ICAO Security Manual Volume V

Doc 8973/7
Restricted
Approved by the Secretary General

and published under his authority
INTERNATIONAL CIVIL AVIATION ORGANIZATION

Volume V-2 Security Manual Doc8973/7
AMENDMENTS
The issue of amendments is announced regularly in the ICAO Journal

and in the monthly Supplement to the Catalogue of ICAO Publications
and Audio-visual Training Aids, which holders of this publication should
consult. The space below is provided to keep a record of such
amendments.
RECORD OF AMENDMENTS AND CORRIGENDA
AMENDMENTS CORRIGENDA
Date Date Entered Date of Date Entered
No. No.
applicable entered by issue entered by
Crisis management and response to acts of unlawful interference

Guidance material on ICAO Standards and Recommended Practices
Volume V. Crisis management and response to acts of unlawful interference Doc 8973/7
TABLE OF CONTENT
TABLE OF CONTENT................................................................................................................... 3
INTRODUCTION ........................................................................................................................... 4
CHAPTER 1 DEFINITIONS ...................................................................................................... 6
CHAPTER 2 GENERAL PRINCIPLES ................................................................................... 14
2.1 Operational aspects ......................................................................................................................... 14
CHAPTER 3 COLLECTION AND TRANSMISSION OF INFORMATION ............................... 17
CHAPTER 4 AIR TRAFFIC CONTROL .................................................................................. 20
CHAPTER 5 CONTINGENCY PLANS.................................................................................... 22
5.1 Principles .......................................................................................................................................... 22
5.2 Threat assessment and risk management .................................................................................... 24
5.3 Contingency plan exercises............................................................................................................ 24
5.4 Crisis management team................................................................................................................. 25
5.5 Incident access and control............................................................................................................ 26
5.6 Isolated aircraft parking position ................................................................................................... 27
5.7 Suspect explosive devices.............................................................................................................. 28
5.8 Emergency operations centre......................................................................................................... 28
5.9 Communications .............................................................................................................................. 29
5.10 Press and media............................................................................................................................... 30
5.11 Telephone enquiries and Relatives ................................................................................................ 30
5.12 Response to threats......................................................................................................................... 31
Bomb threats on the ground............................................................................................................... 32
Bomb threat in flight ........................................................................................................................... 33
Searching procedures ........................................................................................................................ 33
In-flight aircraft search procedures..................................................................................................... 34
Evacuation procedures....................................................................................................................... 34
Evacuation of air traffic services ........................................................................................................ 35
CHAPTER 6 REVIEW, ANALYSIS AND REPORTS .............................................................. 37
6.2 Reports .............................................................................................................................................. 37
Timescales for reports........................................................................................................................ 38
APPENDIX-1 COMPILATION AND DISSEMINATION OF INFORMATION CONCERNING AN
AIRCRAFT WHICH IS BEING SUBJECTED TO AN ACT OF UNLAWFUL INTERFERENCE ... 40
APPENDIX-2 THREAT ASSESSMENT METHODOLOGY.......................................................... 46
APPENDIX-3 RISK MANAGEMENT MODEL ............................................................................. 53
APPENDIX-4 ACTION BY THE RECIPIENT OF A BOMB THREAT TELEPHONE CALL.......... 59
APPENDIX-5 BOMB THREAT ASSESSMENT ........................................................................... 63
APPENDIX-6 RESPONSE TO BOMB THREATS AGAINST AIRCRAFT.................................... 67
APPENDIX-7 AIRCRAFT SECURITY SEARCH CHECKLIST .................................................... 71
APPENDIX-8 SUSPECT EXPLOSIVE DEVICES ........................................................................ 77
APPENDIX-9 SEARCH AND EVACUATION GUIDELINES ........................................................ 80
APPENDIX-10 OFFICIAL REPORT ON ACT OF UNLAWFUL INTERFERENCE....................... 87
Volume V - 3
INTRODUCTION
This manual has been developed to assist States in promoting safety and security within the field of civil
aviation. The objective of this document is to advise States on the prevention of and, where necessary,
response to acts of unlawful interference, through the application of an aviation security system comprised
of the four main elements:
legal framework and security oversight;
airport design, infrastructure and equipment;
human resources recruitment, selection, training and certification; and
procedures and the implementation of security measures.
In order to achieve a high degree of sustainable performance, it is necessary to apply a

multi-layered security system combining principles, procedures, programmes, technologies, and
countermeasures, based on each of the above elements, to form an overall system of systems approach to
aviation security.
The security manual, comprised of five volumes addressing the above-mentioned elements,
contains guidance as to how States may comply with the Standards and Recommended Practices of Annex
17 to the Convention on International Civil Aviation, signed at Chicago on 7 December 1944. While the
methods of compliance provided are based on generally recognized practices and procedures common
within the international civil aviation industry, they are not the only means of compliance. Other methods of
meeting the Standards and Recommended Practices contained in Annex 17 Security may be equally
appropriate. Modification to the practices and procedures proposed in the manual may also be necessary in
order to meet the varied legal and administrative structures within individual States.
The material in this volume, entitled Crisis Management and Response to Acts of Unlawful
Interference is intended for the appropriate authority, airport and aircraft operators and any other entity
responsible for crisis management and emergency response. This volume provides guidance with regard to
threat and risk assessment, contingency plans, collection and transmission of information during an act of
unlawful interference, and the subsequent review, analysis and reporting of any act of unlawful interference.
The remaining four volumes of the security manual address the following aspects of an
aviation security system:
Volume I-National Organization and Administration is intended for the appropriate authority
and provides guidance with regard to the development and implementation of a national
legal framework, oversight responsibilities of a State, as it pertains to aviation security. This
volume contains guidance related to legal aspects, international cooperation, and additional
security measure such as in-flight security officers, armed personnel, national aviation
security programme, quality control and procedures for handling sensitive information;
Volume II-Recruitment, Selection and Training is intended for any entity responsible for the
recruitment and training of personnel involved in the implementation of aviation security. It
provides guidance material with regard to the national training policy and the national civil
aviation security training programme, including recruitment, selection, training and
certification of security staff, selection and training of non-security staff and training
development;

Volume III-Airport Security, Organization, Programme and Design Requirements, is

intended for the airport operator and any entity responsible for design of the airport
infrastructure. It provides guidance material with regard to organization, airport security
programme and airport design requirements; and
Volume IVPreventive Security Measures is intended for all entities responsible for the
implementation of an aviation security system and consists of preventive procedures with
regard to access control, aircraft operator security, general aviation and aerial works,
passengers and cabin baggage, hold baggage, special categories of passengers, cargo,
mail and security procedures for other entities.
In order to keep this manual relevant and accurate, suggestions for improving it in terms of
format, content or presentation are welcome. Any such recommendation or suggestion will be examined
and, if found suitable, will be included in the next edition of this manual. Regular revision will ensure that this
manual remains both pertinent and accurate. Comments concerning this manual should be address to:
The Secretary General

International Civil Aviation Organization
999 University Street
Montreal, Quebec H3C 5H7
Canada
Volume V - 5
CHAPTER 1 DEFINITIONS
Terms that are defined in the ICAO Vocabulary (Doc 9713, 2nd edition, 2001) and the Annexes are used in
accordance with the meanings and usages given therein. A wide variety of terms are in use throughout the
world to describe facilities, procedures and concepts for airport operations and planning. As far as possible
the terms used in this document are those which have the widest international use.
Doc 9713 Part 1 &2 ICAO Vocabulary 2001 act of unlawful interference A53.
Acts of Unlawful Interference (Definition given for guidance purposes)
These are acts or attempted acts such as to jeopardize the safety of civil aviation and air transport, i.e.
unlawful seizure of aircraft in flight,
unlawful seizure of aircraft on the ground,
hostage-taking on board aircraft or on aerodromes,
forcible intrusion on board an aircraft, at an airport or on the premises of an aeronautical

facility,
introduction on board an aircraft or at an airport of a weapon or hazardous device or

material intended for criminal purposes,
communication of false information such as to jeopardize the safety of an aircraft in flight

or on the ground, of passengers, crew, ground personnel or the general public, at an
airport or on the premises of a civil aviation facility.
Accompanied hold baggage. Baggage accepted for carriage in the hold of an aircraft, on which the
passenger who checked it in is onboard.
Aerial work. An aircraft operation in which an aircraft is used for specialized services such as agriculture,
construction, photography, surveying observation and patrol, search and rescue, aerial advertisement, etc.
Aircraft. Any machine that can derive support in the atmosphere from the reactions of the air other than the
reactions of the air against the earths surface.
Aircraft operators documents. Air waybills/consignment notes, passenger tickets and boarding passes,
bank and agent settlement plan documents, excess baggage tickets, miscellaneous charges orders
(M.C.O.), damage and irregularity reports, baggage and cargo labels, timetables, and weight and balance
documents, for use by aircraft operators.
Aircraft maintenance area. All the ground space and facilities provided for aircraft maintenance. It includes
aprons, hangars, buildings and workshops, vehicle parks and roads associated therewith. Such an area is
normally designated as a security restricted area.
Aircraft in flight. An Aircraft from the moment when all its external doors are closed following embarkation
until the moment when such doors are opened for disembarkation.
Aircraft-in-service. A parked aircraft which is under surveillance sufficient to detect unauthorized access.

