INTRODUCTION

SIA SECURITY INDUSTRY ASSOCIATION

CHAPTER 1 – ROLES AND RESPONSIBILITIES

CHAPTER 2 – THREAT ASSESSMENT
CHAPTER 3 – IED - BOMB AWARENESS
CHAPTER 4 – TERRORISM
CHAPTER 5 – SECURITY ADVANCE PARTY
CHAPTER 6 – INTERNATIONAL TRAVEL
CHAPTER 7 – RESIDENTIAL SECURITY
CHAPTER 8 – WALKING DRILLS
CHAPTER 9 – EMBUS/DEBUS
CHAPTER 10 – VEHICLES
CHAPTER 11 – VEHICLE ESCORT PROCEDURES
CHAPTER 12 – OPS ROOM
CHAPTER 13 – SURVEILLANCE
CHAPTER 14 – COMMUNICATIONS
CHAPTER 15 – BUSINESS SECURITY
CHAPTER 16 – CONFLICT MANAGEMENT
SIA Security Industry Association
The Private Security Industry Act 2001

The Private Security Industry Act 2001 outlines a system for the statutory regulation of
the private security industry.
The Act is broken down into a number of Sections and two Schedules:

The text below summarises sections 1 and 2 of the Private Security Industry Act 2001.

The SIA's functions are:

 to license individuals in specific sectors and to approve security companies.

 to keep under review the private security industry and the operation of the
legislative framework.
 to monitor the activities and effectiveness of those working in the industry.
to conduct inspections.
 to set and approve standards of conduct, training and supervision within the
industry, and
 to make recommendations to improve standards.

In addition:

 The SIA can do those things it considers necessary or helpful in discharging its
functions.
 The SIA can make proposals to the Secretary of State to modify any provision
contained in the Act, and to undertake, arrange or support research relating
to the provision of security services.
 The SIA must comply with directions, from the Secretary of State and must
provide any information that the Secretary of State requests. The Secretary of
State must consult the SIA before giving any directions.

The text below summarises sections 3-6 of the Private Security Industry Act 2001.

These clauses create the offence of engaging in conduct for which a licence is
required when not in possession of the appropriate licence. The penalty on
conviction in a magistrates' court, is up to six months' imprisonment or a fine of up to
£5,000, or both.

The current designated sectors or activities that must be covered by a licence are
as follows:
  manned guarding, which includes:
cash and valuables in transit - under contract
close protection - under contract
door supervisors - under contract and in-house
public space surveillance (CCTV) - under contract
security guarding - under contract
vehicle immobilising - under contract and in-house
key holding - under contract

These activities are defined in detail in Schedule 2 of the Act.

The Secretary of State can, by order, add or remove activities from the above list.
The following categories of people will need licences:

 security contractors, directors of security companies and partners in security

firms.
 employees of security contractors, security companies and security firms.
agency workers performing the designated duties.
 persons who manage or supervise security operatives supplied under
contract by a security contractor (but not in-house supervisors of contractors).
 agency-supplied managers or supervisors of security operatives supplied
under contract.
 directors of security companies and partners in security firms who do not
themselves carry out the designated activities.
 in-house door supervisors and vehicle immobilisers and their employers,
managers and supervisors.
 others who immobilise vehicles on private land against a release fee.
 The Secretary of State can, by order, add or remove categories of people
from the above list.
 Some activities can be classified as exempt from the licensing requirements.

The text below summarises sections 7-12 of the Private Security Industry Act 2001.

Criteria

The SIA is required to prepare and publish the criteria that it will apply in reaching
decisions on granting, modifying or revoking licences.
In practice, this will be criteria relating to criminality and competency for each
designated sector.
Licences

The SIA can refuse to grant a licence until it is satisfied about the identity of the
applicant; until any additional information requested of the applicant has been
provided; and until any further enquiries undertaken by the SIA have been
completed.

Applicants for licences are required to pay the SIA a fee of an amount prescribed
by the Secretary of State.
A licence is valid for a period of three years, although the SIA is empowered to
modify, revoke or suspend a licence or any conditions attached to it.

An appeals procedure will be established.

Conditions Attached to Licences

Types of conditions that can be prescribed relate to:

 training, registration and insurance.
 the manner in which activities are to be carried out.
 the production and display of the licence.
 information that the licensee is to provide to the SIA from time to time.

Other conditions can be prescribed by the Secretary of State.

Public Register

The SIA is required to establish and maintain a register of individual licensees.

The register must be available for public inspection.

The text below summarises section 13 of the Private Security Industry Act 2001.

Licensing at Local Authority Level

The Secretary of State may make an order allowing a local authority to carry out the
functions of the SIA with regard to the licensing of door staff.

The text below summarises sections 14-18 of the Private Security Industry Act 2001.

The SIA will establish an Approved Contractor Scheme.

The SIA will ensure that the applicant meets the criteria and is 'fit and proper' to
receive approved status.
The text below summarises sections 14-18 of the Private Security Industry Act 2001.

The SIA will establish an Approved Contractor Scheme.

The SIA will ensure that the applicant meets the criteria and is 'fit and proper' to
receive approved status.
Those that obtain approval can advertise themselves as being approved.
conditions may be attached to the granting of approved status.
A contractor can be removed from the scheme.
An appeals procedure will be put in place.

The Act provides for a voluntary scheme but also provides power to convert it into a
compulsory one.

Public Register of Approved Contractors

A register of approved contractors will be maintained by the SIA and can be

inspected by members of the public.

The text below summarises sections 19-22 of the Private Security Industry Act 2001.

Powers of Entry and Inspection

Persons authorised by the SIA may enter premises owned or occupied by a

regulated person other than premises occupied exclusively for residential purposes
as a private dwelling.
Regulated persons are required to produce documents or information in connection
with matters that are subject to regulation under the Act (i.e. licensable conduct,
the provision of security services, and any conditions attaching to approved
contractor status under a compulsory scheme).
Persons exercising powers of entry may do so only at reasonable times and must
satisfy certain requirements under the Act, such as providing evidence of their
identity and authorisation.
It is made an offence for a regulated person to fail to comply with the provisions in
section 19.

Guidance on Exercising Power of Entry

The SIA must publish guidance on the manner in which persons authorised with the
power of entry and inspection should exercise it and the manner in which they
should conduct themselves.
This guidance may be revised from time to time. The SIA must publish the initial
guidance and any revisions to it in a way that will bring it to the attention of those
affected by it.

Access to Enhanced Criminal Record Certificates

The Act amends the Police Act 1997 to permit the SIA to obtain an enhanced
criminal record certificate for anyone applying to be licensed as a door supervisor.

Please note that this was repealed by the Criminal Justice Act 2003.

False Information
It is made an offence for anyone to knowingly or recklessly make a false statement
to the SIA in connection with the exercise of its functions.

The text below summarises sections 23-26 of the Private Security Industry Act 2001.

Criminal Liability of Directors etc

If a body corporate is convicted of an offence, a director or senior officer, or
anyone purporting to act in such a role, who is shown to have consented to,
connived in, or been negligent in preventing that offence, is also liable to
prosecution.

Orders and Regulations

Subordinate legislation under the Act may be made by the Secretary of State
through the use of statutory instruments. Unless otherwise specified, such statutory
instruments may be annulled by a resolution of either House of Parliament. In specific
instances the Secretary of State must consult with the SIA before exercising a
statutory instrument.

Interpretation
The terms used in the Act are defined.

Short Title, Commencement and Extent

The name of the Act is set out, as is its extent and the means by which it should be
brought into force.

The text below summarises Schedule 1 of the Private Security Industry Act 2001.
This Schedule contains detailed provisions about the constitution of the Security
Industry Authority, including:

 membership (appointment, tenure and remuneration);

 employment of staff; its ability to establish committees;
 delegation of its functions to committees and staff;
 the conduct of its proceedings;
  the seal of the SIA and use of the SIA's documents as evidence;
 financial matters (payments to the SIA, accounts and auditing); and
 the SIA's production of an annual report, which the Secretary of State is to lay
before Parliament.

This Schedule also extends to the SIA the provisions of legislation relating to public
records, the Parliamentary Commissioner, the payment of pensions, disqualification
for election to Parliament or the Northern Ireland Assembly and freedom of
information.

The text below summarises Schedule 2 of the Private Security Industry Act 2001.

This Schedule describes the activities that are subject to control under the Act. Part I
relates to the controlled activities of security operatives. Part II provides for additional
controls in relation to door supervisors and vehicle immobilisers.
Chapter 1

ROLES AND RESPONSIBILITIES OF A CLOSE PROTECTION OFFICER

The SIA (UK Regulatory Authority) defines a Close Protection Officer as someone
whose role is: "to establish and maintain a safe working environment in which a
Principal can live and work whilst continuously minimizing risk".

OBJECTIVES

There are four main objectives

 Unintentional Injury; Vehicle accidents, random accidents, medical

emergencies and medical problems (existing conditions).
 Embarrassing Situations; Media Control, public situations, private and family
matters.
 Intentional Attacks; Criminal threat, random attacks, organized assault,
kidnapping.
 Managing convenience ensuring the smooth running of any occasion
involving the Principal.

PROTOCOL

The system of rules, dress and acceptable behaviour that people should follow.

Hygiene, Habits and Behaviour:

 Cleanliness.
 Well-groomed.
 Nails clean and trimmed.
 Clean-shaven.
 Haircut.
 Avoid strong smells i.e., aftershaves & food.
 No smoking while on duty. Be mindful of smell on clothes when on duty.
 No chewing gum.
Dress and Conduct

As a Close Protection Operative, you must ensure your presentation is clean and
clothes are pressed.
Take into account the following in order to present a professional image in all
circumstances:

 Principal / Entourage
 The Itinerary
 The Environment
 Covert or Overt

Invest in a decent suit, however, if you are buying an off the rack suit ensure that it’s
a good fit especially the shoulders. Opt for a charcoal or grey colour suit rather than
black unless its evening wear. Trousers should cover the top of the shoe and parts of
the laces. Consider weapons (not the UK) or communications equipment.
You cannot go wrong with a white shirt (keep a spare i.e., in the boot of a car, ops
room, hotel, etc). Sleeve cuffs to be exposed approximately half an in inch. A tie
should be darker than your shirt and should just reach the waistband of your trousers
or slightly shorter.
Always wear a belt which should be fairly thin and the same colour as your shoes. If
carrying equipment wear dark-coloured bracers.

You should endeavour to have a mixture of clothing available to you for different
occasions:

 Specialist – Tuxedo.
 Business casual – Smart dress without tie (keep tie with you).
 Smart casual – Trousers, shirt, jumper over the shirt, shoes.
 Casual – Smart jeans, shirt, polo shirt, trainers or shoes.
 Physical training kit/sportswear – Tracksuit, shorts, t-shirt, sweatshirt, skiing outfit.
 Overalls – for searching vehicles, venue search, etc.

Often you will be required to blend into your environment in order to keep a low
profile. For example:-
The Principal is dressed casually therefore you will need to dress casually.
You are working with your Principal in the city in an area of executive business
people, therefore, will need to dress accordingly.

Key Interpersonal Skills

The importance of interpersonal cannot be overstated. Your attitude and approach

to the Principal, the principal family, their employees, and members of the public
you meet in the execution of your duty must be professional and beyond reproach
at all times:

 Communication skills.
 Listening skills.
 Negotiation skills.
 Problem-solving.
 Decision making.
 Assertiveness.
 Etiquette.

Honesty, Integrity, and Confidentiality

A great deal of trust is given to you as a Close Protection Operative:-

You will have access to parts of buildings that are restricted.
You will be entrusted with keys that allow you the freedom to go where you choose.
You will have access to very sensitive information which could be of great value to
your client’s competitors.

In UK law there is a duty of confidentiality that has been established by Statute and
continually developed by Case law. A duty of confidentiality can arise without an
explicit statement of its kind, i.e. a client has the right to assume you are 100%
trustworthy and will not discuss their private conversations with anyone else. This is an
implied and legally binding confidentiality agreement simply because you are
employed in your role.

Diplomacy

As well as a Close Protection operative being a representative of the Principal they

are also ambassadors of their own profession. Be mindful of diplomacy when
confronted by the media when being asked questions about the Principal.
Adaptability

Close Protection operatives need to be adaptable, having to think at act at very

short notice and quite often without any notice. Be able to change a course of
action and adapt to something new. For example, last minutes change in the
Principal’s itinerary.

Laws and Legislation

As a close protection operative, it is imperative that you have a level of knowledge

regarding Law and Legislation relating to the Close Protection industry in the United
Kingdom. It is also important to have knowledge of Law and Legislation in other
countries if working overseas. In the United States, you will need to look at legal
requirements for the State in which they are working as they vary from State to State.

Failure to abide by a country’s laws and legislation could lead to imprisonment.

What is Law?

Law is a code that regulates the behaviour of members of society and affects
almost everything we do from buying a house to getting a divorce.

Whist is Legislation?

The legislation is a law enacted by a legislative body or the act of making laws.

Types of Law in the United Kingdom

Common-Law i.e. a breach of the peace, a threat of physical violence.

Statute Law i.e. written by legislative authority.
Civil Law i.e. trespass, family law, property law
Criminal Law i.e. murder, theft, drug offences.

Laws and Legislation that apply to the Close Protection Operative

During employment as a Close Protection Operative, you may have to make a legal
decision before or during the execution of duty. These legal decisions will not only be
made of oneself but also on behalf of the protective team and the Principal. As a
Close Protection Operative, you have no more powers than any other ordinary
person by acting lawfully i.e. Any person may arrest without warrant any person who
is in the act of committing an arrestable offence or has reasonable grounds for
suspecting to be committing such an offence.

Civil Law – Trespass

Trespass is committed by a person who is improperly on someone else’s property

without consent:

Civil offence.
No power of arrest.
Power of eviction.

Criminal Law – Serious Offences

Murder.
Rape.
Sexual Assault.
Assault (ABH).
Assault (GBH).
Assault (GBH with Intent).
Possession of a firearm in a public place.
Possession of a firearm with intent to endanger life.
Possession of a firearm or imitation firearm with intent to cause fear of violence.
Drugs and Controlled Substances.
Supplying Drugs.
Possession of Drugs.
Possession with intent to supply.
Offensive Weapons.
Possession of bladed or sharply pointed articles.
Theft.
Fraud.
Robber.
Burglary.
Aggravated Burglary.
Criminal Damage.
Damage with intent to endanger life.
Aggravated Damage.
Threats to Damage.

Use of Force

The suspect tries to escape.

The suspect offers violence towards you.
The unlawful use of force is an assault.
The use of force must be justified.

A Close Protection Operative may use force as a last resort.

A Close Protection Operative may be prosecuted for using too much force.

Rules of Self-Defence

If any person has an honest belief that he or she is in imminent danger, then he may
use such force as is reasonable and necessary to avert that danger.

Pre-Emptive Strike

Although a person who acts in self-defence is normally being attacked, the defence
is not limited to this situation, since it has been recognized that there may be
situations in which it will be justified to use reasonable force by way of pre-emptive
action against an apprehended attack.

Personal Security and Awareness Responsibilities

It is very easy to become familiar with things in our everyday lives and therefore you
become complacent and if danger were to strike you would be caught off guard.

Five Principles of Personal Security

 Limit Information.
 Be constantly aware.
 Avoid routine.
 Maintain your security procedures.
 Exercise initiative and common sense.
Limiting Information - Need to Know Basis.

All information regarding the Principal is to be treated strictly confidential including

and not limiting to:-

All information that comes via Principal Profiling (See Threat Assessment)
All business details.
All security plans including floor plans and maps.

Information regarding the Principal's itinerary only needs to be provided to the

relevant security team as and when required and until that point, all details secured.

Be Constantly Aware

Keep within the "Yellow" area of Jeff Cooper's Colour Chart. Be constantly aware of
what is going on in your surroundings.

Jeff Cooper’s Awareness Colour Chart

WHITE Switched off and unaware of what is going on around you.

YELLOW Alert and aware of your surroundings. Difficult for someone to surprise you.
ORANGE Heightened awareness and sense something is wrong.
RED The fight is on and you are taking decisive and immediate action.

The Cooper Colour Codes is not a system for describing levels of potential danger,
but rather a technique to enable a law-abiding citizen to overcome a natural
reluctance to use lawful deadly force against another. Jeff Cooper

Avoid Routine

Routines fall under the category of patterns and habits. It is these patterns and
habits that can give the hostile information needed to plan an attack. For example:-

 Leaving for the office every day at the same time taking the same route.
 A meeting scheduled at the same time, same place, same day every week.
 A CP team member leaving his home heading to the Principal's residence at
the same time using the same route every day.

Maintain Security Procedures

Ensure all security procedures and principles are being adhered to. Follow SOP’s
(Standard Operating Procedures).

CLOSE PROTECTION ROLES

The Close Protection Team

The size and members making up the Close Protection team depends on many
factors;-

The Principal.
The level of threat.
The environment in which protection will be offered.
Travel requirements.
The cost factor and available funding.

The different roles performed by Close Protection Officers are explained below.

Close Protection Team Leader – TL

The Team Leader is primarily a manager usually carried out by the most experienced
team member. Responsible for;-

 The command and tasking of the Close Protection team as a whole.

 Providing the itinerary details and SOP’s (Standard Operating Procedures).
 The direct contact between the Principal, Principal’s PA, or Client and CP
Team.
 Taking on the role of PPO (Personal Protection Officer) or BG (Bodyguard).
 Updating risk and threat assessments.
 Liaising with authorities, other security companies and resources.

Personal Protection Officer (PPO) or Bodyguard (BG)

The PPO or BG is a member of the team who has been allocated the responsibility
for the immediate protection of the Principal at all times and will escort the Principal
whenever possible. Their main role is to provide “cover and evacuation” of the
Principal when threatened.
Here the PPO / BG will be the initial communications link between the Principal, the
Team Leader (TL) and the rest of the CP team who will relay any immediate changes
to the itinerary or issues that may affect the security of the Principal.

(There may be times and / or places when due to the venue and existing security
the PPO or BG and members of the Personal Escort Section will not be allowed,
remember to remain polite and flexible).

Personal Escort Section (PES)

The PES provides the next layer of protection around the Principal and PPO / BG.
They are tasked with assisting the PPO / BG, specifically dealing with any threat
directly, continued surveillance for any potential threat and to assist the PPO / BG in
the evacuation of the Principal.

Security Advance Party (SAP)

Close Protection Officers employed on SAP duties go ahead in advance of the

Principal to carrying out route reconnaissance and conduct surveys of intended
locations for visits by the Principal.
The Security Advance Party (SAP) duties include:-

The planning of routes to, from and between venues, where possible ensuring the
safety of the route prior to the Principal using it.
The planning of secondary and escape routes.
On route surveillance.
Checking and assessing venues.

Residential Security Team (RST)

Members of the RST would ordinarily be responsible for searching and securing the
Principal’s home, office and residences. Roles and responsibilities include:-

Establishing and maintaining an Operations (Ops) Room.

