne IED– Vehicle Borne IED– Delivery by Proxy

Other WMD Concerns– CBNR

Threat to Prevention

Steps to Prevention

KnowledgeUnderstandingAssessment PlanningPracticeReassessment

PreventionQuestions To Consider

What is your risk level? Low/High– Are you a potential target?

What vulnerabilities or risks is your venue facing?Are you prepared?– Can you prevent, deter, disrupt, delay, respond to,

and/or mitigate a hazardous incident?Are you protected?– Physical– Liability

PreventionRisks and Vulnerabilities Assessment

How do you know what to protect or how to protect it? There may be help!

“Protected Critical Infrastructure Information Program” (2002) ACAMS, HSPD-7, and other Initiatives

– For additional information view video at www.dhs.gov/acams

Prevention

Seven Signs of Terrorist Activity– Surveillance– Elicitation– Tests of Security– Acquiring Supplies/Funding– Suspicious People/Impersonation– Dry Runs/Rehearsals – Deployment of Assets

Terrorist Attack Cycle

Target SelectionSurveillanceFinal Target SelectionPlanningFinal SurveillanceDeploy Attack TeamAttack

Target Selection

Terrorist’s Goals– Kill and/or Injure – Cause overreaction

by the government– Harass, weaken or

embarrass government

– Destroy Infrastructure

– Destroy facilities– Instill fear

– Disrupt communications

– Discourage foreign investment

– Influence government decisions

– Satisfy a vengeance

– Destroy economy

Desirable Targets

TransportationEconomic Infrastructure Soft TargetsSymbolic or “Public Message”MilitarySpecific Individuals

Surveillance-Terrorists Seek Information-

Existing security at the facility:– Security force size– Security’s normal duties– Security measures (i.e. Searches)– Reaction times and procedures to false alarms– Security Equipment– Patrol Routines– Shift Changes– Access control measures– Uniforms and clothing worn by personnel– Location of critical assets (fuel, water, power)– Computer sites– Schedules of vendors– Photos, video recordings, etc

Final Target Selection

Targets with greatest weaknesses and vulnerabilities

Targets with possibility of greatest success.

Planning Phase

Research and Intelligence GatheringChoosing method of attack Gathering suppliesDesigning-Building-Testing Device(s)Dry Runs

Methods of Attack

– Bombings– Suicide/Homicide

Bombings– Arson– Armed Assault– Ambushes– Assassination

– Hijacking– Skyjacking– Kidnapping– Hostage taking– Criminal Activities– WMD– C.B.R.N.

Final Surveillance

Terrorists will look for the same items and routines that showed a particular facility to be vulnerable during the first surveillance phaseThey conduct a final surveillance to make sure nothing has changed in and around the facility during their planning phase.

Attack Cycle

Deployment of Attack Team– Terrorist have their weapons intact and are en-route

to the attack site

The Attack– Terrorists have arrived at the location of the attack,

the weapons of choice are in place, and the attack is carried out.

Lodging Industry

Inherent Problems– No vehicle checkpoints– No security searches– Occupants have free access – Occupants have some right to privacy in their

rooms– Many of the behavioral signs for a

criminal/terrorist may be typical for a hotel guest (i.e. bags, clothing, photos)

Lodging Industry

What you can do– Watch for suspicious vehicles – Watch for highly unusual behavior– Train employees to watch for suspicious

behavior– Instruct employees to watch for unusual

activities taking place in guest rooms– Practice your emergency plans– Report suspicious behavior immediately

Other Threats

Cyber Attacks– Very real concern

in the U.S. for all entities

Workplace violenceActive Shooters

RobberyTheftEspionageAssault

Behavioral awareness is beneficial in stopping any criminal activity

Technology-Techniques

BiometricsCard AccessDetection Inst.-CBRNECameras/Surveillance/LightingAlarms/Motion SensorsCyber wareSecurity DoorsX-ray/MagnetometersVehicle BarriersBlast Mitigation ProductsCCTV

Keep premises clean and orderly! Know your facility and what belongs there. Incorporate blast mitigation designSecurity (Armed vs. Unarmed)Challenging Unknown VisitorsSign-In Logs and ID ChecksVehicle InspectionsInterview TechniquesBehavioral Analysis Training

Technology Techniques

PreventionSummary

Complete vulnerability assessmentsMinimize risks and vulnerabilities Have a security planPractice and test the plan Reassess the plan and fine tune Train and conduct exercises. Continually educate employees

Response Actions for Business

Response (Business)

Bomb Threats Gather information from caller. Complete Bomb Threat Checklist Record conversation if possible Note Caller ID information Telephone Trap/Trace Notify supervisors and police immediately Search premises for suspicious items

Police generally do not searchYou know your facility.Search by twos (floor to waist, waist to head, head to ceiling).Search public access areas and then more secure areas.

If suspicious object is located…DO NOT TOUCH!!

Response (Business)

Bomb Threats Evacuation? Staging Area(s) Write statements with exact quote of threat! Documentation of threat Remain available to police. Witnesses will be asked to testify in court.

Response(Business)

What is a suspicious item?

Evaluate the totality of the circumstances

Gather intelligence on the item.

Trust your gut feelings.

Use of phones or other transmitting devices?

Do not handle a suspicious item!

Evacuation suggested

Notify police!

The Vehicle Borne IED

Response(Business)

Vehicle Borne IEDs (VBIED)– Indicators of a VBIED

Sagging shocks, indicating heavy payloadOdors, smoke, or fluids coming from vehiclePaperwork or plates do not match vehicle registrationVehicle appears to be abandoned Wires, switches, or other suspicious items observed inside of vehicle. Appears to be stolenSigns that it may be a cloned vehicleItems lying in vehicle that appear to be suspicious.

Response(Business)

Business Response to VBIEDEvacuate area immediately, allowing for blast hazards. Notify police immediately. Do not attempt to tow vehicle! Always keep Secondary Devices in mind!

Response (Business)

Business response to a post-blast bombing incident.– Evacuate – Notify police and EMS immediately. Care for

injured. – Stay on phone with police dispatcher to keep

LE/EMS updated. – Keep employee roster/log book to manage

personnel at scene.

Response (Business)

Business Response to Bombing Scenes– Secure the building, parking structure, and surrounding area

until police arrive.– Building maintenance, management, and security need to

remain available to LE. – Have communications system available for employees. – Minimize media contact– Point person to collect statements/documents – Do not handle evidence! – Security can attempt to keep streets open for arriving LE/EMS– Attempt to minimize emotional distress in employees.– Follow instructions from LE

Police ResponsePolice and EMS will arrive on scene very quickly.The injured will be cared for by EMS, while LE secures the crime scene and searches for additional hazards.Once hazards are identified and eliminated, the crime scene will be evaluated and processed ASAP. Command Post(s) will be set up and an Incident Command System will be implemented to manage all agencies. LE will immediately begin investigative processes to maximize their chances of a successful prosecution. Your help will be needed!!!

SummaryPrevention and response is everyone's responsibility. Conduct Risk and Vulnerability AssessmentHarden security as much as possible Based on assessments, make a plan practice the plan, re-evaluate, make necessary changesTrain and educate employeesContact your local LE officials for additional training and information.

Contact Information

Detective Joe Tennant-Denver Police Bomb Squad, #720-913-6381 or joe.tennant@denvergov.org