Aircraft not in service. An aircraft that is either parked for a period of more than 12 hours or is not under
surveillance sufficient to detect unauthorised access.
Aircraft security check. An inspection of the interior of an aircraft to which passengers may have had
access and an inspection of the hold for the purposes of discovering suspicious objects, weapons,
explosives or other dangerous devices.
Aircraft security search. A thorough inspection of the interior and exterior of the aircraft for the purpose of
discovering suspicious objects, weapons or other dangerous devices
Aircraft stand. A designated area on an apron intended to be used for parking an aircraft.
Airport. Any area in a Contracting State which is open for aircraft operations.
Airside. The movement area of an airport, adjacent terrain and buildings or portions thereof, access to
which is controlled.
Appropriate authority for aviation security. The authority designated by a State within its administration
to be responsible for the development, implementation and maintenance of the national civil aviation security
programme.
Apron. A defined area, on a land aerodrome, intended to accommodate aircraft for purposes of loading or
unloading passengers, mail or cargo, fuelling, parking or maintenance.
Apron passenger vehicle. Any vehicle used to convey passengers between aircraft and passenger
buildings.
Background check. A check of a persons identity and previous experience, including where legally
permissible, any criminal history, as part of the assessment of an individuals suitability to implement a
security control and/or for unescorted access to a security restricted area.
Baggage. Personal property of passengers or crew carried on an aircraft by agreement with the operator.
Baggage container. A receptacle in which baggage is loaded for conveyance in aircraft.
Baggage sorting area. Space in which departure baggage is sorted into flight loads.
Baggage storage area. Space in which checked/hold baggage is stored pending transport to aircraft and
space in which mishandled baggage may be held until forwarded, claimed or otherwise disposed of.
Bomb alert. A status of alert, put in place by competent authorities to activate an intervention plan intended
to counter the possible consequences arising from a communicated threat, anonymous or otherwise, or
arising from the discovery of a suspect device or other suspect item on an aircraft, at an airport or in any civil
aviation facilities.
Bomb threat. A communicated threat, anonymous or otherwise, which suggests, or infers, whether true or
false that the safety of an aircraft in flight or on the ground, or any airport or civil aviation facility or any
person may be in danger from an explosive or other item or device.
Cabin baggage. Baggage intended for carriage in the cabin of an aircraft.
Cargo. Any property carried on an aircraft other than mail, stores and accompanied or mishandled baggage.
Cargo area. All the ground space and facilities provided for cargo handlings. It includes aprons, cargo
buildings and warehouses, vehicle parks and roads associated therewith.
Volume V - 7
Cargo building. A building through which cargo passes between air and ground transport and in which
processing facilities are located, or in which cargo is stored pending transfer to air or ground transport.
Catering stores. All items, other than catering supplies, associated with passenger in-flight services, for
example newspapers, magazines, headphones, audio and video tapes, pillows and blankets, amenity kits, etc.
Catering supplies. Food, beverages, other dry stores and associated equipment used on board an aircraft.
Certification. A formal evaluation and confirmation by or on behalf of the appropriate authority for aviation
security that a person possesses the necessary competencies to perform assigned functions to an
acceptable level as defined by the appropriate authority.
Check-in. The process of reporting to an aircraft operator for acceptance on a particular flight.
Check-in position. The location of facilities at which check-in is carried out.
Courier service. An operation whereby shipments tendered by one or more shippers are transported as the
baggage of a courier passenger on board a scheduled aircraft operator service under normal passenger
hold baggage documentation.
Co-mail. Abbreviation of aircraft operator company mail, shipped within its network of stations.
Co-mat. Abbreviation of aircraft operator company materials, shipped within its network of stations.
Commercial air transport operation. An aircraft operation involving the transport of passengers, cargo or
mail for remuneration or hire.
Note: For the purpose of this Manual the aircraft operator term will be used instead of a commercial air
transport operator.
Contingency plan. A proactive plan to include measures and procedures addressing various threat levels,
risk assessments and the associated security measures to be implemented; designed to anticipate and
mitigate events as well as prepare all concerned parties having roles and responsibilities in the event of an
actual act of unlawful interference. A contingency plan sets forth incremental security measures that may be
elevated as the threat increases. It may be a stand alone plan or included as part of the Crisis Management
Plan.
Corporate aviation. The non-commercial operation or use of aircraft by a company for the carriage of
passengers or goods as an aid to the conduct of company business, flown by a professional pilot employed
to fly the aircraft.
Crew member. A person assigned by an operator to duty on an aircraft during a flight duty period.
Crisis management. Contingency measures implemented in response to increased threat levels as well as
implementation of measures and procedures in response to the emergencies to include acts of unlawful
interference.
Dangerous goods. Articles or substances which are capable of posing a risk to health, safety, property or
the environment and which are shown in the list of dangerous goods in the Technical Instructions or which
are classified according to those Instructions.
Deportee. A person who had legally been admitted to a State by its authorities or who had entered a State
illegally, and who at some later time is formally ordered by the competent authorities to leave that State.
Note: The competent authorities may provide an escort for such persons.

Diplomatic pouch (bag). A diplomatic bag is a shipping container having diplomatic immunity from search
or seizure.
Direct transit area. A special area established in an international airport, approved by the public authorities
concerned and under their direct supervision or control, where passengers can stay during transit or transfer
without applying for entry to the State.
Disruptive passenger. A passenger who fails to respect the rules of conduct at an airport or on board an
aircraft or to follow the instructions of the airport staff or crew members and thereby disturbs the good order
and discipline at an airport or on board the aircraft.
Emergency plan. The plan set forth the procedures for coordinating the response of different aerodrome
agencies (or services) and of those agencies in the surrounding community that could be of assistance in
responding to the emergency.
Explosive substance. Solid or liquid substance (or mixture of substances) which is in itself capable by
chemical reaction of emitting gases at such a temperature, pressure and speed as to cause damage in the
surrounding area.
This definition includes pyrotechnic substances, even if they do not emit gases. Those substances that are
in themselves not explosive but may produce an explosive atmosphere of gas, vapour or dust are not
included.
Explosive Detection System (EDS). A system or combination of different technologies which has the ability
to detect, and so to indicate by means of an alarm, explosive material contained in baggage, irrespective of
the material from which the bag is made.
Explosive Device Detection System (EDDS). A system or combination of different technologies which has
the ability to detect, and so to indicate by means of an alarm, an explosive device by detecting one or more
components of such a device contained in baggage, irrespective of the material from which the bag is made.
Facilitation. The efficient management of a necessary control process, with the objective to expedite
clearance of persons or goods and prevent unnecessary operational delays.
Freight. See Cargo.
General Aviation operation. An aircraft operation other than a aircraft operation or an aerial work
operation.
Human factors principles. Principles which apply to design, certification, training, operations and
maintenance and which seek safe interface between the human and other system components by proper
consideration to human performance.
Human performance. Human capabilities and limitations which have an impact on the safety, security and
efficiency of aeronautical operations.
Identification cards. See Permits.
Inadmissible person. A person who is or will be refused admission to a State by its authorities. Such
persons normally have to be transported back to their State of departure, or to any other State where the
persons are admissible, by the aircraft operator on which they arrived (see appropriate Standards in ICAO
Annex 9, Chapter 5).
In-flight Security Officer. A person who is employed and trained by the government of the State of the
Operator or by the government of another Contracting State to travel on an aircraft with the purpose of
protecting that aircraft and its occupants against acts of unlawful interference. This excludes persons
Volume V - 9
employed to provide exclusive personal protection for one or more specific people travelling on the aircraft,
such as personal bodyguards.
Integrated/consolidated cargo. A consignment of multi-packages which has been originated by more than
one person, each of whom has made an agreement for carriage by air with another person other than a
scheduled aircraft operator.
Interline baggage. Baggage of passengers subject to transfer from the aircraft of one operator to the
aircraft of another operator in the course of the passengers journey. (see also online baggage and transfer
baggage)
International airport. Any airport designated by the Contracting State in whose territory it is situated as an
airport of entry and departure for international air traffic, where the formalities incident to customs,
immigration, public health, animal and plant quarantine and similar procedures are carried out.
Known consignor.
For Cargo: The originator of property for transportation by air for his own account and who has established
business with a regulated agent or aircraft operator on the basis of the criteria detailed in this document.
For Mail: The originator of mail for transportation by air for his own account and who has established
business with a regulated postal authority/administration.
Known Supplier of LAGs and/or Known Supplier of STEBs. Entity that ensures implementation of the
security controls and protection from unauthorized interference with supplies of LAGs or supplies of STEBs,
respectively, from their first point of entry on airside until their delivery to passengers. The Known Supplier of
LAGs and/or the Known Supplier of STEBs fully accepts responsibility, by written declaration, for the
implementation and quality control of LAGs and STEBs within the supply chain on the airside.
Landside. That area of an airport and buildings to which both traveling passengers and the non-traveling
public have unrestricted access. (See also Non-restricted area.)
Mail. Dispatches of correspondence and other items tendered by and intended for delivery to postal
services in accordance with the rules of the Universal Postal Union (UPU).
Mishandled baggage. Baggage involuntarily, or inadvertently, separated from passengers or crew.
Movement area. That part of an aerodrome to be used for the take-off, landing and taxiing of aircraft,
consisting of the manoeuvring area and the apron(s).
Narcotics control. Measures to control the illicit movement of narcotics and psychotropic substances by air.
Non-restricted area. Areas of an airport to which the public have access or to which access is otherwise
unrestricted.
Off-airport processing facilities. A passenger or cargo transport link terminal at an urban population
centre at which processing facilities are provided.
On-demand Commercial Aviation. Proposed definition being prepared by IBAC, IAOPA and ICAO-ANB
with a view to separate advice to the Panel.
Passenger area. All the ground space and facilities provided for passenger processing. It includes aprons,
passenger buildings, vehicle parks and roads.
Permits. A permit system consists of cards or other documentation issued to individual persons employed
on airports or who otherwise have need for authorized access to the airport, airside or security restricted