Securing vehicles.
Patrolling the grounds.
Vetting visitors and incoming post/parcels.

Second in Command (2IC)

The 2IC is a team leader who will be au fait with all the Close Protection Team
Leader's duties and responsibilities.

Security Driver

The security driver is responsible for not driving the Principal from A to B but also the
security of the vehicle. The driver must be trained to very high standards in
advanced, defensive, offensive and anti-ambush techniques under highly stressed
situations.
It is also essential that the driver works well and has carried out drills with the Close
Protection team.

Surveillance Operative

A surveillance operative has the task of maintaining control of subjects via covert
observation and gathering quality intelligence in order to assist in the provisions of
security procedures.
Chapter 2

THREAT ASSESSMENT

A threat assessment is the most important procedure carried out in a Close

Protection operation.
The reason for the threat assessment is to identify anything that might threaten your
Principal, their family, their properties, their businesses, business associates, as well as
members of the Close Protection team.

ASSESS To assess the likelihood of an attack.

THREAT ASSESSMENT ESTABLISH To establish the level of protection needed.
ENSURE To ensure total wellbeing.

The “Threat Assessment” must assess the likelihood of imminent danger.

Threats are usually associated with assassination, kidnapping, robbery, or
harassment. However, other risks must be accounted for including:-

 Fire.
 Theft.
 Accidents.
 Embarrassment.
 Discretisation.
 Health problems.
 Dangerous weather conditions.

The threat assessment is a continuous process that is undertaken to make predictions

about the types and levels of threat within the environment.
As well as predicting on-going and future threats we must also look at history, what
threats have there been in the past and what’s the chance or probability of these
threats happening again.

The threat assessment will need to include a vast amount of background information
including and not limited to:-

 Who, what and why is there a need for protection.

  What are the Principal’s business interests?
 Principals places of work and residences.
 The Principal’s itinerary including venue, meetings, and travel details.
 Duties to be performed.
 Any threats which are known.

Private and sensitive information is also required, however, often the Principal is
reluctant to provide such information, therefore, it might be a case of learning on
the job and adding the information at a later date. Such information may include
extramarital affairs, drug or drinking habits and gambling addictions.

CLEAR
A Threat LOGICAL
Assessment RELEVANT
Must Be ACCURATE
ONGOING

GATHERING INFORMATION

When first compiling a threat assessment it is important to get as much information

as possible, past, present and future, not only information on the Principal but also
their family, their business interests and business links etc.

There are several places where information for threat assessments can be gathered
including:-
• The Principal, the Principal’s family, the client, advisors and staff.
• Police, Security Services, Military Intelligence and Embassies.
• Local Information and open source information (Press, Media, Internet
etc.)

To not be fully aware of the Principal’s religious beliefs, political background or

business interests could have very serious implications.
PRINCIPAL PROFILING

As stated earlier some of the information required of our Principal will be given and
some information will be gained as the relationship with the Principal builds.

Principal Profiling:-

1. Personal History – Principal’s basic background information - name, age,

place of birth, marital status, previous and current nationalities, residences,
languages, military service, occupation, children, medical and health
details, previous marriages etc.
2. Personality – the type of personality, for example, confrontational or have an
abrasive way about them.
3. Political and Religious Persuasions – Principal's political standing. Is he/she an
active member of any political party? What are their religious beliefs?
4. Prejudices – A Principal who has religious or strong racial prejudices is like a
ticking time bomb waiting to go off. Ensure certain potentially hazardous
encounters are avoided.
5. Private Lifestyle - A family man? mistresses or boyfriends ?. Are there drinking
habits, gambling habits ?. Are there any sporting activities and pastimes. Are
they a workaholic?. Does the Principal maintain a low profile despite
prominence or seek a profile above his position.
6. People – all know associations, business contacts, family, friends and
acquaintances. Any type of relationships can cause a variety of problems
stemming from jealousy, business takeovers or disagreements, family feuds to
relationship breakdowns and divorces.
7. Places – where people work, live, travel, even born have importance to the
threat assessment. Geographic implications will often affect the ‘risks’ if not
the overall threat.
8. Previous and known Potential Threats – details of all previous threats as well as
known potential threats.
Example: Principal Profile

STRICTLY PRIVATE AND CONFIDENTIAL

1 – Personal History
Full Name: Aliases:
Date of Birth: Nationality:
Place of Birth:
Residential Address: Other Addresses:
Contacts Details: Mobile / Landline Email:
First Language: Languages Spoken:
Marital Status: Previous Marriages:
No. of Children: Age of Children:
Health Level: Medical History:
Blood Group: GP / Emergency Contacts:
Ailments / Allergies: Medications:
Occupation: Business Details:
Lawyers: Accountants:
Criminal Record:
Military History: Awards:
Hobbies / Interests: Other:
Additional Information:
2 – Personality
Type of Personality:
Likes: Dislikes:
Additional Information:
3 – Political and Religious Persuasions
Political Background: Active Member of a Political Party:
Length of Time: Political History:
Position / Role: Relevant Addresses:
Religion: Active Member Yes / No
Position / Role: Relevant Addresses:
Additional Information:
4 – Prejudices
Known Prejudices:
Known Publicly: Details:
Additional Information:
5 – Private Lifestyle
Sports, Fitness, Pastimes: Relevant Addresses:
Food Preferences: Preferred Restaurants:
Other Information:
6 – People
Family Members at Residence: Staff at Residence:
Staff Details: Inc. Position, Responsibility, Full / Part-time, Live in / out, their addresses:
Ex-Spouse: Ex-Spouse Relationship Details:
Ex-Spouse Address: Children Outside the Residence:
Business Partners / Associates: Business Partner Relationship Details:
Business Partners Addresses: Other relevant Staff i.e. PA.
Ex Business Partners: Ex Business Partners Address:
Present Ex Business Partner Relationship: Other Business Interests:
Any known Staff issues: Staff Dismissals:
Business Competitors: Know issues with Competitors:
Other Information:
7 – Places
Relevant Residential Addresses: Relevant Work Addresses:
Full Itinerary Details:
Scheduled Meetings:- Date /Time/Address: Type / Purpose of the Meeting:
Details of people in attendance:
8 – Previous Threats
Type Threat: Who:
Why: When:
Outcome:
Known Potential Threats
Who: Why:
Other Information:

Example: Principal’s Office Assessment

STRICTLY PRIVATE AND CONFIDENTIAL

Office
Office Address: Telephone Nos:
Grid Ref: Floor Plans:
Building Point of Contact: Office / Building Security Contact:
Business Interests: No of Staff:
Co-Residence Details: Neighbouring Buildings:
Onsight Security Survey: Security Equipment Details:
Vehicle Parking Details: Drop off / Pick up Points:
Local Emergency Services Address / Emergency Response Times:
Contacts:
Route / Alternative Route Details: Building Emergency Evacuation Plans:
Known Threats: Previous Threats:
Example: Country Residence Assessment

STRICTLY PRIVATE AND CONFIDENTIAL

Country Residence
Address: Telephone No:
Grid Ref: Floor Plans:
Contacts: RST Contact:
Family Members at Residence: No of Staff at Residence:
Co-Residence Details: Neighbouring Buildings:
Onsight Security Survey: Security Details:
Vehicle Parking Details: Drop off / Pick up Points:
Local Emergency Services Address / Emergency Response Times:
Contacts:
Route / Alternative Route Details: Building Emergency Evacuation Plans:
Known Threats: Previous Threats:

From the information gathered can we establish a potential threat?

Who are they, why are they a threat, what’s their motive.
Threat is imminent – the threat is possible.
Security measures to minimise the risks.
Actions on / Emergency plans.

THREATS

There are four types of threat to consider:-

Direct Threats Specifically targets the Principal, his / her family, associates
and the security team.
Indirect Threats Do not specifically target the Principal but can cause harm
or embarrassment etc., for simply being in the wrong place
at the wrong time.
Criminal Threats Money and possessions are targeted by a thief or
opportunists.
Miscellaneous Illnesses, natural disasters, motor accidents/breakdowns etc.
Threats

A threat can originate as a result of many things including;--

 Being outspoken against a particular regime or religious belief.

  Being a millionaire or have status, such as a movie, pop star or sports
celebrity.
 A personal vendetta from a personal or business issue.
 A business competitor wanting to discredit.

A threat can be carried out in several different ways:-

 Verbal assault – verbal abuse from an angry crowd.

 An object is thrown – a bottle, eggs, blood, acid thrown from a crowd.
 Assassination – by way of shooting, bomb (IED), knife, poisoning, etc.
 Kidnapping – for political and religious reasons or financial gain.
 Fear or Intimidation – stalking, nuisance calls, blackmail.

Who the Principal is.

The Threat Is Dependant On What does the Principal do?
Who or what does the Principal represent?
What influence does the Principal have?

There is never 'Not a Threat', as attacks occur from simply being in the wrong place
at the wrong time!

Recognise a potential threat.

Reduce Risk By Assess the situation.
Respond appropriately with the control measures.

The Threat, Balancing the Protection and The Trade Off

The Principals profile and the perceived threat will determine the level of protection
required. By having an accurate assessment of the threat the Close Protection team
can provide a level of protection which can be increased or decreased depending
on the situation. Unfortunately, a “trade-off” between what the Principal is happy
with, the financial resources and the potential threat is common.

How much of a trade-off a Principal will have to make between protection and
lifestyle. The higher the level of threat the more the Principal’s lifestyle will be
compromised. The threat assessment must be able to establish which risks can be
eliminated, which can be lowered and which will remain constant. Some of these
risks will be inherent to the Principal while others to a specific place or event. For
example, the risks associated with being very wealthy and powerful are inherent to
the Principal. Risks that occur when the Principal travels to a place controlled by
business rivals are inherent to that place.

Cat 1 Significant threat – an attack is imminent.

Threat Categories Cat 2 Medium threat - an attack is probable.
Cat 3 Low threat - an attack is possible.

Personal Protection Operative / BG

Personal Escort Section
Protection Residential Security Team
Recommendations Security Advance Party
Cat 1 Surveillance Team
Armoured Vehicles

Personal Protection Operative / CPO /BG

Protection Personal Escort Section – scaled to requirements
Recommendations Residential Security Team – scaled to requirements
Cat 2 Security Advance Party – scaled to requirements
Surveillance Operative

Personal Protection Operative req. to do other duties

Protection PES & RST if required
Recommendations Routine searches
Cat 3

Note: It is necessary to recognise that there are problems with determining the
appropriate threat level as well as implementing procedures required. For instance;
a Cat 2 client can only afford Cat 3 protection.

THE ATTACKER, THE HOSTILE, THE ASSAILENT, THE ASSASSIN

Mounting an attack on a prominent person requires preparation and planning. For

example:-
  A potential assassin must choose a target.
 Know where the target is going to be at a time and place.
 Choose a weapon of attack.
 Carry out surveillance on security.
 Formulate an attack plan.
 Consider whether and how to escape.

Once a threat has been recognised the following questions should be addressed:

 Does the attacker know the Principal and if so how well?

 Will the attacker know the Principal’s work and lifestyle patterns?
 What information about the Principal is readily available?
 How vulnerable is the Principal to an attack?
 What is the attacker’s motive?

Motive and Target Selection

In a study of “thinking and behaviours” in 83 American attackers they identified 8

motives:-
1. To achieve notoriety or fame.
2. To bring attention to a personal or public problem.
3. To avenge a perceived wrong.
4. To end person pain.
5. To save the country or world, to fix a problem.
6. To develop a special relationship with a target.
7. To make money.
8. To bring about political change.

Many attackers and near-lethal approaches craved attention and notoriety, while
others acted to bring attention to a particular problem. Some assailants of public
officials and figures were consumed with seeking revenge for perceived injuries or
harm.
A few attacked, or nearly attacked public officials or figures in hopes of being killed
by law enforcement or being removed from society by being incarcerated.
Several believed that assassinating their target was a way to save the world. Others
responded to beliefs or imagined voices that they felt ordered to attack a national
leader. Some subjects approached a celebrity with a weapon to try to force the
target into a special relationship.
Finally, a few attacked public officials or figures for money, either because they
were paid to kill the target or as part of an attempt to secure ransom money…….
ECSP Examination

Targets Are Selected Based On Motive.

A person or organisation who thinks that attacking a public official or figure is a

desirable, acceptable, or potentially an effective way to achieve a goal can be
considered a potential assassin. If such a person has or develops the capacity to
mount an attack on a public official or figure, the threat increases.

What do we know about the attacker?

 Is there history?
 Have the attacked before?
 How sophisticated is the attacker?
 What resources have the attacker?

Potential Attackers / Threats - Why and how but not limited to:-

Attacker Why example How example

Disgruntled Employee Dismissed from employment. IT virus
Sell information to
competitors.
Discretisation.
Physical Attack.
Personal Vendetta An affair. Daily disruption.
Vandalism.
Discretisation.
Physical Attack
Stalker An affair. Daily disruption.
A fixation. Theft.
Physical Attack
Activist Campaign. Disruption.
Protests. Inconvenience.
 Social cause. Discretisation.
Attack i.e. paint / blood /
damage.
Kidnappers Financial Gain. Abduction.
Bargaining Tool.
Criminals Financial Gain. Theft.
Arson.
Terrorists Political. Shooting.
Stabbing.
IED.
Suicide Bomb.
Kidnapping.
Fire (Miscellaneous Threat) Accidental
Weather (Miscellaneous) Mother Nature
Health (Miscellaneous) Heart Attack
Accident (Miscellaneous) Car Crash

From the assessment, you have established that there is a threat and now ask
yourself:-

Motivation Yes / No
Does the attacker have The Capability Yes / No
The Opportunity Yes / No

If the answer is yes to the three questions then there is a real danger of some kind of
attack therefore your job becomes more difficult. However, you MUST prevent an
attacker’s opportunity by implementing security measures.

Checklist X
Principal’s Profile X Security
Principal’s Itinerary, places, venues, trips. X Measures and
Details / Plans of the Principal's Residence & Office. X Actions On
Details of potential attacks, who, why, when. X

The purpose of the Threat Assessment is to identify what possible threats you are up
against, including those that are indirect threats, so that you can plan effective
measures to secure a safe environment.

Example: On route to an important board meeting: Note: Communications

 Risk/Threat Security Measures Actions On
The drivers will attempt to remain in a Attempt to re-join the
Vehicle Convoy convoy of two vehicles without convoy.
Separation separation.
Communicate with team and
The team will ensure that they are in Ops room and advice.
constant communication between
vehicles and the Ops room. Head to rendezvous point.

The TL will identify suitable check

points and rendezvous points along
the route.
Use professionally trained and skilled Ensure Principal and team
Road Traffic drivers. members are injury free.
Accident
The team will ensure that they are in Provide first aid.
constant communication between
vehicles and the Ops room. Call emergency response.
Communicate with team
Ensure vehicles are serviced and and Ops room and advice.
adequate for the job.
Assess the vehicle damage.
Drivers will keep to the legal speed Alternative vehicle and / or
limits and ensure manoeuvring space vehicle recovery.
between vehicles.

Seat belts are worn.

Scenario:
The Principal has an important board meeting at the organisations offices. The
meeting has been publicised so there will be a crowd of environmental activists
outside the office.

 How are the environmental activists going to react?

 Will they become angry and unruly?
 What can be done to prevent the activist from becoming unruly?
 What measure can be taken to get the Principal into the office building with
minimum disruption?
 What are the actions to be taken if the Principal is attacked?

Risk / Threat Security Measures Actions On

Chapter 3

IED and BOMB AWARENESS

The IED is the most popular method of attack by terrorists worldwide since the
information regarding the construction of basic IEDs can be found on the
internet and the materials needed are sold over the counter in most places.
The size of an IED can range from as small as a cigarette packet to a large
truck as well as being disguised as virtually anything.
The success rate is high, they attract publicity and there is no need for close
contact as the attacker can be hundreds of miles away.

There are two types of explosive – high and low.

High explosives such as dynamite, RDX, Gelatine, C-4, Semtex and PETN
undergo a rapid chemical change upon detonation. This change is from a
solid or liquid to a gaseous state. The gas rapidly moves away from the point
of detonation at speeds of up to 26,500fps as in the case of C-4. The moving
gas is the force that damages or destroys everything in its path.

Low explosives burn quickly instead of exploding such as in gun powder. The
burn rates of low explosives are usually under 3000fps. Low explosives are
usually sensitive to heat, shock and friction and less stable than high
explosives.

An explosion occurs when a large amount of energy is released into a small

volume of area in a very short space of time. Burning very fast, explosive
material releases concentrated gas that expands quickly to fill the
surrounding air space and apply pressure to everything in it whereby it
explodes in a blast powerful enough to blow away cars, buildings and
anything else in its path.
Simplified IED Definition

An Improvised Explosive Devise is triggered by a firing system e.g. a pressure

plate, mobile phone, radio, command wire, timer. A signal is sent to the
initiator/detonator which activates the main charge (e.g. artillery, grenades,
mines, homemade explosives, or combinations of several explosives and/or
fuel) the whole system is powered by a power source (e.g. car batteries).

If working within a hostile environment or the threat assessment dictates that

your Principal is in possible danger of being attacked via an IED you must
formulate an emergency procedures plan in the event of an incident.

Improvised Explosive Devices (IED’s) commonly use but do not always require
the following:

 Timer and Power Unit.

 Detonator or Igniter.
 Explosive or Incendiary mix.
 An optional arming device.
 An optional antihandling device.

Timer

Timers used include:

 Mechanical timer i.e. alarm clock, watch, barometric etc.

 Electronic timer i.e. video timer, digital watch/clock etc.
 Chemical timer i.e. an acid that will eat through to initiate a device.

Ahmed Ressam, known as the “Millennium Bomber”, acquired several Casio

F91 digital watches that he planned to use as the timers for the bombs he
planned to use to blow up Los Angeles International Airport (LAX). He was
trained to use that model of watch at an Afghan training camp.
Power Unit

Power units include:

 Watch batteries.
 Flat batteries used in novelty birthday cards.
 Solar powered cells.
 Car batteries.

Detonators and Igniters

A detonator is a small explosive charge contained within a metal tube wired

to a power supply. This small charge is required to supply an initial boost to
the main explosive charge.

An igniter is needed for an incendiary mix and can be as simple as a light

bulb filament being placed within an incendiary mix. As a current passes
through the filament glows hot and ignites the mixture.

Explosives and Incendiary Mix

Explosives are fairly easy to come by if the right resources are available. For
example, due to the lack of security at quarries and mines especially from
some eastern bloc countries that supports certain terrorist organisations.

Homemade explosives such as ANFO and CO-OP mix are easy to produce
and are very effective.
Incendiary mixes are usually all homemade from simple household items such
as weed killer and sugar. These devices can be as small as a cigarette
packet.

Optional Arming Switch or Anti-Handling Device

An IED may need some kind of arming switch especially if it needs to be

transported prior to being planted and armed.
Command Operated IED’s

Command operated IED’s are usually detonated by radio signal or

command wire. Suicide bombs are a form of command operated IED’s.