area. Its purpose is to identify the individual and facilitate access. Vehicle permits are issued and used for
similar purposes to allow vehicular access. Permits are sometimes referred to as airport identity cards or
passes.
Person with disabilities (with reduced mobility). Any person whose mobility is reduced due to a physical
incapacity (sensory or locomotor), an intellectual deficiency, age, illness or any other cause of disability
when using transport and whose situation needs special attention and the adaptation to the persons needs
of the services made available to all passengers.
Pilot-in-command. The pilot responsible for the operation and safety of the aircraft during flight time.
Regulated agent. An agent, freight forwarder or any other entity who conducts business with an operator
and provides security controls that are accepted or required by the appropriate authority in respect of cargo,
courier and express parcels or mail.
Restricted articles. Articles which are, in the specific context of aviation security, defined as those articles,
devices or substances which may be used to commit an act of unlawful interference against civil aviation or
which may endanger the safety of the aircraft and its occupants, or installations and the public.
Sabotage. An act or omission, intended to cause malicious or wanton destruction of property, endangering
or resulting in unlawful interference with international civil aviation and its facilities.
Screening. The application of technical or other means which are intended to identify and/or detect
weapons, explosives or other dangerous devices, articles or substances which may be used to commit an
act of unlawful interference.
Note. Certain dangerous articles or substances are classified as dangerous goods by Annex 18 and the
associated Technical Instructions for the Safe Transport of Dangerous Goods by Air (Doc 9284) and must
be transported in accordance with those instructions.
Security. A combination of measures and human and material resources intended to safeguard civil aviation
against acts of unlawful interference.
Security audit. An in-depth compliance examination of all aspects of the implementation of the national civil
aviation security programme.
Security checks for LAGs and STEBs. Visual checks or security controls, performed by security staff, for
signs of interference, in particular tampering with seals, theft and the introduction of potentially dangerous
devices, articles or substances. The checks should be made at the first point of entry on the airside. The
checks should be made on all supplies of LAGs and STEBs to establish that they have been protected, that
there is no evidence or suspicion of tampering, and that the necessary documentation is in order.
Security control. A means by which the introduction of weapons, explosives or other dangerous devices,
articles or substanceswhich may be used to commit an act of unlawful interference can be prevented.
Security exercise. A full-scale security exercise is a simulated act of unlawful interference with the objective
of ensuring the adequacy of the contingency plan to cope with different types of emergencies.
A partial security exercise is a simulated act of unlawful interference with the objective of ensuring the
adequacy of the response to individual participating agencies and components of the contingency plan, such
as the communications system.
Security equipment. Devices of a specialized nature for use, individually or as part of a system, in the
prevention or detection of acts of unlawful interference with civil aviation and its facilities.
Security inspection. An examination of the implementation of relevant national civil aviation security
programme requirements by an airline, airport, or other entity involved in security.
Volume V - 11
Security investigation. An inquiry into any act or attempted act of unlawful interference against civil
aviation and/or any alleged or suspected instance of non-compliance with the State' s National Civil Aviation
Security Programme or other legal and/or regulatory requirements pertaining to civil aviation security.
Security programme. Written measures adopted to safeguard international civil aviation against acts of
unlawful interference.
Security restricted area. Those areas of the Airside of an airport which are identified as priority risk areas
where in addition to access control, other security controls are applied. Such areas shall normally include,
inter alia, all commercial aviation passenger departure areas between the screening checkpoint and the
aircraft, the ramp, baggage make-up areas, including those where aircraft are being brought into service and
screened baggage and cargo are present, cargo sheds, mail centres, airside catering and aircraft cleaning
premises.
Security test. A covert or overt trial of an aviation security measure which simulates an attempt to commit
an unlawful act.
Security survey. An evaluation of security needs including the identification of vulnerabilities which could be
exploited to carry out an act of unlawful interference, and the recommendation of corrective actions.
Service panel. Aircraft external access point used for providing aircraft services; such include water,
lavatory, ground electrical outlets and other service compartments that have external clip-down panels.
Small arms. A general description applied to all hand-held firearms.
State of Registry. The State on whose register the aircraft is entered.
Sterile area. That area between any passenger inspection or screening control point and aircraft into which
access is strictly controlled. (Also known as Security restricted area.)
Stores (Supplies).
Stores (Supplies) for consumption. Goods, whether or not sold, intended for consumption by the
passengers and the crew on board aircraft, and goods necessary for the operation and maintenance
of aircraft, including fuel and lubricants.
Stores (Supplies) to be taken away. Goods for sale to the passengers and the crew of aircraft with
a view to being landed.
Supplies of LAGs. Liquids, gels and aerosols, in any volume, for sale at airport outlets (excluding food and
beverages for consumption in the airport premises and not intended for carriage into the aircraft passenger
cabin) or on board aircraft during the day(s) of the journey, either in the airside area, or in a security
restricted area.
Supplies of STEBs. Security tamper-evident bags that should only be used for the sale of LAGs by airport
outlets, or on board aircraft.
Terminal. The main building or group of buildings where the processing of commercial passengers and
freight and the boarding of aircraft occurs.
Transfer passengers/baggage. Passengers/baggage making direct connections between two different

flights.
Transit passengers. Passengers departing from an airport on the same flight as that on which they arrived.

Threat Image Projection (TIP). A software programme approved by the appropriate authority which can be
installed on certain X-ray machines. The programme projects virtual images of threat articles (e.g., guns,
knives, improvised explosive device) within the X-ray image of a real bag under examination or complete
virtual images of bags containing threat articles, and provides immediate feedback to the X-ray machine
operators of their ability to detect such images.
Trace Detection Equipment. Technology system or combination of different technologies which has the
ability to detect very small amounts, and so to indicate, by means of an alarm, explosive materials contained
in baggage, or other articles subjected for analysis.
Travel document. A passport or other official document of identity issued by a State or organization, which
may be used by the rightful holder for international travel .
Unaccompanied baggage. Baggage which may or may not be carried on the same aircraft with the person
to whom it belongs.
Unclaimed baggage. Baggage which arrives at an airport and is not picked up or claimed by a passenger.
Unidentified baggage. Baggage at an airport, with or without a baggage tag, which is not picked up by or
identified with a passenger.
Unruly passengers. Persons who commit on board a civil aircraft, from the moment when the aircraft door
is closed prior to take-off to the moment when it is reopened after landing, an act of:
assault, intimidation, menace or wilful recklessness which endangers good order or the safety of
property or persons;
assault, intimidation, menace or interference with a crew member in performance of duties or which
lessens ability to perform duties;
wilful recklessness or damage to an aircraft, its equipment, or attendant structures and equipment
such as to endanger good order and safety of the aircraft or its occupants;
communication of information which is known to be false, thereby endangering the safety of an
aircraft in flight;
disobedience of lawful commands or instructions for safe, orderly or efficient operations.
Vulnerable point. Any facility on or connected with an airport, which, if damaged or destroyed, would
seriously impair the functioning of the airport.
Volume V - 13
CHAPTER 2 GENERAL PRINCIPLES
2.1 OPERATIONAL ASPECTS
2.1.1 It must be recognized that despite the best efforts of States, airport administrations and
aircraft operators, acts of unlawful interference, attempts to commit such acts or threats thereof are likely to
occur from time to time. Therefore States should develop crisis management measures and procedures
which should involve identifying crisis' s, planning the appropriate response to the crisis and confronting and
resolving the crisis. As a consequence, flexible contingency and emergency plans for each type of
occurrence as a part of crisis management plan should be prepared for each airport in accordance with
requirements of the NCASP.
2.1.2 Emergency plans are in nature reactive dealing with incidents occurring in the air or on the
ground (mainly safety-related emergencies even if they started as security-related incidents) and are
designed to limit the consequences or the impact of such incidents. Contingency plans are more proactive
including measures and procedures to deal with various threat levels, risk assessments and the associated
security measures to be implemented, and are designed to anticipate events, and prepare all concerned
parties, involved in case of emergencies. In either cases, resources, facilities and personnel must be made
available in support of these plans.
2.1.3 States should ensure that airports remain open and available for use by an aircraft
subjected to an act of unlawful interference. The denial of essential navigation aids or ATS and
communications services, turning off essential lighting, particularly on runways and taxiways, and the
deliberate obstruction of runways can only increase the probability of an accident to such an aircraft. A
combination or any one of these deliberate decisions will seriously endanger the lives of passengers. Lack
of provision of assistance to such an aircraft could result in:
a) injury to persons on board an aircraft;
b) damage resulting from an in-flight explosion;
c) fuel shortage;
d) mechanical failure; and/or
e) other unforeseen emergencies.
In addition, the perpetrators may vent their frustrations on the hostages under their control.
2.1.4 Each State is obliged, under the aviation security Conventions, to take adequate measures
for the safety of passengers and crew of an aircraft which is subjected to an act of unlawful interference until
their journey can be continued. This obligation may arise as a consequence of a wide variety of acts,
ranging from the sabotage of an aircraft in transit through the airspace of a State to the termination of an act
of unlawful seizure at an airport. Also included is the length of time which may be required to restore an
aircraft to a serviceable state after its emergency exit equipment has been deployed to allow the evacuation
of passengers.
2.1.5 A single government agency should be assigned primary responsibility and authority to
determine the course of action to be taken when an aircraft subjected to unlawful interference is in the
airspace or at an airport. This agency should coordinate all actions with the civil aviation authority, the airport
administration, the affected operator, the State of Registry/Operator of the affected aircraft, and such other
organizations on or off the airport as may be deemed appropriate.