Victim Operated IED’s

Booby-trapped or victim operated devices are detonated when a person
activates them, for example a car drives over a device. These devices are
considered as antipersonnel mines under the Mine Ban Treaty and are
therefore prohibited under international humanitarian law. With their random
trigger mechanism they are not able to distinguish between armed actors
and civilians.

TYPES OF BOMB

From recent events we have seen how devastating portable devices can be
and all it takes is for the attacker to have knowledge of where and when
your Principal is going to be at a certain location.

A device can be planted way in advance of its detonation as we have seen

from the Brighton Bombing in 1984 where a long delay bomb was planted in
the Grand Hotel by an IRA member.

Car Bombs

Car bombs have proven to be one of the most harmful kinds of IED for
civilians causing as average of 30 casualties per incident.
These types of bombs are known as vehicle-borne improvised explosive
devices (VBIED)

VBIED’s can be divided into two main categories:

1. Those used to kill occupants of the vehicle i.e. an assassination.

2. Those used to kill people and cause damage outside a vehicle.

In the 1980’s the Colombian drug lord Pablo Escobar used VBIED’s extensively
against government forces ad populated centres in Columbian and Latin
America. The most notable was the DAS Building bombing which killed 63
and injured approximately 1000 people.

Roadside Bombs
Roadside bombs, on the other hand, have a small payload in comparison –
causing an average of six casualties per incident. They are also less targeted
and less likely to be used in populated areas. Unlike, other IED types, the
roadside bomb causes a greater percentage of armed actor and security
personnel casualties. 84% of casualties from car bombs were civilians,
compared to 55% from roadside bombs. In total, roadside bombs accounted
for 6% of civilian casualties from IEDs, but 22% of armed actor casualties.
Roadside bombs were recorded in 29 countries and territories around the
globe.

Letter Bomb

A letter bomb, parcel bomb, mail bomb or package bomb is an IED sent via
the postal service or via a courier and designed to assassinate or injure the
recipient when opened.

Suicide Bomb

A suicide bomb is when the attacker accepts their death as a direct reslt of
the method used to harm, damage or kill targets.

Suicide bombings represented only 28% of all IED incidents recorded, but
they accounted for 66% of all deaths and injuries from IED attacks. The
countries worst affected by suicide bombings last year were Iraq, Syria,
Afghanistan, Turkey and Pakistan. 30% of all incidents recorded were in Iraq.
70% of all recorded suicide incidents took place in populated areas. In these
attacks around 90% of those killed and injured were civilians. Suicide attacks
in populated areas caused an average of 51 civilian deaths and injuries per
incident. This means suicide bombings are the most injurious of all IED types
and, indeed, all explosive weapon types.
Pipe Bombs

Pipe bombs are metal tubes filled with some type of explosives and mixed
with nuts, bolts, and nails. These devises can be very portable, easily
concealed and very effective.

Drone Bomb

Drones have been employed by those who seek to spread terror by

delivering IED’s as well as gather information.

The size of an explosive device that can be deployed by a drone is relatively

small compared to most IED’s, however the ability to deploy such a weapon
to a specific location at speed and with accuracy is significant.

Advantages of Drone IED’s

 Drones allow a terrorist to avoid and circumvent traditional security

measures, or even battlefield defences, simply by flying over them.
 The operator can remain behind cover, out of sight of targets and
enemy, to conduct the attack from a position of safety: they do not
even require “line of sight” to a target, thereby lessening the risk in
conducting the attack.
 Recent advancements have enabled operators to drop IEDs from a
drone with great accuracy; such attacks are therefore efficient and
the accuracy outweighs the relatively small size of the IED.
  Modern consumer drones are relatively quiet and very hard to spot in
certain battlefield conditions, enabling the attacker to achieve
tactical surprise.
 The drone operator can film the attack from on-board cameras,
generating propaganda of the deed to suit modern social media.
 The images transmitted to the operator can also prime their attacks
and provide surveillance of the targets.

IED/Target Indicators and not limited to:

 A signal such as vehicle lights, a torch flashing to indicate that the

target is in the attack spot.
 Empty streets except for an individual stood in a particular place on
their mobile phone.
 Absence of children, where children normally play.
 Unusual markers or objects next to a road i.e. a refuge bin left out close
to a road on a non-collection day.
 Obstacles blocking roads.
 Disturbed vegetation.

IED Possible Placement Areas and not limited to:

 Buried near roads.

 Left in parked vehicles.
 Refuge bins.
 Inside traffic cones.
 Buildings.
 Manholes.
 Vegetation areas.
IED COUNTER MEASURES

5m check:

 Conduct a visual check for 5m working from the ground to head

height.
 Check for disturbed earth and other suspicious objects.
 Be systematic and take your time as IED’s are well camouflaged.

20m check:

 After 5m check continue a visual check out to 20m.

 After a visual check conduct a physical check.

DO NOT:

 touch an IED
 cut any wires

Security Measures for Suspect Packages

When looking for a suspect package, or with the discovery of a device

mobile telephones must be switched off. Under no circumstances should any
suspicious items be touched or moved in any way. Apply the 4 C’s protocol:
Confirm, Clear, Cordon and Control.

CONFIRM CLEAR CORDON CONTROL

Confirm

 Confirm whether or not the item exhibits recognisably suspicious

characteristics.
 Is it hidden? Has the item been deliberately concealed or is it hidden
from view?
 Is it suspicious? Does it have wires, circuit boards, batteries, tape, liquids
or putty-like substances visible?
  Could it pose an immediate threat to life?
 Is the item typical of what you would expect to find in this location?

Clear

 If the item is classed as suspicious, clear the immediate area.

 The item should not be touched.
 Move your Principal, the Principal’s family, staff and security team
away to a safe distance. Even for a small item, such as a briefcase,
move at least 100m away from the item.
 Remain out of the line of sight of the suspicious item as if the item
cannot be seen, the better protected you will be.
 Hide behind something substantial if possible, away from glass such as
windows and skylights,

Cordon

 Cordoned off the area ensuring that no-one can approach the area
until it is deemed safe.
Minimum cordon distances:-
 100m - Briefcase Sized Devices.
 200m - Large items up to motor vehicles.
 400m - Vans and heavy goods vehicles (HGV’s).

Control

 Control the cordoned area.

 Mobile phones and radios should not be used within a 30-metre radius
of the suspect package, and if used beyond this point should only be
used behind a hardcover
 Eyewitnesses should remain on hand so that they can tell the police
what they saw.
BOMB THREATS

Most bomb threats are made over the phone and the overwhelming majority
are hoaxes, often the work of malicious jokers, although terrorists do make
hoax calls with the intent of causing alarm and disruption. Any hoax is a crime
and must be reported to the police.

Calls may be of two kinds:-

1. Hoax threats designed to disrupt, test reactions or divert attention.
2. Threats warning of a genuine device – These may be attempts to avoid
casualties or enable the terrorist to blame others if there are casualties.
However genuine threats can provide inaccurate information about
where and when a device might explode.

Bomb Threat Procedures

Ensure that all staff who could conceivably receive a bomb threat are
trained in handling procedures or have ready access to instructions.
Draw up a clear list of actions to follow upon receipt of a call. Even though
staff may be unable to assess a threat’s accuracy or origin, their impressions
of the caller could be important. A suggested bomb threat checklist is
available on www.cpni.gov.uk.

 Stay calm and listen.

 Obtain as much information as possible – try to get the caller to be
precise about the location and timing of the alleged bomb and whom
they represent. If possible, keep the caller talking.
 Ensure that any recording facility is switched on.
 When the caller rings off, dial 1471 (if that facility operates and you
have no automatic number display) to see if you can get their number.
 Immediately report the incident to the relevant manager or security
team to decide on the best course of action and notify the police. If
 you cannot get hold of anyone, and even if you think the call is a
hoax, inform the police directly.
 Give your impressions of the caller and an exact account of what was
said.
 If you have not been able to record the call, make notes for the
security staff or police.
 Do not leave your post – unless ordered to evacuate – until the police
or security arrive.

Evacuation Plan

An evacuation of the premises may be required because if:-

 A threat is aimed direct.

 A threat is aimed at a target within the vicinity.
 A suspicious item has been discovered in or in the vicinity of your
location/building.

Depending on the size and location of the premises, the plans for evacuating
should confirm both the circumstances and arrangements for conducting
either a full evacuation, partial evacuation or evacuation to an internal safe
area such as a protected safe room.

An important consideration when planning an evacuation route is to ensure

people are kept away from other areas where a second device could
detonate – arrangements should include a quick search of the muster point
(500m away from the building), to ensure it is free from any further devices.
The general principle is if the:-

 The device is within the building then consider evacuation, if the

  The device is outside the building it may be safer to remain inside.

Whatever the circumstances, tell the Police what action you are taking as
soon as possible.

The morning after the IRA bomb attack at the Grand Hotel in Brighton.

Car bomb in Baghdad.

Chapter 4

TERRORISM

Terrorism: The unlawful use, or threatened use, of force or violence against

individuals or property, in an attempt to coerce or intimidate governments or
societies, to achieve political, religious or ideological objectives.

The threat from terrorism remains both real and serious with attacks taking
place at any time without warning and directly or indirectly affecting
organisations
Acts of terrorism vary in terms of scale and purpose. Some merely inflict
superficial damage, some to cause public distress, some to draw attention to
a particular cause and some carry more malicious intent.

Terrorism is not just about violent attacks on people and property.

 Disrupted communications systems.
 Damaged assets.
 Tarnished reputations can cause immediate and/or long-term harm to
a business and so equally desirable from the terrorist point of view.

The most significant threat comes from international terrorism and its stated
ambitions to mount ‘high impact’ attacks that combine mass casualties with
substantial disruption to key services such as energy, transport and
communications.

Threats to Business – Not always your typical terrorist.

Businesses face a range of other threats that possess the potential to cause
significant disruption such as:-
 Activist groups driven by political or social issues.
 Organised crime.
 Foreign intelligence agencies looking to advance domestic interests.
 Competitors seeking a commercial edge.
 Amateur hacker showcasing their skills.
 Staff members, present or former, with a score to settle or opportunity
they couldn't resist, can present a serious risk to an organisation.

Basic Terrorism Methodology

Terrorist Aim: To enforce change through violence and intimidation

This can be achieved through targeting:

 Personnel - Attacking civilians has a greater impact on shock and awe.
 Locations - Popular and densely populated locations for greater
impact.
 Infrastructure (including IT) - To undermine government or authority
giving the appearance of weakness or fragility.

Terrorist Tactics

Terrorist tactics tend to favour attacks that exploit vulnerabilities and avoid
effective counter-measures. These terrorist groups have the potential to make
use of different types of terrorism tactics depending on the circumstances
and the likelihood of their success. These include:

 Shootings
 Hijackings
 Kidnappings
 Bombings
 Suicide Attacks

Unconventional attacks include:-

 Bioterrorism – biological agents

 Argo-terrorism – to destroy the agricultural food industry/food supply
 Nuclear terrorism – nuclear weapons
 Cyberterrorism - an act of Internet terrorism

Case Study #1 -London Bridge Attack

June 2017, London Bridge attack, was an Islamic terrorist attack in London,
United Kingdom. Whereby a van left the road and struck several pedestrians
on London Bridge. After the van crashed, its three occupants ran to the
nearby Burra Market area and began stabbing people by the local
restaurants and pubs. Eight people were killed and 48 were injured, including
four unarmed police officers who attempted to stop the assailants. The three
attackers, who wore fake explosive vests, were later shot dead by police. The
incident came less than three months after five people were killed in a similar
vehicle-ramming attack in Westminster.
Case Study #2 - Brusthom Ziamani

Brusthom Ziamani, 19, was carrying a rucksack containing a 12-inch knife and
a hammer, when he was arrested on a street in East London in August 2014.
The Old Bailey heard he idolised the killers of Fusilier Lee Rigby and had
researched the location of Army cadet bases in South-East London. Mr
Ziamani, of Camberwell in South-East London, pleaded not guilty. Jurors
heard Mr Ziamani had converted to Islam in early 2014 and his arrest came
after he showed his ex-girlfriend the weapons, described Fusilier Rigby’s killer
Michael Adebolajo as a “legend”, and told her he would “kill soldiers”.

Case Study #3 - Manchester Arena Bombing

The Manchester Arena bombing was an Islamist terror attack in Manchester,

United Kingdom. On 22 May 2017, a shrapnel-laden, homemade device was
detonated as people were leaving Manchester Arena following a concert by
the singer Ariana Grande. Twenty-three people were killed, including the
attacker, and a total of 512 people were either physically injured or left
profoundly traumatised with 112 treated in hospital.

Case Study #4 - Radicalised UK Citizen

The world knew him as “Jihadi John”, the masked man with a British accent
who beheaded several hostages held by Daesh and who taunted audiences
in videos circulated widely online. But his real name was Mohammed Emwazi,
a Briton from a well-to-do family who grew up in West London and graduated
from college with a degree in computer programming. He was believed to
have travelled to Syria around 2012 and to have later joined Daesh.

Terrorism Targeting Corporations

Terrorism targeting corporations continues at an alarming rate and have

been the victims of an increasing number of bombings, kidnappings and
other serious criminal acts.
Chapter 5

ADVANCE SECURITY – SECURITY ADVANCE PARTY (SAP)

A Principal is vulnerable to kidnapping, assassination and harassment whilst

located near or in transit. Statistics show that between 50% and 80% of
kidnappings occur whilst the victim is in or near their vehicle.

The security advance party are assigned to move ahead of the Principal and
close protection team to ensure no problems will be encountered along the
route, at a venue, a meeting place, or at the Principal’s residence.

Advance security is essential in all security operations and can be carried out
either covertly or overtly.
When planning an operation the Security Advance Party (SAP) will travel the
planned routes to all locations that the Principal has planned, carry out threat
assessments of all potential threats that might occur, plans on how to avoid
them and if necessary counter them.

Where finances and manpower permits and the threat level dictates the SAP
team will go ahead of the Principal and security team by 10 to 20 minutes to
check the route and final destination. The SAP can then set up surveillance
before the Principals arrival. If any threats or other problems are seen the SAP
team leader will inform the PES and/or the BG enabling them to take the
alternative route or head for safety.

Advance security should be performed covertly as to not give away the

Principal, their status, or itinerary, therefore it is important to blend in with the
local environment.

It is advisable to have cover stories and/or alternative names when booking

hotel and restaurant reservations rather than the Principals name.

ROUTE RECONNIASANCE
Recces and threat assessments must be carried out for every journey.
We can break our route reconnaissance down into four phases.

 Phase 1 – The Itinerary

Obtain the itinerary.

Liaise with the aide who schedules the travelling, guest appearances,
meetings etc., and ensure a good working relationship, both
understanding each-others roles and responsibilities.

 Phase 2 -Selection of Routes

Map Study - ensure maps are up to date. Pick the fastest route with
the least amount of vulnerable points. Use a route planner (mobile
phone) to check for distance/times, delays and roadworks.
Use Google maps for aerial views.
Alternative routes.

 Phase 3 – Route Reconnaissance

A detailed inspection including travel times of the main and alternative

route. Break the route down into sections for radio checkpoints.
Note type of areas that are driven through / passed.
Check for radio black spots.
Speed restriction areas, dual carriageways, A-roads / B roads.
Road works and congestion areas.
Detail alternative routes.
Routes to emergency services or safe houses.

 Phase 4 – Planning

The planning phase will consist of all the fine details including the route
 threat assessment - vulnerable points, escape routes and details of
emergency services and safe houses along the routes.
.
Don’t Be An Easy Target

Discourage your Principal from establishing a routine that will make them an
easy target. When studying assassinations and kidnappings it becomes
obvious that the terrorists/abductors had observed the movements of the
target knowing where he/she would be at a certain time.
(See Hostile Surveillance)

Whenever Possible Vary Routes.

 Do not leave the office/residence at the same time every day.

 Look for alternative routes.
 Make a random stop if safe to do so.
 If the Principal likes to go for a 5k jog in the morning, vary the route,
place and time.
 Do not park in the same place every day unless parking is secured and
manned. Even then a security check procedure should be put in
place.
 Use alternative entrances if possible.

Varying routines will not only make it harder for some type of ambush to be
orchestrated but will also ensure that the protective team maintain a high
level of alertness.

The Route Recce

The route recce is a key element in all journeys being mindful of anything that
may have an effect on the journey including and not limited to:-

 Road works.
 Diversions, one-way streets and dead ends.
 Traffic lights.
 Built-up areas, tall buildings.
  Roundabouts and junctions.
 Bridges, crossings and tunnels.
 High crime and lawless areas.
 Radio black spots and checkpoints.
 Safe-houses (Police stations, Embassies) and Hospitals.

Assessing Vulnerable Points

Put yourself in the shoes of the attacker and establish if areas especially
choke points, could be used as attack sites. (Chokepoints = one way systems,
bridges, tunnels, railways crossings).
Consider the following:-

 What is the objective of the attack, to kidnap? to kill? to make a

statement?.
 Concealment.
 Level of control of the attack.
 Escape route.
 Level of successful.

Drawing Up A Linear Recce Map

The diagram below shows a very basic recce map.

  Start point – for example, office.
 At 1 mile you come to a roundabout and take the third exit.
 You pass through a built-up area of high rise office blocks.
 At 3 miles you turn left.
 You drive through an area with a park on your left and a residential
area on your right.
 At 6 miles turn right at the traffic lights.
 At that junction at 6 miles to your left is the hospital in 1 mile.
 At 8.2 miles take the second exit off the roundabout.
 At the 8.2 mile roundabout is an alternative route to the venue.
 At 9 miles is a radio blackspot area for 1 mile.
 At 10 miles you carry out a radio check and confirm you are on route.
 At 11 miles to the left is a Police station in 0.6 miles.
 At 12 miles you reach your venue in 28 minutes.

Considerations:-

 What type of hospital is it and what emergencies can they deal with.
 Choke areas.
 Possible ambush / vulnerable areas.
 Emergency response times from the hospital and police station.
 Alternative and escape routes.
 Radio blackspots.
 Checkpoints.
 Travel times including alternative route times.
 Built-up areas.

Having gathered all the information and formulated your linear recce leave
copies in the Ops room as well as copies in the vehicles. Remember to
remove these and place in secure holding away from unauthorised
personnel.
The process of route selection can be achieved by using the mnemonic

S.A.F.E.R.

S = Situational Awareness
Understand that the threat exists and make sure you are aware of the threat
ranges and history of the threats.

A = Avoid Routine
Make sure you avoid routine by using the same routes and times all the time,
this applies more when conducting daily types of journey. Try to have a
system in place for randomly selecting routes so that a pattern doesn’t
emerge.

F = Follow Security Procedures

In order to follow security procedures you need to make them workable and
realistic. You should also practice them to ensure that all team members
have the confidence in them.

E = Exercise Common Sense

Where applicable exercise common sense when on the road and ensure
that you keep your awareness open to the environmental change.