2.1.6 When different government agencies are assigned responsibility for managing acts of
unlawful interference taking place in flight or on the ground, it will be essential for a clear and precise
procedure to have been established prior to an occurrence, so that there will be no confusion as to when
responsibility passes from one agency to another during an act of unlawful interference.
2.1.7 When an aircraft which has been unlawfully seized is parked at an airport, the competent
authorities of the State in which the airport is situated should not take any action to terminate the unlawful
seizure of the aircraft without taking into account, in particular, any wishes that the pilot-in-command may
have been able to express and, if feasible, those of appropriate officials of the State whose aircraft operator
is operating the aircraft. As the safety of the passengers and crew should be the overriding consideration of
those involved in reaching any decision, full weight must be to all relevant circumstances and to the views of
the operator.
2.1.8 Contingency plans for dealing with an act of unlawful interference involving an aircraft
should take into consideration the following factors:
a) the safest place for an aircraft under an act of unlawful interference is on the ground
(the national contingency plan should therefore be closely coordinated with airport
contingency plans);
b) the paramount objective is the safe release of passengers and crew, which overrides
other considerations such as capture and punishment of the perpetrators and the
protection of property;
c) there is a need to ensure that the perpetrators of acts of unlawful interference will be
confronted with a well-organized and effective response so that damage or injury may
be prevented or minimized;
d) negotiations should always prevail over the use of force until it becomes evident to
decision makers that all other possibilities have been exhausted and the consultative
process has reached a deadlock;
1
e) negotiations with the offenders should be conducted by persons properly trained and
skilled in such matters since this is far more likely to result in the successful termination
of the occurrence with the least loss of life, injury to persons and damage to or loss of
property;
f) in general, persons in a position to make decisions on the demands made by offenders

without referral to a higher authority should not enter into direct negotiations with the
offenders and should preferably not be immediately available at the airport Emergency
Operating Centre (EOC) or other command post;
g) procedures and equipment to ensure secure communications channels between the

aircraft and the negotiators must be in place; and
h) the aircraft should, where possible, be parked in an isolated parking position to minimize
the disruption to normal airport operations.
2.1.9 States should develop a standard procedure to relay confidential information concerning an
act of unlawful interference. Measures should ensure that persons, including aircraft operators acting in an
official capacity, do not divulge information likely to jeopardize the safety of international civil aviation to the
press or to others.
1
ICAO has developed Aviation Security Training Packages (ASTPs) for Negotiators (Levels 1 and 2). Check ICAO website
www.icao.int under aviation security.
Volume V - 15
2.1.10 In addition to the requirements included in Annex 6, Chapter 13 Operation of Aircraft

prescribes that:
a) operators shall establish and maintain a training programme which enables crew
members to act in the most appropriate manner to minimize the consequences of acts
of unlawful interference;
b) pilots-in-command should submit reports on acts of unlawful interference promptly;
c) a checklist should be available on-board detailing bomb search procedures; and
d) the flight crew compartment door on passenger-carrying aircraft should be capable of

being locked from within the flight deck compartment.

CHAPTER 3 COLLECTION AND TRANSMISSION OF

INFORMATION
3.1.1 In the event of an occurrence, each Contracting State responsible for providing air traffic
services for an aircraft which is the subject of an act of unlawful interference shall collect and compile all
pertinent information on the flight of that aircraft and transmit the information to all other States responsible
2
for the air traffic services (ATS) units concerned. Also included are the units at the airport of the known or
presumed destination, so that timely and appropriate action may be taken en route and at the aircrafts
known, likely or possible destination.
3.1.2 This information must be distributed locally to the appropriate authority for security, air traffic
services units concerned, the appropriate airport administrations, the operator and others concerned, as
soon as practicable.
3.1.3 The rapid, systematic collection and dissemination of information regarding such an aircraft
requires close cooperation between security services and related ATS units in each State through whose
airspace the aircraft will, or may, proceed. In particular, close cooperation is required between the
designated security officer and the relevant ATS unit in whose area the unlawful seizure first becomes
known. The object is to ensure that information is collected and transmitted, in a step-by-step manner as the
flight progresses, to the appropriate security services and air traffic services units in each State which may
become involved, so that timely and appropriate safeguarding action may be taken en route and at the
aircrafts known, likely or possible destination. Further guidance is shown in Appendix 1-Compilation and
dissemination of information concerning an aircraft which is being subjected to an act of unlawful
interference.
3.1.4 The initial notification should be sent to all security services and ATS units within an area of
probability to be determined in each case but avoiding unnecessary alerting on too wide a scale.
Circumstances such as direction of flight, range of aircraft, proximity to the borders of other States or to
other flight information regions, and the need to provide any advance warning should all be considered. This
should be done, if possible, within at least one or two hours. As a minimum, all adjacent States along, or in
the proximity of, the projected flight path should be forewarned. It is desirable that all security services and
ATS units follow the same pattern as the flight progresses.
3.1.5 The State in which an aircraft subjected to an act of unlawful interference has landed shall
pass information regarding the landing to the State of Registry and the State of the Operator of the aircraft,
by the quickest possible means, and not later than one hour after the aircraft has landed.
3.1.6 In every case, the recipient of a message should acknowledge receipt so that the originator
knows the message has been delivered.
3.1.7 As soon as circumstances indicate that special security precautions may be dispensed with,
such information should immediately be transmitted by the appropriate authority for security to the affected
States, airports and operators.
3.1.8 The essential information that should be collected and transmitted progressively to those
concerned should include:
a) the known or anticipated route of flight;
b) the known or suspected destination and the estimated time of arrival;
2
other ICAO reference documents should be considered as Doc 4444 Procedures for Air Navigation Services Air Traffic
Management
Volume V - 17
c) supplementary flight plan data such as fuel endurance (expressed in hours and
minutes, if possible) and number of crew and passengers on board;
d) the composition of the flight crew and its knowledge and experience of the anticipated
route;
e) the presence of In-Flight Security Officers (IFSOs) on board the aircraft;
f) the availability on board the aircraft of navigation charts and associated documentation;
and
g) flight time limitations of the flight crew taking into account the number of hours already
flown.
3.1.9 In addition, the following information should be forwarded, to the extent that it can be
obtained:
a) the number, names and nationalities of passengers and, if possible of the offenders;
b) the number and condition of injured persons on board;
c) the number, type and any other information on weapons, explosives and incendiary
material, devices or other substances known or believed to be in the possession of the
offenders; and
d) the physical condition of the flight crew and IFSOs if present on board.
3.1.10 The most efficient means of disseminating the information are as follows:
a) ATS units along the flight route collect and transmit to other ATS units concerned, all
information required for ATS and search and rescue (SAR) purposes; and
b) security services in each State along the flight route collect and transmit information to
other security services concerned using the designator YZY to identify and thereby
expedite delivery of messages.
3.1.11 Each State in which an aircraft subjected to an act of unlawful interference has landed is
required to notify by the most expeditious means the State of Registry of the aircraft and the State of the
operator of the landing and similarly transmit by the most expeditious means all other relevant information
to:
a) the State of Registry and the State of the Operator of the aircraft;
b) each State whose citizens suffered fatalities or injuries;
c) each State whose citizens are/were detained as hostages;
d) each State whose citizens are/were known to be on board the aircraft; and
e) the International Civil Aviation Organization (ICAO) and any other relevant
international/regional organizations.

3.1.12 In order that threat information may be disseminated immediately, taking into account confi-
dentiality and local requirements, one of the following means of communication may be used:
a) telephone, electronic mail, telegram or the aeronautical fixed service (AFS) circuits to
report an incident likely to occur within the next 12 hours;
b) telegram, electronic mail or AFS to report an incident likely to occur sometime after the
next 12 hours and within the next 12 days;
c) registered airmail or telegram to report an incident likely to occur more than 12 days
hence; and
3
d) the ICAO Aviation Security Point of Contact (AVSEC PoC) network .
3.1.13 Designators should be used to identify communications intended for the airport security
services as published in the ICAO Designators for Aircraft Operating Agencies, Aeronautical Authorities and
Services (Doc 8585).
3.1.14 When a State has intelligence or other information which indicates that specific aircraft may
be subject to an act of unlawful interference, the aircraft operator concerned and any airports at which the
aircraft might land are to be notified to enable them to respond and implement any additional security
measures considered necessary to counter the threat and any increased risk assessment by the appropriate
authorities.
3.1.15 Notification should follow well-established communication procedures and be sufficiently

secure and fast to ensure its timely receipt by the aircraft operator and other agencies required to respond
and implement the additional security measures. The appropriate authority for security must be included in
the notifications if it is not the initiating agency of such requirements.
3
for further information on the ICAO AVSEC PoC network, please contact SGM Section at sgm@icao.int
Volume V - 19
CHAPTER 4 AIR TRAFFIC CONTROL

4.1.1 All unlawfully seized aircraft or those subject to a bomb threat must be deemed to be in a
state of emergency and treated accordingly. When such aircraft are not fitted with a transponder able to
transmit a code setting of 7500 which will alert all radar stations equipped with secondary radar, the flight
crew whether it is possible (i.e. not always during the acts of unlawful seizure when there is a cockpit
intrusion) should use plain language to inform ground control authorities.
4.1.2 Flight information service should be provided in accordance with Annex 11-Air Traffic
Services and the PANS-ATM. Alerting service (Annex 11 and PANS-ATM), search and rescue (Annex 12-
Search and Rescue), and those procedures relating to emergencies and radio communications failure
(PANS-ATM), should be called for and provided as dictated by the circumstances surrounding each
occurrence.
4.1.3 States should plan for the possibility of an unlawful act of interference occurring to an
aircraft while it is within the jurisdiction of their air traffic control facilities. A notification system should be
developed which would utilize radar transponder coded transmission, voice communication, visual signals
and other suitable methods. Specific air traffic control instructions should be published. Where transponder
coded transmission is not available, the use of the term channel 7500 immediately after the aircraft call
sign in transmissions to air traffic control can be a useful contingency. Other alternatives, involving other
words not common to air traffic service normal terminology, are similarly useful.
4.1.4 Air traffic controllers should:
a) be prepared to recognize plain language or covert messages that indicate the

occurrence or impending occurrence of an unlawful seizure, bomb threat or act of
sabotage;
b) immediately notify their supervisor upon receiving information that indicates the unlawful
seizure of an aircraft. The supervisor should immediately notify the following:
the appropriate authority for security and the civil aviation authority (if the two are
not one and the same);
the appropriate airport administration;
the appropriate search and rescue agency, as required;
the owner/operator of the aircraft;
other government organizations;
adjacent air traffic service units; and
c) comply with the following when controlling an aircraft that has been unlawfully seized:
be discreet in communications with the pilot and be responsive to the pilots

requests;
monitor the aircraft and use normal hands-off procedures without requiring
transmissions or responses by the pilot unless the pilot has established
communication; and
if military aircraft are dispatched to intercept and escort the unlawfully seized
aircraft, provide all possible assistance to the intercepting aircraft to aid in placing
them in a position behind and below the seized aircraft.
4.1.5 In cases of emergency it may be necessary, in the interests of safety, for an aircraft to enter
an airport traffic circuit and effect a landing without proper authorization. Controllers should render all
assistance possible.

4.1.6 Upon receiving notification of the threat of an act of unlawful interference to an aircraft at the
airport, the controller should immediately notify the appropriate authority, the aircraft operator and the airport
operator, and:
a) if the aircraft is on the ground, deny clearance for its take-off until appropriate measures
have been taken to establish that the threat is false and continuance of the flight may be
authorized, or until the aircraft and contents have been searched and declared by a
competent authority to be no longer under threat. After denying clearance the control
tower should clear affected taxiways and runways and direct the aircraft to taxi or be
towed to the isolated parking position. At the same time, the rescue, fire fighting and
security services should be alerted in accordance with the airport emergency plan; and
b) if the aircraft is airborne, clear the aircraft to land in accordance with established
emergency procedures at the request of the pilot-in-command. In these circumstances,
the decision on the action to be taken should be that of the pilot-in-command. If the
decision made is to continue the flight, then, for the duration of that flight, the aircraft
should be treated as suspect and appropriate separation arranged with contiguous air
traffic services units to ensure that other aircraft are not endangered.
Volume V - 21
CHAPTER 5 CONTINGENCY PLANS

5.1 PRINCIPLES
5.1.1 Security instructions, emergency instructions and contingency plans as parts of crisis
management plan should be developed at the national level and for each airport. The national contingency
plan should focus mainly on incidents involving aircraft in the air, as airport contingency plans should focus
more on incidents occurring on the ground. These instructions should, at the very least, deal with:
a) the measures for re-screening of passengers, baggage, cargo, mail and stores following
a threat;
b) action to be taken in respect of unlawful seizure or sabotage of aircraft;
c) action to be taken in respect of unlawful attacks at an airport (aircraft or installations);
d) threat of such acts;
e) investigation of suspected explosive devices or other potential hazards at airports or

inside the aircraft; and
f) contingency plans, which should contain procedures for the disposal of such items.
5.1.2 Airport contingency plans for aviation security incidents should be compiled in much the
same manner as airport emergency plans are prepared to deal with emergencies of a non-security nature
occurring at airports. The national contingency plan should also follow the same format but focusing more on
incidents or emergencies in the air. More information on the preparation of airport emergency plans is
contained in the Airport Services Manual (Doc 9137), Part 7-Airport Emergency Planning.
5.1.3 To achieve their purpose, the airport and national contingency plans should be set out in an
easily understood manual (inclusion if possible in aerodrome emergency manuals should be considered for
airport contingency plans and inclusion in the national security programme for the national contingency plan)
and should contain the following elements:
a) policies in force;
b) options possible;
c) measures to be implemented;
d) resources available;
e) responsibilities; and
f) decision process, link with authorities and delegations of authorities.
5.1.4 The national contingency plan should be developed in cooperation with all national
agencies/authorities which take part in the resolution of major incidents/emergencies in the State, and its
airspace, considering the abilities, resources and potential of each individual national airport and regions. At
the airport level, each contingency plan should be a coordinated programme between national
authorities/agencies, individual airports and the surrounding community. This is desirable as the planning
and procedures needed to handle major security emergency situations on the airport are similar to other
types of emergencies that can strike a community, particularly in the response of the authority responsible
for police functions and medical aid agencies. The airport contingency plan should spell out the coordinated
response or participation of all existing agencies, both on and off airport, which could be of assistance in

responding to such emergencies, and should designate specific duties to be undertaken by each responding
agency. Examples of such agencies are:
a) government authorities;
b) authority responsible for police functions;
c) airport administration;
d) air traffic services;
e) aircraft operator;
g) military;
h) medical services;
i) rescue and firefighting services; and
j) hospitals.
5.1.5 Each airport/community has individual needs and distinct peculiarities because of political,
jurisdictional and agency differences. However, the basic needs and concepts of security emergency
planning remain the same and common major problem areas which need to be addressed are command,
control and communication.
5.1.6 The elaboration of a contingency plan at one airport is a major project and should respect
the following principles :
a) development of the project, planification, definition of the objectives and the team;
b) identification of the potential risks taking into consideration the strengths and
weaknesses of the airport, States policy as well as the local, national and regional
environment;
c) development of possible actions and responses; and
d) implementation of the necessary material and human resources for an effective

response.
5.1.7 Prior to the preparation of a contingency plan, it is essential that a thorough assessment be
conducted to obtain information about the layout and installations at the airport. Any such survey should
include the vulnerable points, the extent of available supporting services within and outside the airport,
facilities for evacuating personnel and diverting aircraft from normal terminals and the availability of
accommodation for the use of police, as well as floodlighting, communications and access points throughout
the airport. The reconnaissance should identify and make a special study of the most advantageous points
at which unlawfully seized aircraft might be positioned.
5.1.8 Up-to-date maps of the airport, plans and photographs of the airport and its environs and
the main types of aircraft in use by the major aircraft operators as well as a scale model of the airport are
invaluable aids to planning and training. If possible, advanced preparation and training of the forces which
might be engaged in the response should be organized for thorough familiarization of the local facilities.
Volume V - 23
5.2 THREAT ASSESSMENT AND RISK MANAGEMENT
5.2.1 In order to ensure the effective application of preventive security measures, the level of
threat must be continually reviewed taking into account the domestic, regional and international situations.
5.2.2 Contingency planning to promote coordinated and timely counteraction to the level of threat
is important. To ensure such a counteraction in the event of a serious incident of unlawful interference
involving a national-level government response, national contingency plans should include details on policy,
responsibilities and lines of command and communication from the highest level to the on-site command
and control authority.
5.2.3 Security measures and procedures should be flexible and commensurate with the threat
assessment which may fluctuate given various changing factors. As a consequence, the national civil
aviation security programme must detail the mechanisms for a valid threat assessment process, as well as a
risk management scheme, which must be followed by timely and effective implementation.
5.2.4 Valid threat assessment and analysis can be best achieved by instituting a systematic and
continual process of intelligence collection and evaluation. This will require coordination at the national level
among all responsible entities as well as close cooperation with the regional/international intelligence
community. Guidance material is shown in Appendix-2 - Threat assessment methodology.
5.2.5 Whenever a specific threat exists, selected and predetermined preventive security
measures should be applied depending upon the nature of the threat. The appropriate authority for aviation
security, usually through the civil aviation security policy and regulatory section, needs to analyse the
vulnerabilities of the aviation system in relation to the threat assessment and initiate appropriate adjustments
to the national civil aviation security programme as well as the set of additional security measures to be
implemented for each elevated threat level. Guidance material is shown in Appendix-3 Risk management
model.
5.2.6 Because terrorism is a trans-national problem, an act of unlawful interference can originate
in one State but impact more than one State. Each Contracting State must be prepared for such an
eventuality and have procedures in place to share pertinent threat information with other Contracting States,
at least to the extent practicable taking into account the protection of sources and methods of collection.
Procedures should be designed to disseminate threat information in a timely manner and with the proper
4
controls. Use of the ICAO AVSEC PoC network is highly recommended.
Airport threat and risk assessment
5.2.7 When applying security considerations in airport design, it will be necessary to conduct an
airport threat and risk assessment. It is strongly recommended that these threat and risk assessments be
taken together with national appropriate authorities so that the design of the airport will be flexible enough to
adapt to future security requirements. The sooner proper resources are allocated to threat and risk
assessment of the airport, the better additional requirements will be smoothly implemented without major,
and costly, restructuring. Knowing, even at the design stage, the strengths and weaknesses of an airport as
regards potential terrorist attacks is essential decision-making information.
5.3 CONTINGENCY PLAN EXERCISES
5.3.1 Contingency plans should be practised and exercised on a regular basis to identify
weaknesses and modifications necessary for the safe conclusion of an actual emergency situation.
Particular emphasis should be placed upon ensuring the operational reliability and compatibility of all
communication equipment which is designated for use during an incident.
4
for further information on the ICAO AVSEC PoC, please contact SGM Section at sgm@icao.int