R – Remain Anonymous
Weather overt or covert don’t go looking for trouble as it will surly find you so
try to remain anonymous in your tasks along routes.

TYPES OF JOURNEY
There are three types of journey that the SAP encounter:

1. Daily - Routine.
2. Hasty – Short Notice.
 3. Special – Planned.

Daily – Routine
The daily routes taken i.e. from the residence to the office. These types of
journey require more attention to prevent routine setting in.

 Avoid routine of times, routes and if possible vehicles.

 Keep records of al journeys.
 Photograph or video pre-recce’d routes.

Hasty – Short Notice

These are unplanned short notice trips therefore it’s a case of making good of
a bad situation.

 Confirm urgency of the trip and whether it is essential.

 Consider the threat and risk associated with taking the short-notice trip.
 Conduct a map study and time appreciation of the route and journey.
 SAP move a head of the Principal.
 Access previous reports if possible.

Special – Planned
These are pre-planned journeys where the SAP have had notice to carry out
full recces and planned for every eventuality.

SECURING VENUES and EVENTS

SITE SURVEY

The site survey should be carried out as far in advance as possible and should
include the drop off / pick up points, entrance and exits vulnerability
assessments, exit routes, building plans, building staff security checks,
emergency fire procedures, safe rooms, emergency evacuation plans /
routes, building alarm systems, routes to the local Police or Fire Departments,
who will be attending the meeting, meeting durations etc. Take photographs
of the inside and outside of the building, details of other buildings close by.
Also liaise with various law enforcement, intelligence, or civilian security
contractors that may provide valuable information concerning to that
specific itinerary site.

Office

In an ideal world we would have a say in the location, construction and

layout of the Principals office, unfortunately this is rarely the case. In an ideal
world we would consider:

 Located centrally of the building or floor.

 Not overlooked by other buildings.
 Waiting room away from the Principals office with its own toilet facilities.
 Security office.
 Restricted access to the building if possible. If not restricted access to
the Principles office suites.
 Safe-room.
 Shatter-resistant windows and ballistic wall coverings.
 Silent alarm and panic button systems in the secretary’s, security and
Principals office.

Considerations

 Building plans.
 Co-residence information.
 Security procedures including vetting, and security equipment in place.
 Staff details.
 Variety of approach routes.
 Parking facilities.
 Embus / debus points.
 Other building in the vicinity.
 Fire and other emergency evacuation procedures.
 Site a post room.
  Package/courier delivery procedures.
 Maintenance i.e., air conditioning.
 Cybersecurity.

Hotels

As a Close Protection operative you will spend time in hotels, not just as
temporary accommodation but also for business and social meetings.
Here you could be sat in hotel corridors or foyer for hours at a time.
This is an area of the industry that requires a lot of discipline.

 You must stay switched on and remain alert.

 Be clean, well presented and professional.
 Be respectful and polite to hotel staff and their clients.

A threat assessment should be compiled on hotels that the Principal is either

staying at or just visiting together with details of the protection teams SOP’s
(standard operating procedures) for the duration of the stay. Whether long or
short stay you will need to liaise with hotel management and security to work
out plans that are suitable for both parties during the stay.

Let’s look at the threat level being a CAT 2: Medium Threat with an attack
likely at some stage.
Below is a list of some of the procedures you will need to put in place:-

 SAP in place before the Principal arrives.

 Security searches and checks (IED’s, bug sweeps, staff ID checks, hotel
guests etc).
 Proximity building checks (knowing what is in these buildings i.e.,
businesses, vacant units, other hotels).
 All hotel entrances/exits manned by security team members
 Covert surveillance staff monitoring the outside of the hotel.
 Principals room to be above the second floor at the end of a corridor
and not looked into by other buildings.
  Emergency contacts and emergency response times including peak
hours.
 Hotel/venue security systems and staff.

Ideally the Principal’s room or suite should be located at the end of a

corridor to restrict the flow of public traffic passing the VIP’s door.
If the protection team have been provided with a room then this could also
be used as the control room and will contain all relevant assessments,
logbooks, maps, routes, SOP's etc. This room must be treated strictly as a
team room only. No unauthorised personnel including hotel staff such as
room service will be able to access this room without permission and
members of the security team being there. This goes without saying with
regards to the Principals room.

Whenever the Principal requests to returns to the hotel the BG should inform
the RST or corridor security10 to 15 minutes before arrival enabling a security
check to take place including rooms/suites, corridors, stairways, entrance
and evacuation routes in case of an emergency.

Control Room (see ops room)

If staying in a hotel for a long stay it would be ideal to have a dedicated ops
room/control room. Often this will be the team leader's or BG's room.

 Ideally opposite the Principals suite door.

 Two security operatives in attendance.

Considerations

 Complete a threat assessment of the hotel.

 Compile a set of SOP’s for the duration of the stay.
 Liaise with relevant hotel management and staff.
 Book rooms in an alternative name.
 Try and check out other guests.
  Ensure rooms are above the second floor at the end of a corridor.
 Other buildings with visual over the Principal's room/suite/floor.
 Set up the control room.
 Hotel CCTV / your CCTV equipment.
 Covert continued surveillance of the hotel both internally and
externally.
 Procedures for deliveries.
 Regular search procedures.
 Communication black spots.
 Control the use of room phones.
 Bill paying.
 Budgets on room service.

Events

Attending events and social functions with a Principal can be troublesome if

not assessed and planned properly. Many venues have their own security
staff and depending on their willingness to cooperate may make your job
much harder. Temporary venue staff such as waiters/waitresses, dishwashers,
bar and security staff can also be a hurdle due to not being properly vetted,
often untrained, and in some cases undocumented.

Considerations for Attending Events

 Compile a threat assessment on the venue include building

layout/plans and details and information on the actual event.
 What other guests will be attending and are they high profile, could
they be the cause of an indirect threat.
 Routes to the venue, emergency evacuation routes (route recce).
 Other buildings close to the venue.
 Venue search.
 Covert surveillance internally / externally of the venue.
  Liaise with venue management and carry out staff vetting. Will staff be
wearing ID?.
 Drop off points, parking and alternative pick up points, emergency
rendezvous points.
 Emergency reaction and evacuation plans.
 First aid facilities.
 Firefighting equipment.
 PES points. area checkpoints, radio call signs
 Emergency response times.
 Communication / radio black spots.
 Table / seating plans. Who is seated on the other tables?.
 If there is a bodyguard where will he/she be positioned?
 Are other security teams/bodyguards going to be there?
 Will the media be present as guests or will paparazzi be outside when
the Principal arrives and leaves.

Meetings

Extreme caution should be taken with regards to meetings especially if the

meeting is publicised due to so many people knowing where the Principal will
be on a specific day at a specific time.

Arranging a meeting is the easiest way to set a Principal up for:-

 Kidnapping
 Assassination
 Robbery, alternatively arrange a meeting and rob the residence or
place of work.
 Set up for blackmail.
 Harassment.

Meetings should be kept as secret as possible and planned well in advance.

Ideally other parties attending the meeting are aware of the importance of
secrecy. Often these are also last-minute meeting therefore time is against
you.

Considerations

 Is it a business meeting or social meeting?

 If a business how sensitive is the meeting.
 Can you sweep and search the meeting place.
 Will there be other security in place.
 Will the Principals security be allowed in the meeting?
 Is there time for a Threat Assessment?
 Where is the meeting taking place - public or private place?
 Surveillance in place before Principal arriving.
 Continued external surveillance during the meeting.
 Route Reconnaissance and emergency evacuation routes.
 Are communications good?.
 Emergency response times
 Time schedules, arrival times, break times, finish time.
 Will there be a lunch break? if so will there be caterers?
 Can the Principal’s vehicle get close the entrance?. If not how close,
where will the driver park after dropping off the Principal.
The list goes on….

Restaurants

Often the Principal has several favourite restaurants and that have been
assessed by the SAP already therefore it may only be necessary to make an
update of the information you already have. However, in many cases, a full
advance of the restaurant is required.

Considerations for Restaurants.

 Is there secure parking.

 Booking the reservation in an alternative name.
  Are there private dining areas.
 Table / seating arrangements. Is it possible to position the Principal
away from the window?
 Table/seating arrangements for the protective team.
 Will the PPO / BG sit with the Principal and guests.
 Who are the guests?
 Protective team to be one course ahead of the Principal. To be ready
10 to 15 minutes ahead of the Principal.
 Paying the bill.
 Communications with the driver.
 Emergency response times.
 Strictly no drinking for the protective team.

Airports

For long journeys, the Principal will in most cases travel by air. Commercial
aircraft journeys require airports and so follow routes and time schedules.
Therefore, the Principal may be vulnerable. Remember: the Principal is
vulnerable near or in transit. If possible and finances allow private aircraft are
preferable to commercial aircraft.

Getting the Principal in and out of airports quickly and safely and often
unnoticed is always an important consideration when travelling. As a result, a
significant amount of advance work will be required.

Considerations

 Drop off / pick up areas.

 Parking arrangements.
 Booking tickets.
 VIP Lounge.
 Luggage drop / pick up.
 Public crowded areas.
  Passport check-in.
 Going through security checkpoints.
 Liaising with airport management and security.
 Aircraft seating arrangements.
Then you have all the considerations at the other end.

Considerations for all Venues

 Variety of approach and escape routes.

 Able to seal off areas in an emergency.
 Control of entrances/exits, communal lifts and stairs.
 Venue / building plans.
 Vehicle embus/debus points.
 Vehicle parking.
 Venue security.
 Public access points and security levels.
 CCTV in place.
 Silent or personal alarm systems.
 Emergency response times for all emergency services.
 Liaising with authorities.
 First aid points.
 Fire procedures.
 Building/room sweeps for electronic surveillance devices.

SEARCH PLANS

In general regular searches are an important part of everyday security

checks carried out whenever the Principal makes visits to different venues for
business meetings, conferences or leisurely activities.
Degrees of a Search
Intensive Search High threat situation. As dictated by the threat
assessment.
Routine Search Medium / low situation. As dictated by the threat
assessment.
Short Notice Search Best search due to time constraints. As dictated by
the Principal.

Preparing a search plan

The search plan will depend upon the circumstances of each separate
location, but the objective is always to ensure that the entire area is
searched thoroughly and reported as safe.

In addition to the main public and operational areas, the plan should ensure
that surrounding grounds and car parks are included as well as stairwells, fire
escapes, corridors, toilets and lifts etc.

To keep searches manageable and safe the search team members always
follow the same search procedure. Divide the area/premises to be searched
into separate sections and provide searchers with written checklists – signed
by the TL upon completion ensuring no area is left unchecked.

Colour Code Search Areas

RED A definite kill zone, the immediate area which the Principal will be in.
AMBER Possible kill zone, the area outside of the kill zone.
GREEN All other areas.

Using a colour code search system is particularly useful for “Short Notice
Searching”.
The diagram bellow shows the areas to be searched in order when time is
limited. However be mindful with what the threat assessment dictates.

VIP Red Zone. First Area To Be Searched

Amber Zone. Second Area To Be Searched

Green Zone. Third Area To Be Searched

CONFIRM CLEAR CORDON CONTROL

RECAP

The duties and aims of the SAP are:

 Maintain a low profile.

 Gather information.
 Avoid unwanted surprises.
 Plan contingencies.
 Avoid hazards.
 Carry out route recces.
 Secure routes to and from.
 Recce and secure locations.
 Check comms.
 Liaise with agencies and other organisations.

Good planning, preparation and reconnaissance will aid safe passage.

Chapter 6

INTERNATIONAL TRAVEL & HOSTILE ENVIRONMENTS

Whenever travelling to another country you must compile a threat

assessment on the country or area that your Principal and protection team
will be visiting whether it for business or pleasure.

Minimising threats is essential for working in hostile environments for ensuring

the safety of your Principle, your team and yourself.

Once you have identified the risks and threats you then think through what
practical measures that can be installed to minimise those threats and put a
Threat Assessment in place.

The internet can provide you with information including:

 The country’s threat level.

 Crime rates including details of crimes.
 History.
 States of emergency (SOEs).
 Zones of special operations
 Political order incidents.
 Terrorism.
 Natural disasters.
 National Travel Health Network.
 Overseas business risks.

You can also use applications such as Google earth that will provide high-
quality aerial photographs as well as street views which can be used to
check out hotels, routes and locations.

Ideally members of the SAP will go ahead and prepare and implement
security plans as well as gather information covertly.
  An evaluation of the country and the particular area(s) you will be
working including terrain, climate, population, religions, employment
rates, crime stats, and the languages spoken

 Establish and identify a full list of types of threat in that particular

country / the region / the area include details of the amount or
popularity of attacks / types of attack i.e., IEDs, kidnapping, insurgent
attack, road traffic accidents, criminal activity, civil unrest etc. / known
terrorists – assailants that operate in that particular area and how they
operate, reasons for attacks, reasons for kidnapping, etc.. Also identify
natural disasters and disease of that particular country.

 Support available to you as a close protection officer. What support is

available, i.e., embassy, local police, local military units, other private
security companies / operatives working within the area.

Considerations:

 Immunisations or preventative medications.

 Trusted contacts who know the area.
 Drivers are they trained security drivers or trained in driving armoured
vehicles?
 Car rentals.
 Visas.
 Weapons permits, laws and restrictions.
 Laws on use of force.
 Will, your mobile phones work, is the network's coverage good?
 Radio communications, what are the laws.
 Currency, ATMs, credit cards.
 What standard the medical facilities.
 Can you take prescription medication into the country and will you
be able to purchase the medication there.
  Medical insurance.
 Is the tap water drinkable?
 Keep all information on a need to know basis.

HOW CRIMINALS OPERATE

From the information gained via the internet and further investigation through
embassies, you can establish how local criminal operate and what they look
for in their targets.
Criminals and terrorists commit crimes to make money or achieve a goal and
some are more sophisticated than others. Knowing how they operate and
what they look for will help formulate security procedures to negate them.

What Do Criminals Look For?

1. Is the target valuable either financially or politically?

2. Will, the target (and security) put up a fight?
3. Is there an escape route?

Below is a list of common criminal activities carried out in many countries.

Criminal Taxis Drivers Look for targets for kidnapping and robbery
Luggage Theft From jewellery to laptops to planting drugs
Corrupt Police For cash
Date Rape Rape and / or robbery
Honey Trap For cash, blackmail or discretisation

HOSTILE ENVIRONMENTS

A Hostile Environment is defined as a country, region or specified area subject

to war, insurrection, civil unrest, terrorism or extreme levels of crime, banditry
or lawlessness, or public disorder.

Below is a list of possible threats that you may find in hostile environments:

 Command Operated Improvised Explosive Device (COIED)

 Person Borne Improvised Explosive Device (PBIED)
 Suicide Vehicle Borne Improvised Explosive Device (SVBIED)
 Armed Opposition Groups (AOG)
 Kidnap and Ransom (K&R)
 Mortars
 Tribal/War lords
 Radical Islamic Networks

Terrorists and insurgents conduct frequent and widespread lethal attacks

against domestic and international political and civilian targets including
those working in the humanitarian and reconstruction fields.

The insurgency has a strong anti-Western focus which could make any Western
interest or person a target. Attacks include bombs (roadside and other),
suicide bombs (either on foot or by vehicle), indirect fire (rockets and
mortars), direct fire (shootings and rocket propelled grenades), kidnappings
and violent crime.

Let’s look at Afghanistan

The risk of being kidnapped throughout Afghanistan remains a very high and
constant threat. At least four foreign nationals have been kidnapped in Kabul
since July 2016, some of whom remain in captivity:

 6 November 2016 – a foreign national was kidnapped in Kabul

 8 August 2016 – two foreign nationals were kidnapped in Kabul
 21 July 2016 – a foreign national was kidnapped in Kabul
Over 100 westerners have been kidnapped in Afghanistan since 2001, a
number of them have been British nationals. The motivation and desire to
undertake kidnapping in Afghanistan is likely to continue.

There’s an ongoing threat from high-profile, large-scale attacks in Kabul.

There have been a number of significant attacks in the capital, including:

 28 November 2018 - a complex attack on the G4S compound in Kabul

killed at least ten people, including one British national, and injured at
least 35 others.
 20 November 2018 – a suicide attack on a wedding hall in Kabul killed
approximately 55 people and injured over 85 others.

 27 January 2018 – at least 105 people were killed and hundreds injured
as a result of a large vehicle borne explosive device which detonated
in a crowded area of downtown Kabul.

 20 January 2018 – six gunmen carried out an attack on the

Intercontinental Hotel killing around 20 including a number of foreign
nationals.

There have also been a number of attacks against aid workers and military
vehicles resulting in deaths and injuries, and there are ongoing military
operations throughout the north.

The eastern region has been extremely volatile for some time, with almost
daily suicide and roadside bomb attacks, shootings and rocket attacks. The
region close to the Pakistani border is extremely dangerous with a high
number of insurgents operating freely.

There are regular, large military operations in this region. There have been
numerous daily attacks against the Security Forces and US-led coalition
forces. There are also daily incidents of Improvised Explosive Devices (IED),
suicide and rocket attacks, and direct fire attacks on security forces patrols,
checkpoints and bases as well as on the local population.

On 24 January 2018, insurgents attacked the offices of Save the Children in

Jalalabad. Up to 13 people were injured in this incident.

On 10 January 2017, an explosion took place in the Provincial Governor’s

compound in Kandahar. The attack left eleven people dead, including the
Deputy Provincial Governor, five Emirati diplomats, an Afghan MP and an
Afghan official.

There have been roadside bombs, suicide attacks, rocket attacks and
criminal kidnappings throughout the western provinces and increased
lawlessness in Western Ghor. There is little security infrastructure in Dai Kundi
and westerners have been kidnapped there.

On 4 August 2016 there was an attack on a convoy of vehicles carrying

tourists (including 8 British nationals) in Herat. The group were on a tour
organised by a company based in the UK. The Taliban claimed the attack on
the vehicle, which involved small arms fire and an explosive device. The
convoy was being escorted by the Afghan military. Five tourists and the driver
were injured in the attack.

KIDNAPPING

If a criminal group is specifically targeting your Principal or even a member of

the security team for the ransom they will need to establish a time, a place
and a way to carry out their plans.
Security procedures including anti-surveillance must be in place and
adhered to.
Top five countries for kidnapping.

1. Mexico - Top of the list of countries where you are most likely to be
kidnapped in Mexico. Organised crime is rife and tourists are always an
attractive target. You may want to especially steer clear of areas such
as Tijuana, Juarez or Tampico.

2. Haiti -Kidnappers are a lot less picky in Haiti. Just looking less wealthy
will not guarantee your protection in Haiti. The country is fine if you stay
in your resort, but if you venture beyond the tourism safe zones, you
may be putting yourself at risk.

3. Brazil - Major cities such as Rio de Janeiro and Sao Paolo are the most
popular areas for kidnapping. Kidnappers work hard to target rich
people, particularly tourists. It is always a good idea to adjust your
appearance and do away with any showy items.

4. India - From kidnapping tourists to kidnapping women and children,

India has it covered. Kidnappers aren’t particularly well-organised, so
ransoms are usually pretty low.