5.3.2 In addition to major full scale exercises on the overall contingency plans to be conducted at
least every two year, smaller scale exercises in addition to tests, inspections, evaluations and audits of the
different portions of the contingency plans should be organized regularly and at least yearly, as mentioned in
the National Civil Aviation Security Quality Control Programme.
5.3.3 In each case, the result of the exercises, tests, audits and other investigation should be
communicated to the security and airport authorities who should, after due consultations with the concerned
agencies, including the appropriate authorities, aircraft operators, and any other concerned and/or affected
stakeholders re-evaluate security measures and procedures and take such action necessary to remedy
weaknesses. If any changes are contemplated in procedures for screening of passengers, baggage, cargo,
mail and stores, the matter should be discussed by the airport security committee and the appropriate
authorities. Sufficient notice should be given to the concerned agencies to enable them to incorporate the
changes in their procedures.
5.4 CRISIS MANAGEMENT TEAM
5.4.1 The national civil aviation security programme must set out, in clear and concise language,
the offices and organizations responsible for the management of each type of occurrence. At the same time,
the contingency plans required by the national civil aviation security programme must provide for flexibility
so that there will be an effective response to unforeseen eventualities which may arise during an
occurrence.
5.4.2 Depending on the importance of the crisis, two crisis teams should be activated, one at the
airport level Emergency Operation Centre (EOC), the Crisis Management Team (CMT) and one at the
national level EOC, the National Coordination and Control Centre (NCCC). The NCCC is composed of high
level Government officials and represents the executive command. The CMT is located at the airport and
represents the operational command of the incident. The CMT receives support from administrative,
logistical and operational groups. The members of the CMT should be selected based upon their
5
competencies, experience and knowledge of different types of crises.
5.4.3 Where the incident involves the taking of hostages, the contingency plan will need to take
into account the need for hostage negotiation and possibly armed intervention to terminate the incident.
Hostage negotiation is a full time job for trained personnel and comprehensive specialized training should be
6
offered to negotiators . The contingency plan will need to specify who will provide negotiation personnel and
lines of command. The provision of other resources such as interpreters, accommodation, communication
facilities and the specific requirements of any armed intervention unit deployed for an incident need to be
included in the plan.
5.4.4 It is essential that the Chief of the CMT has been nominated by the highest authorities of the
State. There should be a clear understanding of who is in charge when a crisis is signalled. The Chief of the
CMT should be experienced, properly trained in crisis management. His title, name and responsibilities
should be clearly indicated in the contingency plan.
5.4.5 As a general rule, the appropriate authority for security will be assigned overall responsibility
for the management of crises. Other government organizations, especially the civil aviation authority, the
authority responsible for police functions and military authorities, the foreign ministry and airport admin-
istrations will be assigned responsibilities in support of the appropriate authority for security. Provisions
should also be made for the involvement and participation of the affected aircraft operator and a senior flight
crew member familiar with the type of aircraft involved when deemed appropriate.
5.4.6 Because of its unique coordinating duties and responsibilities, the civil aviation Security
Policy and Regulatory Section, may be the most suitable organization to which responsibility for the
5 Note: ICAO has developed an ASTP on the Management of aviation security crisis (ASTP/CRISMAN) which details the role,
structure and organisation of CMT.
6 ICAO ASTPs for negotiators (levels 1 and 2) as a basis, in addition to more specialized training offered by full time specialists on
negotiation
Volume V - 25
establishment, maintenance and operational readiness of the national EOC should be assigned. This may
not be applicable in all cases, particularly where responsibility for major incident response is with a national
authority responsible for police functions.
5.4.7 The airport security officer will likewise be the most suitable official to whom responsibility
for the establishment, maintenance and operational readiness of the airport EOC should be assigned.
5.4.8 In addition to those listed in Part 7 of the Airport Services Manual, resources and expertise
required to deal effectively with an act of unlawful interference involving an aircraft will include some or all of
the following areas:
a) in-flight explosive device search procedures;
b) in-flight handling and securing of suspect explosive articles;
c) policing authority responsible to react to a crisis situation;
d) hostage negotiation;
e) psychiatry/psychology;
f) communications;
g) air traffic services;
h) airport operations and layout;
i) special parking location for aircraft subjected to acts of unlawful interference;
j) experts and documents available from adjacent locations;
k) flight operations; and
l) other support services (e.g. linguist or religious specialist).
5.5 INCIDENT ACCESS AND CONTROL
5.5.1 A controlled area should be established covering the main incident area. Within the
controlled area, an outer and an inner cordon should be established surrounding the actual incident with a
forward control point (FCP) to control all access to the inner cordon. The cordons are normally protected by
armed personnel. The purpose of the outer cordon is to protect the incident site and prevent access to the
site by the public, press or non-essential airport/aircraft operator staff. The purpose of the inner cordon is to
isolate the incident and prevent access by anyone not directly involved in the resolution of the crisis. Access
to the inner cordon is permitted only with the agreement of the FCP commander. In the case of an act of
7
unlawful seizure it is important that the FCP be mobile. An example incident site is illustrated in Figure V-1.
5.5.2 Plans must include traffic control around the airport and within the landside areas of the
airport to allow rapid access and exit of emergency vehicles and any other persons or agencies needed at
the airport that may be needed to resolve the incident. A rendezvous point and staging area should be
nominated outside the inner cordon for all agencies arriving at the incident site. Emergency services such as
fire and ambulance crews should be on stand-by at the rendezvous point outside the outer cordon to be in a
position to quickly intervene should there be an explosion or fire.
7
Note: ICAO has developed an ASTP on the Management of aviation security crisis (ASTP/CRISMAN) which details the functions
and coordination at the incident site.

National
command
control
INCIDENT centre
Inner cordon
FCP
Outer cordon Incident

control centre
RV
Staging area point EOC
Figure V-1 Example incident site
5.6 ISOLATED AIRCRAFT PARKING POSITION
5.6.1 It is important that an aircraft which is suspected of having an explosive device or

dangerous substance on board be isolated from normal aircraft operations. To achieve this, each airport
should designate an isolated parking position to which such aircraft may be moved. The site selected should
be, if possible, a minimum of 400 m from any other aircraft parking position, taxiway, runway, building, public
area, fuel tank farm or storage area for explosive or incendiary material. The isolated parking position may
also be used to handle unlawfully seized aircraft which require servicing or special attention; therefore,
consideration should be given to its location so it cannot be easily observed from public areas off airport
property.
5.6.2 Airport emergency procedures should designate one or more points to which affected
aircraft might be directed. However, plans must be flexible enough not to rely on such an aircraft being able
to park at a designated point and must allow for the aircraft to change its position. The following should be
taken into account in selecting designated points:
a) the availability of covered approaches to facilitate action by the security forces; for
example, adjacent buildings, natural features such as undulations in the terrain and the
presence of trees;
b) the need for police and other units to have quick and easy access to the scene to deal
with the situation;
c) the possible danger to other aircraft or people in the vicinity, and hazards such as fuel
tanks;
d) the need for isolation from the press and public; and
Volume V - 27
e) the continuance, as far as possible, of normal air traffic in and out of the airport during
the incident.
5.6.3 Care should be taken to ensure that there is no services such as gas pipelines, refuelling
hydrant pipes, other fuel lines or electric power cables beneath the aircraft parking area surface. If possible,
a second isolated parking may be designated in case the primary isolated parking position is unavailable or
in case of multiple crises.
5.7 SUSPECT EXPLOSIVE DEVICES
5.7.1 If a suspect explosive device or substance is found on board an aircraft or in equipment,

buildings or installations, it is essential that it be dealt with immediately. Transporting such a device or
substance off the airport through public areas creates undesirable risks. It is therefore recommended that
airports set aside an isolated disposal area where experts may disable such material. Ideally, the location
should be situated in close proximity to, but not less than 100 m from, the isolated parking position.
5.7.2 The airport security officer should survey the airport and predetermine the routes to the
disposal area from all likely locations at which suspect explosive devices or substances may be discovered
on the airport in order to determine the safest routes over which they should be transported. In conducting
this survey, consideration should be given to the best routes which avoid other parked aircraft, buildings,
public areas, fuel and electric power installations, natural gas pipelines, communication and navigation aids.
There should always be more that one route from any location on the airport to the isolated disposal area.
5.7.3 When the explosive disposal technician is moving such a device or substance, care should
be taken to eliminate the possibility of electronic signals from airport installations triggering the activating
mechanism. The use of mobile and hand-held transmitting equipment within 30 m (or 10 m for low-powered
transmitters) of the suspect device should be avoided.
5.7.4 In order to minimize the effect of an explosion, the provision of a blast containment area
should be considered. Explosive disposal experts should be consulted, and any facilities that they require
should be provided. Along with the provision of a shelter to permit explosive disposal experts to work
efficiently, the construction of the blast containment area should allow for a vehicle carrying the device to
drive inside for unloading.
5.7.5 Some explosive devices are actuated by simple pressure-sensitive mechanisms that
operate when a pre-set altitude is reached. To check suspect baggage, cargo or mail that may contain such
a device, a chamber which simulates changing atmospheric conditions is helpful in this respect. At the same
time, all other flight conditions likely to be encountered, including sonic and electronic signals generated by
aircraft engines and equipment, should be simulated.
5.8 EMERGENCY OPERATIONS CENTRE
5.8.1 The contingency plan for dealing with an incident of unlawful interference at the national and
the airport level, when implemented, will need to be controlled from a central location. This will best be done
from a command or emergency operations centre (EOC). Information on the planning, establishment and
operation of airport emergency operations centres can be found here below and is published in the Airport
Services Manual (Doc 9137), Part 7 Airport Emergency Planning. That material covers all types of major
emergencies likely to occur on or near an airport and will be useful should the need for an EOC at the
national level be decided upon. The operational readiness of each EOC must be tested periodically.
5.8.2 It is necessary that the airport EOC be provided with a flexible and effective communications
capability which will permit direct communications with the affected aircraft as well as with ATS and all
security services units whose assistance is likely to be required at the airport.
5.8.3 Annex 14 - Aerodromes stipulates, in the form of a Standard, that aerodrome emergency
plans shall be developed which provide for the coordination of actions taken in an emergency occurring at

aerodromes. A fixed emergency operations centre (EOC) providing a forum for that coordination is a
Recommended Practice in that Annex.
5.8.4 Experience has shown that a well-operated and equipped EOC is indispensable in the
management of a response to an act of unlawful interference. The EOC acts as a focal point for the control
and coordination of all responding agencies and, as such, the procedures for its use and staffing should be
clearly designated in the contingency plans.
5.8.5 The EOC should be located in an area off airport property that is easily accessible. The
EOC has to be permanently accessible and it must be possible to reach the EOC in the shortest time
possible. The EOC environment should be spacious and open to make it possible for the group to operate in
a stressful environment without interfering with each others work.
5.8.6 The EOC should have at least the following equipment and characteristics:
a) enough desk space, chairs and office supplies to accommodate all members of the
EMT;
b) computers and/or portable computer hook-ups;
c) all modes of telecommunication: radio, television, enough phone lines, cellular phones;
d) be stocked with up-to-date maps of the airport, plans and photographs of the airport and
environs and the main types of aircraft used by the major aircraft operators as well as a
scale model of the airport;
e) the EOC should be restricted to authorised personnel;
f) auxiliary power supply;
g) operational display boards, airport maps, site plans, floor plans, infrastructure plans
(water, sewer, electric, gas);
h) washroom and eating facilities;
i) nearby area reserved for media, families and next of kin; and
j) easy access.
5.8.7 The operational readiness of each EOC should be tested periodically.
5.9 COMMUNICATIONS
5.9.1 Communications, unless already in position, are likely to be a major problem. Contingency
arrangements for advising telephone authorities must be made in advance. Links will be required between
the forward control point and personnel deployed within the inner cordon. Links are also required with the
EOC. Radio is probably the only system that gives the required degree of flexibility, but it must be
remembered that radio transmissions may be overheard by the perpetrators, the press and others unless
encryption or secure transmission methods are used.
5.9.2 The early establishment of secure land lines from the forward control point to the EOC, to
the negotiators and to the control tower is highly desirable. At the EOC, good internal communications are
required and there should be secure communication links to the government control centre, police
headquarters, emergency services, airport authorities, the control tower and the aircraft operator concerned.
Volume V - 29
5.9.3 Maximum use should be made of hard-wired telephones but, where cellular or mobile
telephones are required to be used during an emergency as an alternative to radio or landline communications,
they will require special configuration. The cellular or mobile phone service provider should be requested to
arrange for immobilization of all non-essential cellular or mobile telephones within the area of the incident.
5.10 PRESS AND MEDIA
5.10.1 The pressure of media interest at a major security incident will be considerable. It is
important that the media are dealt with fairly but firmly to ensure that they do not publish information which
might prempt action planned or being taken by the security forces. Control of information about the situation
is paramount as, in the past, police and aircraft radio communications have been intercepted and
rebroadcast as news items over the public networks. Camera teams have also been known to infiltrate the
incident area and film operations. This can dangerously heighten the tension among the perpetrators while
premature disclosure of information regarding operations can frustrate tactical plans.
5.10.2 However, it is also advisable to ensure that the media are treated with consideration and are
given information and assistance as is possible without compromising the safety of the passengers involved
and the police and security personnel dealing with the situation. If the media are denied all information they
will become frustrated and be unlikely to co-operate with police requests. They will instead pursue
information by all means and, intentionally or not, reduce the possibility of a peaceful solution. An initial
agreement with the media is required to have regular press briefings in a dedicated press room (for example
every hour or second hour) so that only official and safe information will be communicated by the media
officer selected by the police and the CMT. In addition, press releases should be approved by the Chief of
CMT before being disseminated.
5.10.3 The appropriate authority for security and other entities involved in the management of acts
of unlawful interference should exercise restraint in providing information that may be disseminated to and
by news media in respect of acts of unlawful interference, during or after the occurrence. In particular
publicity should be minimized about the actual methods and planning used by the offenders and the security
measures applied by States to prevent acts of unlawful interference.
5.11 TELEPHONE ENQUIRIES AND RELATIVES
5.11.1 There should be separate facilities, other than at the EOC, to deal with the public who will be
8
making enquiries concerning persons involved in the incident. A Telephone and Information Centre (TIC)
will need to be set up, which need not be necessarily at the incident site, with a dedicated telephone
number, and trained staff, to cope with the high volume of calls from public, relatives and friends of persons
involved. Incoming overseas calls in different languages should be expected. As relatives and friends might
provide useful information for the resolution of the crisis (name, age, nationality, physionomy, health
condition, etc.), it is essential to develop a predetermined and systematic collection system (special detailed
forms collecting details on passengers and on the persons calling) so that proper intelligence analysis could
be made by the CMT (and not the TIC which should concentrate on the collection of information and first-
level analysis such as the real list of persons involved). All information provided by the TIC to the public,
relatives and friends should be closely coordinated with the CMT and the media officer.
5.11.2 In addition to the high volume of calls arriving at the airport of the incident, some relatives
and friends might be present at the airports of departure, of destination, or of the incident in case the
incident is taking place at another location. The relatives and friends present at the airport of the incident
9
should be isolated from the rest of the public in a Rest and Debriefing Centre (RDC). The RDC should be
separated from the TIC, and the EOC, and ideally isolated from the public area of the airport. The main
functions of the RDC are to assist relatives and friends during a very difficult period, remove the pressure of
dealing with stressful persons from the entities directly involved in the resolution of the incident and also to
collect additional information on the persons involved or victims of the crisis. The forms used by RDC should
8
More information on TIC in Volume III Airport Design
9
More information on RDC in Volume III Airport Design

follow the same format as the TIC ones, but clearly indicate that the source of information is physically
present at the RDC. All RDC forms should be forwarded to TIC before being sent to CMT. Further interviews
of relatives and friends at RDC might be decided by CMT for confirmation and intelligence purposes.
5.11.3 It is recommended to exercise TIC and RDC functioning on a very regular basis, at least
once a year, to maintain high expertise of its staff, as well as speed and adequacy of processing. In the case
of injuries or casualties, the information collected by TIC and RDC on the relatives and friends is of
paramount importance for police.
5.12 RESPONSE TO THREATS
5.12.1 It is very important that the airport contingency plan should clearly reflect, in accordance
with the national aviation security programme, responsibility for the evaluation of all potential bomb or other
violent threats, whether they affect aircraft on the ground or in flight, or buildings on the airport. Bomb
assessors must be appointed and appropriately trained in order that they can assess the threat and give
guidance to what security measures are considered appropriate to counter the threat received.
5.12.2 Each bomb threat received by telephone, written message or other means of
communication alleging that an unlawful act will occur at an airport or in the air must be considered serious.
Each threat should be thoroughly investigated and reported immediately to safeguard the public. Appropriate
individuals should be familiar with a specific reporting format, an example of which is shown in Appendix-4 -
Action by the recipient of a bomb threat telephone call.
5.12.3 While some States, due to the existing local situation, may call for a more stringent
evaluation of threats, experience has shown that the following technique in assessing threats is reliable in
most circumstances.
5.12.4 A systematic procedure to assess bomb threats is necessary to ensure, as far as possible,
that whenever there exists an actual bomb or other device the assessment leads to positive action and,
where the warning is a hoax, the assessment results in the minimum disruption to operations.
5.12.5 Such a procedure has been devised by several States using a technique called Positive
Target Identification (PTI). The methodology was designed to lead a bomb assessor to a logical conclusion.
Positive Target Identification will assist in classifying the threat as:
a) specific;
b) non-specific; or
c) hoax.
5.12.6 The process of PTI is to use the specificity of the information contained in the threat to
determine the credence to be applied to it. The more information given by the caller (most threats are made
anonymously over the telephone), the more likely the threat should be taken seriously. Further guidance on
Positive Target Identification and its use can be found in Appendix-5-Bomb threat assessment.
5.12.7 Annex 6-Operation of Aircraft requires that operators establish and maintain training
programmes which enable crew members to act in the most appropriate manner to minimize the
consequences of acts of unlawful interference.
5.12.8 After assessing the situation, the pilot-in-command should communicate the circumstances
concerning the threat to an air traffic services unit. However, serious consideration should be given to the
consequences which may occur as a result of any action being taken by air traffic services, or other
authorities of a State, that is contrary to the requests of the pilot-in-command.
Volume V - 31
5.12.9 The Tokyo Convention specifies the powers of the pilot-in-command while in flight and
authorizes specific action to be taken by that officer in the event of an unlawful act. In addition, the pilot-in-
command shall have command over all crew members including any security guards. If the pilot-in-
command is unable to do so, another qualified member of the crew should assume command, in
accordance with the sequence provided for in the operators manual. All crew members under direction of
the commander shall assist that officer in every way.
5.12.10 Full account should be taken of the possibility that a person committing an unlawful act on
board an aircraft in flight may be in an unstable state of mind or extremely volatile or nervous. Crew
members should therefore:
a) refrain from unnecessary conversation or actions which may irritate the individual;
b) exercise due care to ensure that the passengers do not become excited or, in an
attempt to overcome the individual, resort to action which may jeopardize safety. One
practicable measure to restrain passengers would be to instruct them to fasten their
seat belts; and
d) terminate the serving of alcoholic beverages.
5.12.11 Of prime importance to the safe conduct of the flight is the security of the flight crew
compartment. Once the unlawful seizure has commenced, an attempt should be made to dissuade the
offenders from entering the flight crew compartment.
5.12.12 In many cases, the destination of an aircraft subject to an act of unlawful interference will be
in a region for which the flight crew does not possess the necessary flight documentation and manuals. It is
therefore desirable that the flight crew be supplied with a condensed set of valid emergency navigation
material for possible diversionary landing locations that are not on the scheduled route. This technical/
navigational emergency kit will assist the crew to land an aircraft safely at an airport with which they are not
familiar but which lies within the range of the aircraft. Additional guidelines on crew actions in the case of an
act of unlawful interference can be found in "Manual on the Implementation of the Security Provisions of
Annex 6 - Doc. 9811 Restricted.
Bomb threats on the ground
5.12.13 When a bomb threat is associated with an aircraft that is still on the ground, and once the
warning has been assessed, aircraft operators in consultation with airport authorities and other responsible
law enforcement entities should:
a) disembark all passengers and crew with all cabin baggage by steps or jetties. Escape
slides should only be used in extreme emergencies;
b) move the aircraft to a remote location such as the isolated parking position;
c) isolate and re-screen all passengers and their cabin baggage and hold them in a
separate area until the crew members, hold baggage, cargo and catering supplies have
been inspected/screened, searched and declared safe;
d) unload all hold baggage and require passengers to identify their baggage, which should
then be screened or searched before it is re-loaded;
e) unload all cargo which should then be screened or searched before it is re-loaded;
f) unload and check the integrity of catering supplies; and

g) search the aircraft.
5.12.14 In case of bomb threat the aircraft should be searched only by designated and appropriately
trained staff supporting responsible for such searches law enforcement authorities.
Bomb threat in flight
5.12.15 In the event of a bomb threat in flight, responsibility for the decisions taken rests with the
pilot-in-command. In dealing with a bomb threat directed against an aircraft in flight, it may be necessary for
some or all of the following actions to be taken:
a) evaluation of the threat;
b) response/decision, including whether reaction will be overt or covert;
c) conduct search procedures in flight;
e) evaluation of possible effects of pressurization or pressure equalization;
f) establishment of the order of search (e.g. public areas first);
g) arranging of search assignments for flight crew;
h) announcement of the threat by the pilot-in-command to the passengers;
i) arranging for possible passenger participation in search;
j) establishment of emergency procedures once a suspect explosive device is located;