5. The Philippines - Kidnappings are common throughout the Sulu

Archipelago and the southern Sulu Sea. Foreigners are often the
targets of these kidnappings.
Chapter 7

RESIDENTAIL SECURITY

In an ideal world, a security adviser would have a major part to play in the
selection of a Principal's residence, however, it is a case of making good out
of a bad situation and make good of what is already in place.

Considerations in Residential Security.

 Screened / walled and easy to secure.

 Not overlooked by high ground or buildings.
 Level of privacy.
 Multi-floored.
 Location.

Being isolated has its advantages because it restricts methods of hostile

surveillance unlike in a town or city especially in densely populated areas
where surveillance detection is more difficult.
In rural areas we are more likely to see strangers and unfamiliar goings on
stand out. However rural locations have the disadvantage of being isolated,
narrow country roads, dimly lit areas and away from emergency services
which are ideal for planning an attack.

The Residential Security Team (RST) will have in-depth, detailed plans,
drawings, photographs and maps of the residence, details of the
surrounding areas and a security procedures plan.

 Surrounding Area - details on and distance to neighbours, routes in and

out of the surrounding area, local amenities, places of interest and
emergency response times.
 Boundaries – consider radio/communication black spots,
weak/venerable areas, vegetation areas, CCTV positions, motion
detector, security lighting, gates and other entrances/exit routes.
  The Grounds – as above plus plans of outbuildings including types of
construction, parking, pools, and other recreational areas.

 The Residence – power mains and back-up, water mains, intruder,

panic and fire alarm system, fire extinguisher points, lighting, phone
lines, heating system, doors and window security, chimneys and flues,
room plans including master rooms, guest rooms, kitchens, bathrooms,
staff rooms, garages, cellars, attics, safe room including construction
details. Building plans should be shown in the side, front and rear
elevation plus floor plans.

 Security Procedures – SOP’s including gate detail, dealing with visitors,

incoming telephone calls, post and parcel deliveries, search
procedures, rotas and emergency plans.

All plans and assessment details are classed as “Restricted”. Be prepared to

constantly update and change details, i.e., building works, landscaping etc.

Have a set of plans and a brief ready for external agencies such as the
Police, Fire Brigade, Ambulance Service, and Rescue Teams if a situation
requires.

Access Control

As mentioned earlier the majority of attacks against a Principal happened

when they are mobile either via foot or vehicle.
With regards to residential security the entering and exiting of the residence is
a very vulnerable time not only for an attack but also the starting point of
being followed. Therefore access control must be very vigilant in not only
assessing visitors and deliveries but also paying close attention to what is
going on in the near vicinity of the residence.

Ops / Control Rooms

The ops/control room is the central hub operating 24 hours a day for all
security procedures and equipment including CCTV monitors, alarm control
panels, communications equipment etc. It will also be the place to report,
sign in / sign out, keys and key log, log and incident books. Incoming calls
also need to come in via the Ops room.
The room must also be restricted to cleared/permitted staff only. It might also
be that all letters are parcel come through via the Ops room unless a
designated, secure post room is in place.
Gate security either manned or electronic will be cleared via the Ops room
including ID checks, guest arrivals and appointments. The ops/control room
can be a busy noisy room, therefore, may be positioned away from intruding
on the Principal and his / her family, ideally, a purpose-built outbuilding.
If a purpose-built outbuilding is not available then use a suitable secure room
within the main building.

Safe Room

Where circumstance have made it impossible or too much of a risk to

evacuate the Principal and his/her family to a safe place a safe room is
where they will take refuge in the event of an attack.

The safe room must be constructed so that it can withstand an assault until
help arrives, (Emergency Response Time). An ideal safe room choice would
be a cellar with a steel door, reinforced ceiling and walls. A good supply of
water, toilet facilities, fitted with a panic alarm system, CCTV system, and a
communications system (be aware that mobile phones may not work in the
cellar). Also ensure that there is an extensive first aid kit including a
defibrillator.

Mail Handling

Explosives or incendiary devices through to dangerous chemicals can easily

be delivered via post. A device concealed in an envelope no thicker than a
quarter of an inch to a large parcel delivered by a courier service will have
devastating effects.

To an attacker, the letter or parcel bomb is an attractive option because the

assailant could be at a visual distance or hundreds of miles away when the
device is activated.

Ideally, depending on the threat, what the threat assessment dictates and if
resources allow have trained staff to screen and open all mail in a
designated controlled area.

Recognition

 Unusual and unfamiliar postmarks.

 Unexpected post.
 Unfamiliar handwriting.
 Incorrect spelling.
 The address stated but no name.
 Marked confidential or private.
 No return address.
 Oily stains.
 Unusual smells i.e., almonds or ammonia.
 Shape and / or weight for its size.
 Excessive wrapping with masking tape or string.
 Protruding wires or tin foil.
 Pinholes.

Control of Suspicious Mail

 Do not open any suspicious package.

 Do not bend a suspicious package.
 Do not place suspicious package near flammables
 Get the Principal to a safe area.
 \Do not use radios within 50 metres.
  Wear protective gloves and glasses.
 Seal suspicious mail in a plastic bag.
 Confirm, Clear, Cordon, Control.
 Inform relevant authorities i.e., Bomb Disposal, Health & Safety
Authority.
 Call emergency services.
 Contaminated clothing in a plastic bag and seal.
 Wash hands and other parts of the body that may have been
contaminated.
 Any chemical spillages turn off air conditioning.
 List persons affected and write a report.

Security Measures

 Physical barriers to keep all but authorised vehicles at a safe distance.

 Automatic Number Plate Recognition (ANPR) and protection from
flying glass.
 Train and rehearse your staff in identifying suspect vehicles, and in
receiving and acting upon bomb threats. Key information and
telephone numbers should be prominently displayed and readily
available.
 Establish and rehearse bomb evacuation drills.
 Record details of contract vehicles and the identity of the driver and
any passengers delivering to or visiting the residence.
 Depending on the level of threat consider a vehicle search regime at
entrances that are flexible and can be tailored to a change in threat
or response level. It may be necessary to carry out a risk assessment for
the benefit of security staff who may be involved in vehicle access
control.
 On finding a suspicious package carry out the 4-C’s (See Chapter on
Bomb Awareness).
See search procedures in Chapter 5

CONFIRM CLEAR CORDON CONTROL

RST TEAM LEADER

The team leader is responsible for ensuring all policies are followed not only
security policies but also those required by the Principal. These include:

 Conduct, protocol, accountability.

 Logistics.
 Threat assessment updates.
 Training.
 Security plans.
 Health and Safety.
 Law.

The team leader will also be responsible for the review of security procedures
and emergency plans. This is a review of defences and includes:

 Regularly reviewing security plans.

 Protective intelligence.
 Liaise with other agencies.
 Update SOP’s.
 Review emergency action plans.
 Update first aid training as required by legislation.
Chapter 8

WALKING DRILLS

A Principal is most vulnerable when travelling whether via vehicle or on foot.

Walking drills or foot drills as they are known by are protective formations
carried out by the Personal Escort Section (PES) by providing a protective
cordon around the Principal and the PPO / BG. These protective formations
will take on different shapes depending on the situation and/or environment,
number of protective operatives, level of threat, the Principal’s public profile
and finances.

High / Low Profile

Unless protecting pop stars the majority of the time the PES will be required to
operate at a low profile level. Whilst high profile can be a deterrent it will
draw unwanted attention to the Principal.

The PES and BG must be able to adapt to ever-changing situations while on

foot. These include:-

 Layouts and patterns of streets, roads and shops.

 Pedestrians.
 A range of different hazards from mother-nature or man-made i.e.,
footpath repair works, building scaffolding, street vendors etc., etc.
 The Principal decided to head off into a shop without prior warning.

In low-level threat environments it is recommended that the Principal be

protected by two operatives, a BG and one PES member.
In the situation where there is only one PES member, they will need to be
constantly moving into different positions to gain better observation/fields of
view while going through the ever-changing situations.
The PES must also be aware of signals from the BG or team leader. These may
be hand signals or gestures.
Whether there is a team of PES or a single PES member with a BG, walking
formations must be adaptable and flow in all situations such as:

 The change of direction with limited or often without communication.

 Moving to other PES positions.
 Responding to situations.

As stated in the Roles and Responsibilities chapter it’s the BG’s job to provide
cover and evacuate the Principal to a safe area. The role of the PES to
provide protection, engage the attack and assist the BG in giving cover and
evacuation.

The BG should always be within arm’s reach or striking distance to the

Principal and being mindful not to intrude on the Principals space.

PES and BG Distance and Spacing

The distance and spacing between the BG, the PES members and the
Principal will depend on the level of threat and the level of profile required.
With a pop star that likes to stand out and show that they are heavily
protected will require the PES to close ranks and show strength. While a
business executive may want a very low profile formation even to the point
where they do not realise they have a PES team around them.
Note. Often the Principal will want operatives in sight but not within a range
conversations can be heard. This is something that will need to arrange with
the Principal to what is comfortable for them without comprising safety.
However, ideally a BG needs to be within reach or striking distance.

All PES members must have a designated area of responsibility with the
ability to move into another team member’s position when needed without
hesitation or any confusion. The PES team must act as one constantly training
as a team and drilling different scenarios and tactics.
Each PES member is responsible for their arc of vision as well as being able to
see where your Principal is going, hand signs or gestures from the team
leader, and on vigilant watch for suspicious characters and general hazards.
CLASSIC PROTECTIVE FORMATIONS

The formations in this manual will give you a practical guide and a good
starting point from which you will be able to adapt to situations you
encounter.

The BG Position

The image bellow shows a BG with the Principal.

 Low-level threat.
 Arm's length or striking distance away from the Principal
 Slightly to the rear and side of the Principal.

Note: In this diagram the building to the left of the Principal act as hard
protection however it’s crucial to be mindful of doorways and alleyways.

Key: = VIP = BG = PES = Direction of travel

VIP, BG and 1 PES - Profile slightly raised. BG could move forward in line with
the VIP. PES out front.

Diagram below shows VIP, BG and two PES - A classic low profile formation
with PES 1 and 2 on the opposite side of the road.
Diagram shows VIP, BG and 3 PES - Classic high profile box formation.

VIP, BG and 4 PES - Four man PES team lowering the profile by spreading out.
Diagram shows the VIP, BG and 3 PES - High profile arrow formation for
cutting through crowded areas.

Classic high profile box formation

Arcs of Responsibility
PES team to provide cover through 360 degrees.

Responding to an Attack - Contact Front: PES 1&2 engage the attack as BG

and PES 3&4 move VIP out of the attack zone.

3 1

ATTACK

2
4
FIVE PRINCIPLES OF PROTECTION
There are five main principles we must consider when carrying out protective
duties:

1. Adaptable formations and concentric circles.

Remain flexible and adaptable.
Maintain 360 degrees of protection at all times.
Be observant.

2. Body cover.
Actions on procedures.
Control of the Principal at all times when maximum body cover is
required.
Control the Principal with words of command and firm physical
movement.

3. Maintain a professional image.

Protocol at all times.
Professionalism at all times.

4. All round observation using OODA.

Overserve.
Orient.
Decide.
Act.

5. Spacing.
Be flexible and able to adopt to the environment you are in.
VEHICLE BACK-UP

When possible, have the Principal’s vehicle close at hand and available to
evacuate if necessary. The SAP will be responsible for planning the back-up
vehicles routes, parking/waiting areas plus provide details of when the
Principal will be out of sight particularly in pedestrian-only areas i.e. city
centres.

Considerations:

 Waiting areas / limited time waiting for areas.

 Communications / radio black spots.
 One way streets.
 Safety areas.
 Dead ends.
 Pedestrian only areas.
 Evacuation routes.

RESPONDING TO ATTACKS

As stated earlier in this manual it’s the PES job to engage an attack, protect
the Principal and assist the BG in evacuating the Principal to safety.

 Team members nearest to the attackers engage.

 Excellent communications.
 BG and other team members provide body cover.
 Evacuate VIP from the attack zone.

Important Note:
Be mindful that an attack could be a diversion to draw the attention of the
PES then leaving the Principal exposed. Or, the BG moves to evacuate the
Principal to a safe place only to be moving the VIP toward a secondary
attack.
TYPES OF ATTACKS

Verbal Attack

Just because its only verbal abuse it doesn’t mean that it isn’t the start of a
more serious attack.

 PES to close in the protective formation.

 If the verbal attack continues, move your Principal to safety.
 If the verbal attacker follows the Principal move your Principal to
safety.
 Be mindful of the law and the views of the Principal when engaging a
threat.

Unarmed Physical Attack

This is when training as a team pays off.

 The PES team member nearest the attack will engage.

 Other PES team members will close down the protective formation
around the Principal and move to safety. Be mindful of an initial attack
being a diversion for the main attack.
 The PES team member who dealt with the attacker re-joins the team.

Weapon Attack

Whether the attack is with a knife or a handgun it’s a very difficult and
dangerous situation especially if the PES and PPO / BG are unarmed
(Country’s Law).

 The PES team member closest to the attacker must decide to engage
the attacker. (If unarmed how ?)
 Close down the protective formation “Tight and Close” around the
Principal providing full body cover.
 Be mindful of the distance between attacker and PES team / Principal.
  If armed use suppressive fire. The volume will play a very important part
when moving the Principal to safety.
 PES team and PPO / BG, giving full body cover evacuate the Principal
to safety.
 PES team member who engaged the attacker joins the team.

Note:
An aggressive response to an attack can divert the attacker from being the
aggressor to a defender looking to survive.

Sniper Fire

The distance is going to play a major role as well as knowing exactly where
the shot came from.

 Close in providing full body cover.

 Evacuate Principal to safety.
 Suppressive fire if the sniper's position can be identified.

Nuisance Attacks

Nuisance attacks come from photographers, autograph hunters, pushy fans

and the press or media. These can be very delicate situations and therefore
need handling carefully.

The lawsuit by paparazzo Aja Oxman states Bieber ordered his bodyguard to
take a memory card after the photographer snapped photos of the pop
singer leaping from a cliff into the ocean on the island of Kauai. Bodyguard
Dwayne Patterson placed Oxman in a chokehold and seriously injured him
and damaged his camera during the November incident, the lawsuit states.
Patterson was arrested on suspicion of assault and later charged with
second-degree robbery. He pleaded no contest to criminal property
damage and harassment and was ordered to pay Oxman $6,000 in
restitution, court records show. Bieber, 20, was not arrested and no charges
were filed against him due to a lack of evidence that he ordered Patterson
to attack Oxman, Kauai County Prosecuting Attorney Justin Kollar said
Wednesday. Kollar said Patterson had fully paid restitution to Oxman.
NBC News

 Embarrassment to the Principal.

 Bad publicity.
 Legal action.

SITUATION AWARENESS

Situation awareness is the perception of the elements in the environment

within a volume of time and space, the comprehension of their meaning and
the projection of their status shortly and is divided into three levels;-

 Level 1 – a perception of the elements in the environment.

 Level 2 – comprehension of the situation.
 Level 3 – a projection of future status.

Endsley’s definition1999.
Chapter 9

EMBUS - DEBUS
A Principal will carry the majority of his travelling from A to B via car, therefore
is another area/time where the Principal will be most vulnerable - entering
(Embus) or leaving the vehicle (Debus).
This is a time when the vehicles are stationary, for example the Principal is
being dropped off outside their hotel before the driver takes the vehicle to
the hotel’s secure parking area. It is during this time the Principal is in the
open and without the protection of their vehicle and when the Personal
Escort Section (PES) and BG will need to deal with unwanted attention from
the press and the public or some kind of attack.

To counteract any unwanted attention at Embus / Debus points a series of

drills have to be established and practised by the team to minimise the risks of
attacks or harassment. Each team member must know exactly their position
and the role they must play in the event of an attack.

Think like an attacker:

 When should I attack?

 When will the target be out in the open?

If the attackers know where the vehicle is going to be parked or where the
Principal is going to be dropped off or collected then they are in a much
better position to plan and carry out an ambush.

Do not make things easy for attackers.

It is extremely important to not be predictable and carry out the same

pattern of movements at the same time day in day out. If these reoccurring
patterns and habits are identified by attackers it will only help them plan and
execute an attack much easier.
Most attacks come from planning and surveillance therefore the security
procedures at embus/debus points must be effective including encouraging
the attackers to think the Principal is to well protected and the chances of
success are extremely low.

Orthodox and Unorthodox Embus and Debus

Orthodox - the Principal gets out of the vehicle with his door nearest to the
venue.
In the diagram below the VIP vehicle pulls up outside of the entrance to a
hotel. The BG exits the vehicle and ensures the way is safe before opening
the Principal’s door. Once the way is safe the BG follows the Principal into the
hotel.

Note: VIP’s do not like to be kept waiting.

VIP
BG
Unorthodox - the VIP gets out of the vehicle and then has to walk around to
the rear of the vehicle and across the road to get to the venue. In a two-car
scenario, there would be enough comfortable space between the two
vehicles to walk between.
Orthodox Debus – Two vehicles, VIP, BG and 1 PES
PES 1 from the rear vehicle moves to the venue ahead of the VIP and BG.
PES 1 will signal the BG that it’s safe to let the VIP exit the vehicle.

2
3

2 1
3
4
4

The PES debus first and into their positions. PES 1 (TL) will signal BG that the VIP
is safe to exits the vehicle and head to the entrance.
Reverse these procedures for Embus.

Embus Procedure:

 Cars are ready to move and doors are unlocked.

 BG gives order to stand-by.
 PES 1 (TL) has gone ahead and is ready to open the VIP vehicle door.
 PES teams move to their position looking outward for threats.
 PES 1 gives the all clear signal for the VIP to make his/her way to
vehicle.
 Principal and BG move to VIP vehicle and BG closes the Principal’s
door.
 BG gets into the vehicle and locks doors.
 PES team move to their vehicle as soon as the Principal's door is shut.
 PES vehicle pulls out giving cover to the rear of VIP vehicle.
 VIP vehicles move off followed by PES vehicle.

Debus Procedure:-

 Vehicles stop outside the venue with the Principal's door in line with the
venue entrance.
 PES 1 (TL) moves to venue entrance.
 PES debus vehicle and take up protective positions looking outward for
threats.
 BG moves to VIP’s door.
 PES TL signals BG that it's safe for the VIP to debus
 BG opens VIP door and ensuring all is clear.
 Principal debuses and moves to the venue followed by the BG.
 PES move to venue.

The Position of the BG:-

 The BG shield the Principal with the car door and his / her body.
 An orthodox or unorthodox drill will dictate where the BG stands.
  If the car door is between the BG and the Principal it is a barrier and
obstructs you from reaching the Principal in an emergency.
 Remember; all vehicle doors should be left open, in case something
happens before the Principal reaches the safety of the venue, in which
case you will evacuate the Principal back to the vehicle for immediate
extraction from the area.

Criteria that will affect Embus and Debus drills;

 Official Visits:- The Principals visit may be advertised by the media,

this will mean that everyone, including any attackers, will know what
time and where the Principal will be.
 Private Functions:- A non-work-related visit, a social call on a friend,
a restaurant or a private residence. Consider the Embus and Debus
points and the drills to be used, so as not to draw attention to the
Principals arrival.
 Unscheduled Movements:- The decision to visit somewhere at the
last moment with little or no notice. On the plus side, if the Close
Protection team had little time to plan for this, there is little to no
chance that the attacking team would have.

Embus Considerations

 Ensure that the cars are in position before the Principal comes out of
the building. Failure to do this will greatly increase the threat and
reduce the ability of the Close Protection team to react to any
potential incident.
 Ensure the distance between the car and the building is the shortest
possible. The shorter the distance the Principal has to walk the less time
an attacker will have to make his move.
 The BG will inform the team that the Principal is ready to come out, so
you can be in position.
 Ensure the drivers and vehicles are ready to move, the vehicle in gear,
foot on the break, handbrake off.
  As soon as the Principal and the BG are in the car, it should pull away.
 The team must look outwards, not inwards towards the Principal. They
need to be aware of their surroundings to know the movement of the
Principals vehicle and any crowds nearby.
 Be prepared with escape routes should an attack happen.

Debus Considerations

 Stop the vehicles as close to the building as possible so the Principal

has the shortest route to walk. Ideally an orthodox debus is the best.
 All-round observation by the team looking outwards for any threat.
 The drivers should be prepared to move in case there is an incident at
the debussing point.
 Identify escape routes in case of attack.
 The PES vehicle should be positioned to prevent an attack vehicle
being able to close or ram the Principals vehicle from the rear.
 When out of the vehicles, Close Protection operatives should position
themselves where they can see as much as possible.
 The Close Protection team as individuals must identify pieces of cover
or decide what they should do if an attack takes place, this may mean
providing body cover to the Principal.
 The BG should be in a position to take control of the Principal should an
attack take place.

High and Low Profile Drills

There will be occasions when drills will need to be adapted to suit the
circumstances, remember flexibility and adaptability are the keywords.

High Profile:- People will be watching at public events, i.e. Film Premiers, the
opening of new venues or election meetings etc.
Low Profile:- ensure not to draw unwanted attention to the arrival of the
Principal.
 1

3 3 1
ATTACK
2
4

Debus – Threat Scenario

In the scenario, PES 1 has moved to the venue door. As the Principal exits the
vehicle he is attacked, “contact right”. PES 1 moves to engage attack with
PES 2 (PES 2 closes to the attacker so engages immediately). PES 3 moves to
assist the BG and provide body cover to the VIP. PES 4 moves to give
protection from the rear as the VIP is rushed into the hotel. In this situation the
vehicle can also engage the attacker to add protection.

Note: Be prepared for a secondary attack.

DRILL – DRILL - DRILL

Chapter 10

VEHICLES and VEHICLE SECURITY

Statistics show that 95% of kidnappings happen between the home and the
office.

Unless you are working with a Principal who is a very high risk from kidnapping
or assassination or a country of a high degree of instability you will most
probably work in standard, non-armoured vehicles.
If however, security takes priority you should consider the following as
standard:-

 A powerful engine.
 ABS braking system.
 Power steering.
 Locking bonnet, boot and petrol cap.
 Top of the range alarm and anti-tamper system.
 Electric windows and central locking.
 Air conditioning.
 Run-flat tyres.
 Tracking device.
 Wire mesh in the exhaust pipe.
 Photographs of the engine compartment and underneath.

Overt Vehicles
Overt armoured vehicles will be used within hostile environments and the
threat assessment will dictate the level of armour required along with the
finance that is available.
There are a number of considerations to take into account when looking at
the type of vehicle(s) required. Are the vehicles fit for the task in hand?

 Size
  Weight
 Terrain capability 4x4
 Security and safety measures i.e. locking systems, fire rating, access, run
flat tyres, armour plating, reinforcement etc.
 Electronic Counter Measures equipment.
 Air conditioning

Armoured vehicles will normally require specialist drivers trained in

manoeuvring, anti-ambush and evasive driving drills of these very heavy
vehicles.
These vehicles will utilise ballistic rated materials – armour plating and
bulletproof glass.

Ballistic Protection Levels

Ballistic protection level indicates to what extent armour plating can provide
protection against bullets or an explosive blast. There are several different
standards of ballistic protection; higher the level, higher the protection.

Protection levels B4, B5, B6 and B7 indicate their ability to resist different
bullets from penetrating the inside cavity of the vehicle with ballistic glass and
armour.
Vehicles in Hostile Environments the minimum requirement is B6 or NIJ:III.G.

B6 to resist high power rifle rounds.

Calibre 7.62 x 51mm
Ammunition FYPB/SC
Mass (g) 9.5+0.1
Test Range (m) 10.0+0.5
Velocity (m.s) 830+10

Ballistics Rating (BR): This is a European standard which certifies the materials
used both transparent (BR - DIN EN 1063) and opaque (FB - DIN EN 1522/23),
general guidelines on vehicle construction and covers 3 levels from 2 to 7.
This is usually grouped under a single definition of B, e.g. B6

The Range Rover Sentinel image Forbes

Covert Vehicles
Covert or soft skin vehicles maybe required for security advance party or
counter surveillance work to blend in to their surroundings.
When using covert vehicles operatives will also need to be covert in order to
not draw attention.

Covert vehicle considerations to take in to account:-

 Type of task – will it be covert in that particular area.
 The terrain.
 Covert Communications.
 Size – will the vehicle be big enough for equipment as well as personnel.
 Security and safety measures i.e. locking systems, fire rating, access, run
flat tyres, Kevlar to minimize the effects of explosives, etc. etc..
 Air Conditioning.

Kevlar is used to make a variety of clothing, accessories, and equipment safe

and cut resistant. It’s lightweight, durable and extraordinarily strong.
Kevlar is best known for its use in ballistic and stab-resistant body armor, as
Kevlar® brand aramid fibre continues to evolve. It’s also on the ski slopes, the
switchback trails, in demanding desert terrain, even the outer limits of space.

Kevlar fibre does not melt or shrink when exposed to extreme heat and flame
and is extremely resistant to cuts. Ballistic panels made with Kevlar fibre
perform well over a broad range of environmental conditions and maintain
ballistic performance after years of service.

Vehicle armour made using Kevlar fibre helps provide better protection at a
lower weight allowing for reduced fuel consumption, higher payloads, and
increased manoeuvrability.
Driving as a Close Protection Operative
At times PPO's / BG's may be asked to undertake driving duties especially if
there is no appointed security driver of the chauffeur. Sometimes it might be
that the Principal like to drive themselves.
Points to consider:-

 A PPO / BG driving may be distracted from their primary objective of

providing security.
 Seating positions – If the PPO / BG is driving is the Principal in the front
passenger seat or in the back seat behind the driver or behind the
passenger seat.
 Avoid the same routes day in day out.
 Embus and debus situations – opening/closing doors, walking to
entrances.

 Parking – leaving the vehicle unattended.

VEHICLE SECURITY

The threat assessment will determine the necessary vehicles security

procedures that will need to be employed for example:-

 Cat 1 – the vehicle when not in use will be garaged overlooked by

CCTV, vehicle and garage alarmed as well as manned and guarded
24 hours a day.
 Cat 2 and 3 – as the threat assessment dictates together with taking
into consideration available resources and manpower.

Other considerations:-

 How long has the vehicle been left unattended?.

 Where has the vehicle been left unattended?.
 How long would it take to either plant a device or sabotage the
vehicle where it has been left unattended for a period.
Example:
A terrorist has bought the same vehicle as your Principal and has had time to
practice planting a device and/or sabotaging the vehicle before the date
planned for the attack.
The terrorist would:-

 Know the layout of the vehicle.

 Know the most secure hiding places.
 Know where the vehicle gets parked.
 Have been watching the Principal and the security team, logging
places visited both regular and irregular, what daily security
procedures the team carry out regarding the vehicle.

Vehicle Search
The driver will know the car better than anyone else, therefore, the driver plus
a team member is the minimum number of operatives needed to search a
vehicle, one to search and one to co-ordinate and record. The vehicle must
be kept clean and a security check making notes of items and positioning of
those items left in the vehicle whenever the left for any period.

 No radio equipment is to be used during a search – radios off.

When do we need to search for a vehicle (or vehicles) ?.

 Daily before use.

 After being left unattended.
 After a service or a valet.

What are we looking for?

 Damage to the vehicle.

 Loosened wheel nuts.
 IEDs.
 Signs of disturbance around the vehicle.
Basic search equipment.

 Mirrors.
 Torches.
 Screwdrivers.
 Pliers.
 Plastic strips.
 Vehicle tool kit.
 Overalls.
 Note pad & pen.

Advanced search equipment.

 X-ray machines.
 Density Meters.
 Mine detection systems.
 Flexible camera systems.

 Electronic countermeasure equipment.

VEHICLE SEARCH PROCEDURES

Surrounding Area
A device may be planted near the vehicle with the use of a triggering device
whether from a distance by way of remote control or by the vehicle itself.
Look for:-

 Disturbances in the ground i.e., footprints, tyre marks, disturbed

vegetation.
 Garage doors, gates i.e., forced entry, tool marks.
 Drains, meter boxes.
 Oil or fluid patches.
 Bits of tape, paper or wire cuttings.
Vehicle Coachwork
When satisfied that the surrounding area is cleared and deemed the safe
move to the vehicles coachwork. While checking the coachwork endeavour
not to touch the vehicle and keep to a visual-only search at this point.

 Pay attention to the paintwork, mirrors and windows for finger marks
and oil smears.
 Check the bodywork and wheels/hubcaps for any tampering.
 Partially closed doors, bonnet and boot.

Wheels and Arches

Continue with a visual-only search and avoid touching.

 Check wheels, tyres and hub caps for sharp objects, punctures,
loosened wheel nuts, lever marks on hub caps, objects forces under
the tyres, oil spills.
 Look up and around the inside of the wheel arches.

Underneath
Overalls required.

 Inner-side of wheels and tyres.

 Suspension.
 Chassis.
 Prop shaft.
 Exhaust system.
 Petrol tank.
 Under the engine compartment.
 Inner bumpers.

Boot
Can the boot be opened via key fob or external catch?
The procedure for opening the boot.

 Ideally, two people required to open the boot.

  One person to retain pressure on the boot lid whilst the other person
releases the catch.
 Keep pressure on the boot lid as visual inspection is carried out around
the boot shut and seals.
 On command slowly release pressure continuing the visual inspection
on boot shut and seals.
 When partially released use plastic strips to feel around the boot seals
for any obstructions.
 When satisfied and on command release the boot lid not allowing it to
spring up to its fully open position.
 Continue visual search of the underside of the boot lid.

Once the boot is fully opened.

 Visual check – is everything in place as it should be?.

 Remove all items and check the entire boot compartment.
 Check the spare wheel visually for tampering then remove and check
tyre condition.

Interior
Inspect the whole of the interior through the windows first. Cross-check with
your list of any items and item positions of anything left in the vehicle. (Ideally,
the vehicle should be clean and tidy at all times and cleared of any items
before end of shift).

 Look through the windows for interior disturbances i.e., seatbelts, marks
on the upholstery and carpets. Items not recognised and left in the
vehicle.
 Work from the back doors to the front doors.
 2 man search procedure as one man slowly opens the door the
second operative is checking through the opposite window.
 Partially open doors and carry out a visual check of door shuts and
seals.
 Carry out the plastic strip procedure as in the boot search.
  Continue to visually inspect the doors as the door is opened.
 Pay attention to the hinge area and interior light switch.
 Ideally no floor mats but if they are in place visually check to look for
bumps showing something has been placed under the mat.
 Remove mats.
 Check under seats.
 Leave doors open.

Bonnet
The same procedure as the boot applies here regarding the releasing of the
bonnet catch.
One person to retain pressure on the boot lid whilst the other person releases
the catch.

 Keep pressure on the bonnet lid as visual inspection is carried out

around the boot shut and seals.
 On command slowly release pressure continuing the visual inspection
the bonnet lid, shut and seals.
 When partially released use plastic strips to feel around the bonnet
seals for any obstructions.
 When satisfied and on command release the bonnet lid not allowing it
to spring up to its fully open position.
 Continue visual search of the underside of bonnet lid.

Once the bonnet is fully opened.

 Visual check – is everything in place as it should be?.

 Check the entire engine compartment. (Check with photographs to
confirm.)
 Check water and oil levels.
 Leave bonnet open until search procedure is complete.
Final Checks
Leaving all the doors, the boot and bonnet open start the engine and
check:-

 Al electrical equipment works as it should – lights, indicators, wipers,

horn, heater, air-con, , mirrors, windows, entertainment system and any
communications systems.
 A short test drive checking breaks, gears and engine sounds.

In the event of a device being found instigate the 4 C’s –

CONFIRM CLEAR CORDON CONTROL

(See chapter on IED and Bomb Awareness).

Chapter 11

VEHICLE ESCORT PROCEDURES

John Fitzgerald Kennedy, the 35th President of the United States,

was assassinated on November 22, 1963, at 12:30 p.m. Central Standard
Time in Dallas, Texas, while riding in a presidential motorcade through Dealey
Plaza. Kennedy was riding with his wife Jacqueline, Texas Governor John
Connally, and Connally's wife Nellie when he was fatally shot by former U.S.
Marine Lee Harvey Oswald firing in ambush from a nearby building. Governor
Connally was seriously wounded in the attack. The motorcade rushed
to Parkland Memorial Hospital where President Kennedy was pronounced
dead about 30 minutes after the shooting.

Assassins and kidnappers will more often choose vehicle attacks due to the
simple fact that they allow them to select the time and place of the attack.

Vehicle Security

A vehicles not being used should still be secure even in secure areas such as
the residence or garage, etc. The level of threat determined by the threat
assessment will dictate the necessary level of security required while the
vehicles are parked in a secure area.

 No sensitive documents will be left in unattended vehicles.

 Vehicles will be checked prior to use by the security team / VIP.
 Unattended vehicles will receive a thorough search.
 Emergency procedures required if anything suspicious is found -
confirm, clear, cordon, control.

Before Collecting The Principal

1. If the vehicle has been left unattended carry out a search.

2. Vehicle is warmed up before departure.
3. Ensure linear recce cards are in place.
 4. Carry out pre-driving checks including lights, breaks, tyres, indicators
and fuel etc.
5. Check for any suspicious vehicles or individuals nearby.
6. Check communications equipment is working and batteries charged.
7. Check boot for spare tyre, first aid kit, tool kit, fire extinguishers, jump
leads, map book, sledge hammer, kit bag with clean shirt and wash
bag, bottled water and umbrella.
8. Depending on the threat at least two respirators.

Client / Principal Brief

The BG, PES or at times the driver will be required to put the Principal at ease
and gain confidence by being professional, polite, and reassuring.

 Inform the Principal that the vehicle is armoured if applicable and

ensure they are familiar with emergency procedures.
 Inform the Principal you are in communications with the operations
room, other vehicles and team members.
 Inform the Principal of the presence of other vehicles.
 Provide the Principal with information regarding the route and in
particular the duration of the journey.
 Provide information on the safety procedures within the vehicle i.e.
locked doors and window open to a max of 3 inches.
 Inform the Principal you are happy to answer any questions regarding
the trip.

On Departure with the Principal.

1. SAP vehicles to leave three minutes earlier than the Principals vehicle if
a daily journey.
2. Check again for suspicious vehicles or individuals.
3. Lock all doors and boot.
4. Windows opened no more than two inches.
 5. Ideally Principal to sit in the rear and behind the BG.

The Law

Seat belts are to be worn, speed restrictions are to be adhered to.

It will be very embarrassing and inconvenient to be pulled over by the police
for either not wearing a seat belt or driving above the speed limit.
If such a time occurs when you have no other option but to drive at speed to
an attack or some sort be mindful that you will still have to answer to the law
if your high speed driving is reported.

DRIVER AWARENESS

Drivers must be constantly aware of:-

 Vehicles or obstacles which may cause the vehicle to be blocked.

 Potential escape routes such as across a field or traffic lanes, side
streets and fast reversing.
 Maintaining a good field of view able to scan ahead
 Distance between vehicles.
 Breaking distances.
 Your exact location at all times.
 Maintaining alertness.

JOURNEY MANAGEMENT

The PES team leader and/or the BG in consultation with the SAP are
responsible for the planning and conduct of journey management in order to
reduce or minimise known threats.

 All movements planned thoroughly.

 Discuss and go over route recces and embus/debus points.
 Discuss vulnerable areas and alternative/escape routes.
  Chain of command established.
 Establish radio check points enabling journey monitoring.
 Confirm radio black spots.
 Communication call signs between vehicles and team members.
 Rehearsals and drills including breakdowns, separations and
emergency actions.

TACTICAL DRIVING

Two Vehicles - VIP vehicle with PES back-up vehicle.

The position of the PES vehicle relative to the Principal's vehicle is crucial to
provide immediate security when required.

 The Principal’s driver and the PES driver must work together to position
their vehicles in a way to that will provide good observation and
defence.
 The PES vehicle must be able to see ahead of the Principal’s vehicle.
 The PES vehicle must always be in a position to react to situation when
required and enhance defensive capability.

The diagram below shows the PES vehicle pulling out into the road ahead of
the VIP vehicle. Not only does this allow visuals ahead but also provides a
block, not allowing any vehicles from the rear getting between the VIP and
the PES vehicle as well as preventing any attacks from the rear. Once given
the signal to go the VIP driver moves out ahead
 View ahead

The diagram below shows the positioning of the PES vehicle to the VIP
vehicle. The PES is slightly offset to the VIP vehicle to act as a block and
increasing its field of view to the front.
 Left Turn Right Turn

Vulnerable

PES in an offset position for better visibility of the road ahead.

 Taking the third exit off a roundabout.

Motorway: - PES keeps to the outside lane and vets vehicles coming to
overtake from the rear. PES will allow vehicles to pass once vetted.
 Motorway: VIP vehicle moves to the exit and the PES moves to give cover
and then adopts the normal positioning.

Considerations:-

 Provide cover for overtaking.

 PES vehicle to be offset to have view ahead.
 Create room to manoeuvre.
 Constant anti-surveillance.
 Give all hazards a wide berth.
 Be mindful of pulling up to traffic light / word works etc.

ANTI-AMBUS DRILLS

The ambush is a very popular tactic which has been very successful in both
rural and urban environments by giving the attackers the advantage of the
element of surprise, time, choice of ambush point and the option of aborting
and planning for another day.
Historically, in assassination type attacks, 85% of these attacks occur near the
residence and in or near the vehicle. If we can anticipate an attack, even
for a few seconds, we have a much better chance to execute specific pre-
planned manoeuvres to defeat an ambush.

In studies, most attacks were carried out by employing two vehicles. One
vehicle was employed to impede or cut off the target vehicle and the other
vehicle was employed to launch the attack itself. For example, a car pulls out
in front of the Principal’s vehicle after a distance the car starts to slow down
to impede the speed of the Principal’s vehicle. A second car behind the
Principal pulls out to overtake. As the second car comes alongside the
Principals vehicle, the occupants of the second car open fire on the
Principal.

As security professionals, we need to plan and rehearse immediate action

drills until they are done without hesitation to prepare us to react to a
potential attack. This includes observation and initiation such as contact left /
contact right or gun l / gun right left and followed by the appropriate tactical
response.

Depending upon the terrain, the type of ambush, the vehicles being used,
etc. the specific immediate actions may differ but, in general, the best
reaction to a threat is to move preferably away from the attackers. By
moving we will gain more options and increase our survivability.
In some cases, your only or best option may well be to drive at the attackers
and ram.
Almost every study on ambushes has shown that response actions that get
the targets moving from the attack site increase the target’s chances of
survival.

A study of post-assassination attacks makes it clear that in most cases where

individuals exited the vehicle they were killed when the attackers were
positioned less than 100 yards distance.
We also need to ensure our actions i.e. movements away from an attack do
not lead us into a secondary ambush.

1 – Becoming complacent and switching off .

FIVE FATAL 2 - Not reacting i.e. not moving from the attack site.
MISTAKES 3 - Not allowing exit points i.e. distance to manoeuvre.
4 - Skills i.e. lack of training / drill practice.
5 - Panic due to absence of training.

Kidnapping of Aldo Moro

The ambush began when the two cars entered Via Fani and the terrorists
were alerted by a lookout, Rita Algranati . Moretti's Fiat 128 cut the road in
front of Moro's car, which bumped into the rear of Moretti's car and remained
blocked between it and the bodyguards. Alfetta. Leonardi tried an escape
manoeuver, but was thwarted by a Mini Minor parked at the crossroad.
Moro's cars were finally trapped from behind by Lojacono's 128. At this point
four armed terrorists jumped out from the bushes at the sides of the street,
firing machine pistols.

Attack Recognition
When carrying out your routes recces think like an attacker and established
ambush points, where can the road be blocked to limit escape, best places
to lie in wait, secondary ambush etc.

Know the Route

 Something is different.
 That’s not usually here.
 That’s an unexpected diversion (road work start dates are often
signed).
Behaviour Patterns

 Unusual activity.
 Lack of activity.

The BG to provide body cover.

SIX Remove Principal from danger.
Fast and aggressive actions.
BASIC
Use appropriate drill to the attack.
PRINCIPLES Exit area to safety.
Be aware of secondary ambush.

Fight or flight ? In Close Protection unless you have no other option “Flight”.

To make the flight successful often requires h high level of aggression and an
immediate response by fleeing to a haven such as a Police or Fire station.

Terrorist will endeavour to stop a vehicle by stopping the driver. In 70% of all
attacks the driver will be hit therefore as a driver you need to lower your
profile to a slouch position but still maintaining control of the vehicle.

Blocked In – Ram Out Moving Cut Off

 2 Vehicle Block Ramming Through

Ramming Procedure

1) Slow down.
2) Select low gear.
3) Select impact point front or rear wheel arch.
4) 25 – 30ft away accelerate hard.
5) Drive straight through
6) Keep going

Motorcycles: If a motorcycle can move into a position next to the VIP vehicle
they will be able to:- Fire shots, attach an IED, take photographs.
Motorcycle attacks are one of the most common methods of assassination.

Be vigilant. Do not be an easy target. Use angles. Vary speed.

 Hand Brake Turn The Y Turn

Hand Brake Turn

 Apply enough hand-brake to lock the rear wheels.

 Keep handbrake on until you are In position to accelerate forward and
escape.
 30 – 40mph in dry weather.
 20 – 25mph in wet

The Y Turn

 Reverse away from the block ensuring there is no obstruction or second

block to the rear.
 Engage forward gear and manoeuvre out to safety.
Road Block
VIP vehicle signals the PES to accelerate ahead to provide cover and if
required return fire.
VIP vehicle will reverse out using a Y turn and the PES will follow giving cover
to the rear. (As in the diagram below).
Be mindful of second block or attack.
PES

VIP
Blocked Front and Rear
If blocked to the front and the rear with no means of the vehicles being able
to exit the attack site you will need to escape on foot.

Vehicle spacing allows cover from doors. PES and BG to provide body cover
and evacuate the VIP from the attack zone to a safe house.
VIP Vehicle Disabled
PES manoeuvre into position providing cover while the Principal is moved
from the VIP vehicle to the PES.
Once Principal is in the PES vehicle and down in the floor well covered by the
BG, the PES driver reverses away from the block and carries out a Y turn to
escape the attack zone.
 PES

VIP DRIVER

BODYGUARD

VIP

VIP Vehicle Disabled

1) BG moves to the back seat of the VIP vehicle to provide body cover to
Principal.
2) PES 1 and 2 engage attack (PES 2 from inside the vehicle).
3) VIP driver and BG provide body cover to the VIP between vehicles.
4) VIP is pushed into PES vehicles floor well.
5) BG and VIP driver provide body cover in the PES vehicle.
6) PES 1 gets in vehicle with PES 2 still providing return fire.
 7) PES driver reserves away from the attack zone, performs a Y turn and
escapes to safety.

HIGH THREAT CONVOY PROCEDURES IN HOSTILE ENVIRONMENTS

The team leader will determine the configuration based on the level of
threat, types of threat and the requirements of the client.
Ideally a minimum convoy of three vehicles will be used with the lead vehicle
being an armoured 4x4 with all personnel armed. This lead vehicle will be
responsible for navigation and reporting.
In the centre vehicle will be the Principles vehicle, again armoured and the
rear vehicle is the backing vehicle required to provide additional protection
from the rear, side or moving forward to the front to provide the additional
protection.

Convoy Movements
Detailed plans and detailed orders will be provided before any movement /
travel plans commence.
Rehearsals will be practised by team members covering a wide range of
scenarios from a traffic accident to a kidnapping attempt.
RV and check points will be established and once the convoy has reached
each point information will be communicated to the operations room.
Vehicles will be close enough to offer emergency response and assistance.
Communications is critical between each vehicle relaying information such
as times, speed, overtaking, roadworks, traffic lights, check points, and
suspicious goings on etc.

Actions On – Drill, Drill, Drill

Actions on procedures are planned and practised actions in case of an
emergency situation.
If attacked from any position be able to manoeuvre the vehicles to provide
cover, ram and escape to the nearest safe location.
If vehicle becomes immobilised conduct cross-loading under fire drills.
For any casualty inform the operations room, carry out emergency medical
care and contact the nearest medical facility.
Use smoke to screen movement and exit manoeuvres.

Separated or Lost
Check your GPS to confirm Longitude and Latitude together with your
direction of travel and report the operations room.
Stay calm and reassure the client.
Make notes of landmarks and attempt to relocate your position.
Move back to the last RV informing the Operations Room.

Breakdown
Provide details of breakdown to the operations room.
Ensure safety of the client.
Recover any sensitive documentation, weapons and ammunition from the
broken down vehicle.
Use a GPS to gain and accurate grid reference of your position.

Vehicle Check Point

Approach a VCP slowly.
Obey the instructions of those manning the VCP.
Ensure weapons are out of sight as you approach the VCP.
Have your identification symbol (Union Flag) to hand as you approach.
Be polite when talking.
Spend as little time as possible at the VCP.
Chapter 12

OPERATIONS ROOM

The Ops room (Operations Room) is the central hub of the operation for the
whole team. It will be the centre for all communications, information and
equipment.

There are two main types of operation room that we need to be aware of:-

 Fixed / permanent i.e., an operations room at the Principal’s residence.

 Mobile / temporary – non-permanent i.e., a mobile operations room that
is deployed from a vehicle or venue that supports a certain time frame.

Both static and mobile operations rooms will be equipped and not limited to
the following equipment:
-
 Computers, scanners, printers.
 CCTV system with monitors or one large screen with multi-scene
capabilities.
 Alarm panel with zone details.
 Communications equipment including chargers. Calls signs displayed
on the whiteboard.
 ECM (Electronic Counter Measures) devise.
 Mobile surveillance equipment.
 Search and detection equipment.
 Go bags.
 Telephone system.
 First Aid and Defibrillator.
 Fire-fighting equipment.

Information:

 Daily itinerary.
  Route maps and building plans.
 Radio checkpoint details.
 Security procedures.
 Threat assessments.
 Transport details.
 Logbooks for keys, visitors, security checks etc.
 Rotas and SOPs.
 Emergency contact details including emergency response times.
 Emergency and immediate actions procedures.

The Ops room is run 24 hours a day by way of shift patterns and hand-overs
where oncoming personnel are briefed by the outgoing personnel.
Brief/debrief to include:

 All operational updates including changes to the itinerary.

 Daily events and logs.
 Weather.
 Daily potential problem details, from traffic delays to the weather.
 Daily protocols i.e. dress - smart casual, suit, etc.
 Daily debrief.
Chapter 13

SURVEILLANCE
Surveillance – The observing of person(s), places or objects whilst static, on
foot or mobile in a vehicle by covert or other means.
This is achieved by the following:

 Briefing – plan the surveillance operation.

 Trigger – this is where the surveillance starts b watching a known
location from where to start surveillance.
 Follow – the movement of surveillance on foot or vehicle.
 Housing – where the surveillance ends due to the subject going to a
static location.

TYPES OF SURVEILLANCE

Covert Surveillance – is done in a way that tries to ensure the subject is

unaware it is or could be, taking place.

Overt Surveillance – is carried out by using methods and devices that are
visible and obvious.

Directed Surveillance – is essentially covert surveillance that is not intrusive

and carried out to a specific investigation.

Hostile Surveillance – is to obtain intelligence by placing your client

under surveillance in order to plan an attack.

Intrusive Surveillance - is covert surveillance that is carried out concerning

anything taking place on residential premises or in any private vehicle and
that involves the presence of an individual on the premises or in the
vehicle or is carried out by a means of a surveillance device.

Definition of Anti-Surveillance - the actions or manoeuvres that a person

 carries out to get a reaction, and therefore confirm that he is under
surveillance and then employing techniques to evade surveillance.

Definition of Counter-Surveillance - measures undertaken to

prevent surveillance, including covert surveillance.

Definition of Protective Surveillance – Protective surveillance minimises the

profile and exposure on the ground. Often the SAP will take on this role.

PROTECTIVE SURVEILLANCE

Protective surveillance is used when the protective profile needs to be as low

as possible but not compromising the security measures.
Protective surveillance operatives blend into the natural environment and
provide protection within the vicinity of the Principal.
Often the Principal is unaware that protective surveillance is being carried
out.

Example
The threat assessment dictates that a level of protection is required, however
finances only allow for a BG, and two SAP.
The SAP go a head of the Principal and once they have reported back to the
BG that the route is safe they take up protective surveillance positions
monitoring movements and looking for anything suspicious prior to the
Principals arrival.

HOSTILE SURVEILLANCE

In order or for anyone to carry out a successful attack they must carry out
intelligence gathering execute some sort of surveillance to plan effectively.
Information required will be and not limited to:-

 Targets Identity.
 Addresses – home, work, venues.
  Vehicles – routes, travel arrangements.
 Family and associates.
 Existing security measures.

When planning an attack the hostile wants to know how easy it will be to
carry out and how easy it will be to escape. There are three different and
compounding types of “ease” that are considered when planning a physical
attack. For example

 Ease of parking a car / car-bomb outside the entrance of a building.

 Ease in which operational information about the target can be
gathered. For example how easy it is to establish the target’s
vulnerabilities, security measures, etc.
 Ease in which operational information can be collected, while
remaining covert. For example, a potential target that the attacker
can more easily collect information on, and more easily remain covert
while doing so, will be much more attractive.

Hostile surveillance is a vital component of the attack planning process.

The attacker will try to obtain enough detailed information from online
resources, site visits, insider knowledge and will want to be certain about the
reliability of this information to be sure of success.
In general, the more sophisticated the attack the more complex the attack
planning. Therefore more accurate reliable information and more detailed
reconnaissance are needed.

The information gathered by the attacker to:-

 Assess the level of security and the likelihood of detection.

 Assess vulnerabilities in security.
 Assess the likelihood of success.
Understanding this provides the opportunity to disrupt by denying the
attacker the ability to obtain the information they need for a successful
attack.

FOUR PHASES OF HOSTILE RECONNIASSANCE

Gather Intelligence Phase - The main objective of this phase is to collect as

much information as possible to gain basic information about the target. This
information can be obtained from open sources such as:-

 All forms of media.

 The internet.
 Public records.
 Public notices.
 Insider resources.

Gathering information from open sources can be done from anywhere in the
world is not only easy to find but also free. The information from open sources
include:-

 Details about your Principal including both business and personal.

 Google maps including street views, routes, areas.
 Photographs of people, places, buildings etc.
 Event information, where, when and who will be attending.

Planning and Preparation Phase – Requires the gathering of more detailed

information. Comparing and contrasting the various targets, places and ways
to carry out a successful attack.

Operational planning tends to be dependent on the attackers' capabilities

and the resources available to them.

 Carry out initial surveillance to physically observe the target.

  Confirm the validity of the information that has been collected.
 Continue to collect information.
 Identifying vulnerabilities regarding the target, their itinerary,
weaknesses in security etc.
 Put together a plan of attack.
 Identify any vulnerability in the attack plan.
 Confirm the attack can take place.
 Confirm the attack and goal can be successful.
 Who is most vulnerable (if more than one target)
 Where is the best place for the attack to take place?
 What is the best day for the attack to take place?
 What is the best time for the attack to take place?
 What is the best escape route?

Once the plan of attack has been formulated the next step is to ensure the
attack can be carried out with success including:

 the attacker(s) escape

 achieving their intended goal.

The next step is to prepare by way of training and rehearsal. For example

 Training – the attacker needs to learn how to build an IED.

 Rehearsal – the attack will be practised with dry runs.

Execution Phase
Here the attacker observes his / her target immediately before the planned
attack to proceed or cancel the attack for whatever reasons for example,
more security have been drafted in. In this situation the attacker is more at risk
of being detected and caught. However, the longer time spent on
surveillance in this phase the more likely the attacker will be detected.
Escape and Exploitation Phase
This phase comes after the execution and is the realisation of the attack
goals.

 Was the attack successful?

 Did the attack go to the plan?
 Did the attacker escape?

Did the attacker escape? Was the attacker meant to escape?

If we use an example of a suicide bomber, the attacker does not escape
however they have still been successful in their assignment and the terrorist
organisation has succeeded in their goal.

These phases form the basic process used by almost every hostile entity from
petty thieves to bank robbers to terrorists:-

1. Gather Intelligence.
2. Plan and Prepare.
3. Execute.
4. Escape and Exploit.

SURVEILLANCE DETECTION

Surveillance detection is responsible for actively discovering hostile

surveillance and carried out by a series of covert procedures implemented to
confirm whether or not hostile surveillance of a Principal, place or event is
being carried out. By establishing that there is hostile surveillance being
carried out a plan of disruption can be put in place.

As previously stated for most attacks to take place and be successful the
attacker/hostile needs to spend an amount of time researching and planning
the attack (See the Four Phases of Hostile Reconnaissance) and so spend
time in the field following a target and gaining intelligence. It is here that
surveillance detection operatives seek out opportunities to detect hostiles
before an attack.

Where the Threat Assessment dictates and finances allow surveillance

detection whether carried out by an individual or a team will be a separate
entity from the close protection team. However often this is not the case and
a member of the team or a team leader will be responsible for this job.

To know your enemy you must become your enemy – Sun Tzu.
When attempting to identify hostile surveillance, you must become the
attacker.

First, identify with the area you are working within and blend in with the
surrounding. For example, the Principal has a meeting in the city with his
lawyer at his lawyer's office which is in an area of office blocks occupied by
insurance companies and legal firms, therefore, you need to dress and act in
such a way to blend in. You will stand out in a t-shirt and jeans.

Secondly, identify suitable observation points (OP’s) that provide optimal

views of critical locations where hostiles/attackers would want to carry out
surveillance on such as entrances to the targets residence or office while
allowing the surveillance detection operative to appear completely natural.
Good observation points include but are not limited to:-

 Coffee shops
 Park benches
 Crowded areas and any environment where the surveillance operative
can naturally blend while observing the target.

Pay attention to vehicles and people that look out of place.

Go back to the example of the Principal meeting with his lawyer:-

 What sort of people frequents this area?

  How are they dressed?
 What about people visiting at different times of the day?
 Any construction work, repair work or contractors working in the area?
Can you confirm by contacting the company or authorities, how many
staff should be working, are they in uniform or identifiable, what type,
make, model and how many vehicles do they have, how long are they
working in the area for?
 What about couriers? Is it the same courier that delivers to the area or
office block, are letters parcels left at reception.
 What about security in office blocks etc. etc.

CORRELATIONS TO THE TARGET

A correlation can be an act of observation, movement, signalling,

communicating or just a presence over time and distance in conjunction with
the location, timing and movements of the target.

 Seeing the same person or vehicle in space or time is a correlation

 The act of observing a target is a correlation.
 Moving in conjunction with or following a target is a type of correlation.
 Paying close attention to a target at specific key moments is a
correlation.

An example of a correlation:
Your Principal, the target is staying at a hotel in London for five days while on
a business trip. One of the surveillance detection operatives has spotted an
individual that sits in the hotel foyer every morning at the same time and pays
specific attention to your Principal. The correlation here is that an individual is
the hotel foyer every morning at the same time and pays specific attention to
your Principal. The presence of the individual over time is also a correlation. If
a week later the same individual is seen outside of the lawyers' office (as in a
previous example) then this would be a correlation over distance.
As a member of the CP team and the SD operative, you will know your
Principal's movements in advance including details of:-

 Publicised conference including dates and times.

 The SAP has carried out a recce of the venue and provided you with
the details.
 The threat assessment has dictated that there is a high possibility of an
attack.
 You know who is likely to carry out the attack.
 The hostile may have attacked your Principal before therefore you
have information on how they operate.

One week before the conference you carry out surveillance detection of the
venue and its immediate vicinity.

You've established a suitable observation point where you have an optimal

view of the venue entrance, drop off points and pedestrian routes.

Those carrying out hostile reconnaissance will often change their

appearance by changing clothes, using hats and other disguises. Pose as
contractors and will often change vehicles or number plates to blend in with
their surrounding remaining covert. For this reason, it is important to focus on
individuals. For example:-

 Facial features.
 Build.
 Mannerisms.
 Gait.
 Identifying marks such as scars and tattoos.
 Nervous traits.

When it comes to vehicles, special attention should be paid to characteristics

such as:-

 Body damage.
  Stickers and other unique characteristics.
 Registration numbers.

ATTACK DETERRANTS

It should be made clear to an attacker carrying out hostile surveillance that

the Principal is not an easy or desirable target and make it hard for them to
formulate a plan. For example:-

 Visible security presence.

 Physical barriers.
 Access control.
 Breaking routines.
 Randomly seen actively carrying out checks, noting number plates and
taking photographs etc.

Be mindful that a deterrent is not a guarantee it’s a process of making things

more difficult for a hostile to plan an attack.

COUNTER SURVEILLANCE
Once hostile surveillance has been detected counter-surveillance tactics are
then employed. “Surveillance on Surveillance”.

 Discovering who the hostile is.

 How they operate.
 What are their motives?
 Collection of evidence for arrest and legal action.

PERSONAL SECURITY

All types of criminals from terrorists to stalkers not only carry out surveillance
on VIP's, business executives and celebrities they also carry out surveillance of
security personnel and other staff.

1. To gain information on the level of security.

2. To assess how professional and how effective that security is.
3. To make a statement – can’t get to the VIP so will get the security.
4. Kidnap or threaten the security operative’s family to gain information
on the VIP. And so on.

Therefore personal surveillance detection is essential.

SURVEILLANCE DETECTION DRILLS – Simple and Proven

 When walking along a street, turn around and go back being mindful
of people you walk past i.e., do they take interest in your change of
direction or do they stop to observe where you are going. Be mindful of
anyone walking and following you on the opposite side of the road.
Carry out this drill a number of times and see if the same person or
same couple become familiar.
 When driving you can do a couple of U-turns or even drive around a
roundabout a couple of times.
 Use reflections in windows and surfaces to see who is behind you.
 Use your mobile phone’s camera to see who is behind you.
 Go up and immediately down escalators and see who follows.
 Take note of people in parked cars near your residence or place of
work. Vans and cars with blacked-out windows. Ask yourself "why has
someone been sat I that car for the last 2 hours?"
 Drive slowly and see if anyone does the same. Pullover and pretend to
use your phone and see if they pull over or slow up ahead of you.
 Board trains or buses at the last minute and see if anyone else does the
same. Even get off at the next stop to turn-around and get back on
again.
  Go into a café and observe what is going on outside. Is anyone waiting
around? do they keep looking in through the window of the cafe?,
have they walked past several times?.

BODY LANGUAGE

Body language plays a vital role in the training of security operatives.

Someone who is carrying out surveillance or is looking to commit a crime will
usually be acting differently to those around them.

 Are they being over observant?

 Are they trying to conceal something?
 Do they seem stressed or nervous or is there over-exaggerated
behaviour?
Chapter 14

COMMUNICATIONS
Good communications are a critical part of any close protection operation
to ensure that all protection team members know their duties and know
exactly what is going on around them.

Team members will not only communicate between themselves but also
outside of their circle of protection:

 The Principal and his / her family.

 The Principals employees.
 Local authorities.
 Venue management.
 Security companies.
And so on.

Be polite and courteous, be professional, and always remember your actions

and communication skills reflect on the Principal.

In an operational environment communications, whether it’s verbal or by

way of hand signal must simple, clear and precise enabling the team
members to understand exactly what is going on, what actions are required
and things are going to plan.

When operational the Ops room and team members will keep in contact
with each other by radio and/or telephone (landline, cellular, satellite).

Communication Security

 Do not discuss any operational details on unsecured communication

devices including itinerary, information regarding the Principal, vehicle
details, locations etc.
 Always use calls signs and code names.
 Change call signs and code names regularly.
  Change radio channels regularly.
 Check equipment daily for battery life and is suitable for the task.
 Have a contingency plan for the loss of primary communications –
back-up plan.

Radio Communication Licencing

There are some countries including the United Kingdom that have licencing
laws regarding radio communications, therefore, ensure you are aware of
any legal requirements.

Mobile/Cell Phone Security

Your smartphone is a potential goldmine for thieves and hackers therefore

essential its data doesn’t fall into the wrong hands. Data that is stored on your
smartphone includes text messages, email exchanges, browsing history,
photos, and videos. Some phones can also be tracked providing information
on where you have been.

 Set up a password.
 Update your operating system.
 Download security apps.
 Privacy settings

Mobile phone considerations:

 Have a separate phone for CP operations.

 Purchase a second battery.

RADIO COMMUNICATIONS

The ear piece and cuff or pinch clip communication system has become the
stereotypical image for the bodyguard however they are essential in the
successful running of a close protection operation.

 Confirming check points.

 Calling for back-up.
  Relaying information.
 Transmitting commands.

Communication Procedures:

 Always assume the comms you are using are unsecured.

 Keep conversations brief and simple.
 Natural pauses between sentences.
 Speak clearly.
 Do not shout as this can cause disruption.
 Keep it short and simple.

Phonetic Alphabet

A - ALPHA B - BRAVO C – CHARLIE D - DELTA

E - ECHO F - FOXTROT G - GOLF H - HOTEL
I - INDIA J - JULIET K - KILO L - LIMA
M - MIKE N - NOVEMBER O - OSCAR P - PAPA
Q - QUEBEC R - ROMEO S - SIERRA T - TANGO
U - UMBRELLA V - VICTOR X - XRAY Y - YANKEE
Z - ZULU

Voice Procedures

CALL SIGN Precedes a call-sign e.g. “CALLSIGN ALPHA CHARLIE 1”

ACKNOWLEDGE Request acknowledgement of the message.
RADIO CHECK Request a radio check with call-signs.
SAY AGAIN Repeat the last message.
I SPELL Precedes letters when spelling a word.
ROGER Understood, Yes.
WAIT OUT I heard you, now wait for a response.
OUT I am ending the transmission.
CORRECT You are correct.
CANCEL Disregard my last message.
CONTACT Informs you are engaged with the enemy.
Example of a Call-Sign Notice Board.

OPS ROOM OSCAR 1

BG - Paul Smith BRAVO OSCAR 1
PES TL - Andrew White PAPA ECHO 1
PES 2 – NE Body PAPA ECHO 2,
PES 3 – NE Body PAPA ECHO 3
SAP TL – NE Body SIERRA PAPPA 1
SAP 2 – NE Body SIERRA PAPPA 2
RST TL – NE Body ROMEO TANGO 1
RST 2 – NE Body ROMEO TANGO 2

KISS – KEEP IT SHORT and SIMPLE

COMMUNICATIONS SYSTEMS
There are a number of communications systems that operatives must be
familiar with including UHF, VHF and Satellite. They also need to be
serviceable enabling a team member / members to maintain and service
when required.

Example of communication systems:-

VHF Motorola vehicle & handsets

VHF = Very High Frequency two way land mobile radio systems used by
emergency, private and military use with a long range data communication
up to several tens of kilometres.

Thuraya Sat Phone – Thuraya is a United Arab Emirates based mobile-satellite

service provider (MSS). The company operates two geostationary satellites
and provides telecommunications coverage in more than 161 countries.

HF Codan – Long range digital radio (LRDR) is the most reliable form of long
range communications without dependence on infrastructure. They are
based on the proven and robust high frequency hard-ward platform.

Other electronic equipment:

Electronic Counter-Measure (ECM) Systems

Electronic counter measure equipment provides a blanket of electronic
security around an operating base or vehicles so that improvised explosive
devices cannot be initiated under the blanket of protection by decreasing
the signal-to-noise ratio to the point where the target communications link is
either degraded or denied service.

Personal Locating Devices (PLD)

A PLD is a personal electronic transmitter which is used in emergency
situations. When activated the device sends out a signal.
Personal locating devices are carried by operatives as part of their personal
security equipment which can be Radio Frequency or GSM/GPRS
technology.
Chapter 15

BUSINESS SECURITY

As well as securing the wellbeing of a VIP it maybe within your role as a

security advisor to secure the Principal business.

Some businesses will be more at risk than others because of the services they
provide, their high worth, and at times their business relationships.

A security consultant must understand the range of threats an organisation

may face whether directly or indirectly.

 Directly – The organisation is at risk itself.

 Indirect – A business relationship, through acts of nature.

The threat assessment process involves making logical assumptions about the
likelihood of a threat and its impact on the Principal, company executives,
staff and the business itself.
A threat assessment should not be limited from resources within the
organisation but should take advantage of external resources:-

 www.MI5.gov.uk
 www.homeoffice.gov.uk
 www.businesslink.gov.uk
 www.crimereduction.gov.uk

The Organisation’s Vulnerabilities

 People – staff, customers, visitors, contractors.

 Physical Assets – buildings, contents, stock, equipment and sensitive
material.
 Information – IT systems, online transaction systems, electronic and
paper data.
 Processes – supply chains, critical procedures, production.
Besides protecting key assets it is also important to identify security measures
in place and more importantly what measures can be improved.

 Are the current security procedures sufficient?

 Are mobile phones being used responsibly by staff?
 Are sufficient security checks in place including pre-employment?
 Are staff able to sensitive/valuable data offsite without permission?

Protective Measures
The most effective security measures will include a combination of physical,
information and personnel security measures. This combination will work to
secure an organisation through a mix of deterrence and detection.

 Physical Security – a measure that protects again physical attacks.

 Information Security – to protect organisations data in its various forms.
 Personnel Security – the risk of staff or contractors exploiting their
legitimate access.

SIX MOST COMMON SECURITY RISKS

Disgruntled Employees
Internal attacks, selling information, sabotage.
Security Solution – identify all privileged accounts and credentials and
immediately terminate those that are no longer in use.

Careless or Uniformed Employees

Security Solution – train employees in best security practices.

Mobile Devices
Data theft.
Security Solution – Put strict policies in place.
There are two methods with which cybercriminals hack into online public Wi-
Fi users:
 1. Man-in-the-middle attack - which involves a hacker intercepting your
logins, passwords or financial information as you use the public Wi-Fi.
2. Fake networks – where the hacker is able to breach unsuspecting uses
online security and data.

A hacker could also install malware on a device by sending phantom notices

of a system upgrade. If the user obliges then the malware is installed on the
device.

Minimising The Risks

1. Restrict file sharing.

2. Scrutinise the Public Wi-Fi you are intending to use.
3. Use a VPN (Virtual Private Network).
4. Only connect to HTTPS sites.
5. Enable your firewall.

Cloud Applications
Cloud-based threats.
Security Solution - Use strong encryptions, such as AES 256-bit, recognized by
experts as the crypto gold standard and retain the keys exclusively to prevent
any third party from accessing.

Unpatched or Un-patchable Devices

Network devices that employ software or firmware in their operation.
Security Solution -Incorporate a patch management program to ensure that
devices, and software, are kept up to date at all times.

Third-Party Service Providers

Contractors, vendors to support and maintain systems.
Security Solution – Vetting of any third party, remote access security,
enforcing multifactor authentication, require unique credentials for each
user.
Chapter 16

CONFLICT MANAGEMENT
What is important?

"Effective communication skills and conflict management techniques

can significantly reduce the incidence of workplace violence".

What is Workplace Violence?

Any incident in which a person is accused, threatened or assaulted in circumstances

related to their work.

Who is Responsible?

 Employers have a duty of care to employees.

 Employees must look after their safety.
 Employers must report certain injuries (RIDDOR).

Preventing Conflict

Proactive Service Delivery

 Understanding potential risks.

 Responding to prevent the serious incident happening.

Common Flashpoints

 Access control procedures

 Queues
 Searches
 Entry Refusals
 Drink / Drugs
 Reprimands
 Disputes / Complaints
 Evictions
 Arrests
Being Proactive

 Learn to recognise common flashpoints

 Agree on policies to reduce incidents
 Regular team meeting to agree on procedures
 Regular debriefs following incidents

Typical Procedures Include

 Well-positioned staff to deter trouble

 A consistent response to the incidence
 Procedures for specific tasks e.g. searching
 Involving Police and passing accurate information
 Use well-sited CCTV with good quality footage
 Effective team communications
 Preventing a build-up of queues and crowds
 Placing signs to discourage anti-social behaviour

Dynamic Risk Assessment

A method of continually assessing situations to ensure that risks of violence are

quickly recognised assessed and responded to

 A conscious and reliable process

How should a security officer deal with a potentially violent incident?

S Step back
A Assess threat (P.O.P)
F Find help
E Evaluate options
R Respond

P.O.P P = Persons or People

 History of previous aggression?

 Known criminals?
 Under the influence of drink/drugs?
  Mental health problems?
 Bigger, fitter, stronger than us?
 Friends/numbers?

P.O.P. O = Object

 Bottles / glasses
 Furniture
 Weapons
 Tools
 Moving vehicles
 Needles/sharps

P.O.P. P = Place

 Crowded areas
 Staircases
 Wet floors
 Broken glass
 CCTV coverage
 Blocked exits

Aggression
What Turns People To Violence Anger
Frustration

Reducing Frustration

 Stopping people from queuing for too long

 Providing information if there is a delay
 Responding to and taking complaints seriously
 Managing people expectations
 Explaining rules and decisions
 Using effective communications
Basic Elements of Communication

Sender
encodes
Sends Message
decodes
Receiver

Both sender and receiver check understanding

When communicating remember that:-

 People interpret things in a different way

 I not just what you say, but how you say it
 There may be a block in communication

Empathy

Empathising means:

 Putting yourself in their shoes

 Acknowledging their feelings
 Stepping alongside them
 Seeing things from their point of view
“I understand why you are upset, but

Communication

Body Language 55%

stance, hand Tone 38%
gestures and the way words
expressions are spoken Words 7% of
words spoken
There May Be a Block to Communication

 Background noise
 Heat, pain, anger
 Language
 Drink/drugs
 Mental illness
 Culture
 Emotion
 Attitude
 Psychological noise

You Can Choose Your Behaviour

affects My attitude affects

My behaviour My behaviour

affects Your attitude affects

Your behaviour is everything you say and do.

Aggressive
Types of behaviour Passive
Assertive

Use Active Listening

 Listen to what they are saying

 Focus your attention on them
 Use non-verbal clues
 Paraphrase
 Use “open” questions
Triggers
We need to avoid accidentally “triggering” someone into violence.

A trigger is something that causes someone to lose their temper and turn to violence.

Triggers include:-

 Embarrassment
 Disrespect
 Insults
 Rudeness
 Being ridiculed
 Being ignored
 Being patronised

Inhibitors

An “inhibitor” is something that stops someone from losing their temper and turning
to violence.

An “inhibitor” is opposite to a trigger.

Inhibitors include:-

 Social or legal consequences

 Self-control
 Personal values
 Fear of other person fighting back
Managing Conflict

How people respond to threats

Fight or flight

Signalling non-aggression

Responding to conflict

Responding to a Threat

 Calm – Rational thinking - Emotional feelings

 Angry / Upset – Rational thinking – Emotional feelings

Fight or Flight

 A response to a threat
 A natural basic instinct
 Prepares our body for action

Fight or Flight – The chemical cocktail

The chemicals adrenaline, dopamine, endorphins and cortisol exist in the human
body. Powerful emotions such as excitement, apprehension, fear and severe stress
may trigger the chemical cocktail and you and subjects may be boosted with an
increased adrenal dose. These chemicals act faster than alcohol and the effects
may be instantaneous and overwhelming.
 Intimidation
or
Don’t trigger Touching
or
a person Standing too close or side on

into a fight or
Inappropriate gestures
or flight by or
Blocking there exist
or
Cornering them in

Signs of Escalation

 Staring with very strong eye contact

 Frowning
 Flushed red face as the colour might drain near an attack
 Stepping in and invading someone’s space
 Standing square on
 Splaying the arms to make them look bigger
 Turning to a fighting stance
 Making a fist
 Looking at an area they are intending to strike
 Ranging a strike by gentle touching the area they are going to strike
 Pupil dilates
 Rapid heavy breathing
 Rapid hand and body movements
 Offensive words

High-Risk Conflict

High-risk conflict is when you are in immediate risk of being physically assaulted.
The 4 A’s

Don’t get Angry

Manage the Abuse
Maintain a positive Attitude
Be Assertive

Defusing High-Risk Conflict

 Signal non-aggression (P.A.L.M.S.)

 Actively listen
 Empathise
 Win their trust
 Look for a win-win
 Deliver a gift

Signalling non-aggression

 Avoid further escalations

 Verbal and non-verbal communications
 Shows the security officer’s intention to peacefully resolve the situation
 P.A.L.M.S.

P Positive
A Attitude USE
L Look and listen OPEN
M Make space PALMS
S Stance

Position – consider your position to the person

Maintain – a positive attitude

Look and Listen – watch what they are doing and listen to everything they say

Make space – keep an appropriate safe distance - intimate space 0 to 0.5m,

normal space 0.5 to 1.2m, stranger space 1.2 to 3m

Stance – consider your position to the person, consider how you look
Win-win
Where both sides of a confrontation come out of an encounter feeling reasonably
satisfied with the outcome

What is your win?

 Minimum aggression and stress

 Doing a professional job
 Finding a successful solution
 Leaving other person satisfied that you have done your best

What’s their win?

 Saving face
 Being listened to and taken seriously
 Being treated fairly and professionally
 Receiving a helpful explanation

Gifts

 Let the person think you have done them a favour

 Leave them with a positive impression of you

Gifts might include:

 Explaining the site rules

 Explaining the complaints procedure
 Calling a supervisor to them
 Telephoning a taxis
 Recommending an alternative site
 Offering the chance to return at a later date
 A refund om tickets if appropriate

Extra Strategies
“A prepared way of getting yourself away from a difficult or dangerous situation”.

Resolving conflict may involve:

  Proactive service delivery
 Being assertive
 Signalling non-aggression (P.A.L.M.S.)
 Choosing positive behaviour
 Watching for signs of escalation
 Showing empathy
 Using inhibitors
 Active listening
 Providing options and choices
 Looking for a win-win
 Delivering a gift
 Employing exit strategies
 Building a rapport

Team Working
“Contact and cover or lead and support”

 The security officer initially dealing with the person and engage in
conversation
 Stands closest
 Should stand further away, to one side
 Listens to and watches and does not get drawn into the conversation

Team Work - How not to do it:

 Contact and cover must not crowd or intimidate the person

Switching

 Contact and cover may decide to switch to defuse a situation if necessary

Passing the baton

A person could be passed to:

 The site security supervisor

 A site manager
  A more experienced colleague
 A colleague with more time to help them

Drawing round (2 aggressors)

Two people should be drawn away from each other

Learn From Conflict

Post-incident considerations

 Support the victim

 Learning from what happened
 Sharing good practice
 Time to improve

Debriefing Incidents

Incident

What can I learn What

for the next time? happened?

Why did it
happen?

How we might feel if we are assaulted at work?

 Pain/injury
 Anger
 Shock
 Disbelief
  Embarrassment
 Fear

And remember

 All injuries involving staff must be recorded (RIDDOR)

 Any use of force must be justified
 Security policies and procedures must be reviewed regularly
 Professional help is available for staff injured at work
(www.victimsupport.org.uk)

Recording Conflict Incidents

 Pocketbook
 Incident book
 First Aid book (RIDDOR)
 Police statement

Security Guarding Scenarios

To develop your knowledge skills in conflict management, and help understanding
and confidence through practical application in scenarios.

Ejecting/evicting a customer

 Enforcement scenarios
 Defusing scenarios
 Confronting scenarios
 High-risk scenarios