and
k) determination of flight routing, and landing and deplaning procedures.
5.12.16 Further guidance on actions to be taken in the event of a bomb threat in flight can be found
in Appendix-6 - Response to bomb threats against aircraft.
Searching procedures
5.12.17 Specific supplementary procedures and measures should be provided by airport authorities
or the aircraft operator, depending on whether the bomb alert or the discovery of a suspect explosive device
concerns an aircraft in flight or on the ground or a building or area of the air terminal or airport. A search plan
and checklist should be available on each aircraft. The checklist should be developed by the aircraft
operator' s engineering department. Different checklists should exist for each different type of aircraft and
cabin configuration.
5.12.18 The searching of a building or aircraft for a suspect explosive device identified by a bomb
threat should follow the basic guidelines:
a) searches will be most effective if carried out by staff familiar with the building or aircraft
concerned;
b) searches must be carried out in a systematic manner and areas cleared should be
marked distinctly;
Volume V - 33
c) strict access control to the building or aircraft being searched must be imposed and
maintained during the period of the search;
d) search teams should be briefed not to touch or interfere with any unusual object which
they might discover but to immediately alert the person responsible for the search party;
and
e) suspect explosive devices found by the search should be marked distinctly and the
immediate area cordoned off.
5.12.19 Further guidance is detailed in Appendix-9 - Search and evacuation guidelines.
In-flight aircraft search procedures
5.12.20 The large number of aircraft in service throughout the world makes it impossible to provide
in this manual recommended aircraft inspection procedures that will be adequate in all cases. Aircraft
operators should develop an aircraft search procedure checklist for each type of aircraft in service and
include this checklist as part of the flight crew security kit. (Refer to Appendix-7 - Aircraft security search
checklist for assistance in this process.) A training programme should be established and maintained for
all flight and cabin crew members.
5.12.21 To avoid duplication of effort, the search of an aircraft should be conducted systematically
by staff familiar with the particular aircraft who are provided with a checklist and assigned to specific areas of
the aircraft. Attention should be given to those areas to which passengers have had access, such as main
cabins, galley areas and toilets but searches should also include the flight deck, or any lower cabin
compartment accessible in flight.
5.12.22 In general, a search should be conducted with extreme caution, using flashlights and
mirrors when searching in confined to dark areas. Areas to be searched should include all quick-latch or
easy access doors. Equipment areas should be searched carefully as there is the possibility that a bomb
may be hidden in, behind or under equipment. It may not be necessary to search some areas if a door,
compartment or piece of equipment is properly sealed or secured and there is no evidence of tampering.
5.12.23 It is difficult to give guidance to search teams about the appearance of suspect explosive
devices as they can be disguised in many ways. Search teams should be briefed to look for unidentified
objects or anything:
a) that should not be there;
b) that cannot be accounted for; and
c) that is out of place.
5.12.24 In view of the possibility that explosive devices and weapons may be concealed within
aircraft equipment or components, searches of aircraft considered at higher risk should be conducted by
trained and competent security personnel assisted where necessary by aircraft crew or aircraft engineering
support personnel.
5.12.25 Further action should be taken in accordance with Appendix-8-Suspect explosive devices
and Appendix-9-Search and evacuation guidelines.
Evacuation procedures
5.12.26 If the airport or building management, in consultation with the airport security officer,
decides on evacuation, the airport security officer should direct which floor(s) or area(s) are to be cleared. In
single or two-floor buildings, evacuation can be executed with relative ease; however, in a building of more

than three floors, evacuation should usually be limited to the immediate area where the suspicious article or
substance is found, or the area that is specifically identified in the threat and the equivalent space on the
floors immediately above and below.
5.12.27 The decision to evacuate buildings to which the public is normally permitted access should
be made by the building management, preferably after consultation with the airport security officer and/or the
policing authority. Operators should establish similar procedures for their own buildings. The following
factors should be taken into account:
a) the number and frequency of false threats and the effect evacuation of buildings has on
the frequency of such threats;
b) the possible hazards arising as a result of evacuation, e.g. numerous people

concentrated in halls, stairways, etc., where a bomb would likely be located; and
c) the problems and hazards created by evacuation of public areas (where the general
public is permitted access).
5.12.28 Further information on evacuation procedures are shown in Appendix-9-Search and

evacuation guidelines.
Evacuation of air traffic services
5.12.29 Air traffic services administrations should develop specific procedures to cover the possible
need for evacuation of air traffic services (ATS) units in the event of a bomb threat. Such procedures would
basically be the same as those to be applied in cases of inactivation of ATS units due to fire, natural
disasters or complete breakdown of essential communication facilities.
The procedures should take account of the location and staffing of the ATS units, the amount and type of
traffic handled, any alternative means available for ensuring continued provision of air traffic services and
the available communication facilities.
5.12.30 The following matters should be covered by the procedures:
a) the authority for and the means and methods of issuing orders for evacuation;
b) the unit or units to which the responsibility for temporary provision of air traffic services
should be transferred;
c) the means and methods of notifying the unit(s) mentioned in b) and of transferring
essential flight data to such units;
d) the means and methods of notifying aircraft in flight of the situation and of the
procedures to be applied by them;
f) the means and methods of notifying aircraft on the ground and operators of the
situation; and
g) resumption of normal activities following elimination or cancellation of the bomb threat,

including the means and methods of issuing orders for such resumption.
5.12.31 It is recognized that in many cases, e.g. where large area control centres or approach
control offices are affected, considerations of the safety of passengers, crew members and aircraft will
militate against the complete closing down of the ATS unit. In such cases, it is important that the procedures
provide for a reduction of the ATS staff.
Volume V - 35
5.12.32 Search procedures for buildings described in Appendix-9-Search and evacuation guidelines
should be adapted and applied to buildings in which ATS units are located, as required.

CHAPTER 6 REVIEW, ANALYSIS AND REPORTS

6.1.1 As soon as possible after each occurrence or threat, a review and analysis of all that
transpired should be conducted by the appropriate authority for security. Depending on the nature and
severity of the occurrence, written reports from participants may be desirable. In any event, all persons
involved should report on their roles, the problems and successes encountered, relationships with others
involved, effectiveness of communications and observations on the need for amendment or revision of the
specific contingency plan or the security programme.
6.1.2 The results of this review and analysis should be made available to all participants, along
with the recommendations of the national civil aviation security policy and regulatory section for general
improvement and for the correction of any deficiencies identified. Any action a State deems necessary to
correct a deficiency is to be notified to ICAO at the earliest opportunity.
6.1.3 Following review and analysis, the appropriate authority for security should conduct, or
arrange for an overall critique of the occurrence which should be attended by all airport and operators
security officers, members of security committees and others who may have an official interest. The purpose
of this critique is to share the experience with those who were not directly involved so that they will benefit
from it and be better prepared to respond to future occurrences in which they may be involved.
6.2 REPORTS
6.2.1 The reporting of acts of unlawful interference is important, and States concerned with an act
of unlawful interference must provide ICAO with all pertinent information concerning the security aspects of
the occurrence as soon as practicable after the act is resolved. States should, whenever appropriate, furnish
copies of reports prepared for ICAO to other States which may have an interest.
6.2.2 Information provided by States will be analysed by ICAO with a view to facilitating the
Councils consideration of proposals for new or revised Standards, Recommended Practices or procedures
intended to safeguard civil aviation against acts of unlawful interference. It is also used to develop additional
guidance material for inclusion in this manual and other appropriate ICAO documents.
6.2.3 Experience has shown the development of new patterns and trends involving acts of
sabotage, bombings, bomb threats and extortion. It is therefore logical to expect the continued development
of new patterns covering a wider range of unlawful acts.
6.2.4 An effective international and national civil aviation security programmemust provide for the
revision of security measures and procedures from time to time in order to compensate for the development
of new patterns as well as new methods and techniques used in committing acts of unlawful interference.
6.2.5 It is therefore essential that States call for, and provide ICAO with, reports on the non-
political aspects of all types of occurrences. These reports should be fully analysed by the State, appropriate
conclusions drawn and meaningful information and recommendations disseminated so that effective
safeguarding action may be taken. Reports should be submitted promptly and should include details of
deficiencies in States programmes revealed by a review/analysis and critique of the occurrence and/or
plans for improvement of the methods and procedures that failed.
6.2.6 The details of important developments such as new or unusual methods of operation and
techniques used by perpetrators must be promptly disseminated to the appropriate authorities for security of
airports at which similar techniques may be used. While public knowledge of such matters is undesirable, it
is essential that all airports which are liable to experience similar occurrences, particularly those in adjacent
States, be informed as soon as is possible. Such action will facilitate the early development and
implementation of effective countermeasures and procedures.
Volume V - 37
6.2.7 Each State shall provide ICAO promptly with reports on each incident of unlawful seizure,
both successful and unsuccessful, as preventive measures are the keystone to the aviation security
programme. A complete final report often involves considerable investigation, and its completion may not be
possible before the lapse of several weeks after the incident occurs. Therefore, in order that ICAO may keep
abreast of changing patterns, the following reports are requested:
a) a preliminary report on an act of unlawful interference, to be prepared and forwarded as

soon as possible by the State of Registry (Appendix 10); and
b) a final report on an act of unlawful interference, to be prepared and forwarded upon

completion of investigations (not the judicial procedures) by States (Appendix-10).
6.2.8 The reports have been designed to accommodate any act of unlawful interference as follows:
a) act of unlawful seizure of an aircraft;
b) attempted act of unlawful seizure of an aircraft;
c) unlawful act against the safety of civil aviation (including acts of sabotage, malicious
damage, bombs and other explosive devices and substances found on airports, aircraft
or in airmail, air cargo, baggage, etc.);
d) attempted unlawful act against the safety of civil aviation;
e) any other act of unlawful interference (including armed attacks at airports and other
unlawful acts directed toward off-airport personnel, facilities, vehicles and other acts
which have the potential to develop into a threat to international civil aviation and its
facilities); and
a) other acts not specified above.
Timescales for reports
6.2.8 Preliminary reports, in one of the working languages of the Organization, should be
prepared by the appropriate authority and forwarded to appropriate States and to ICAO by airmail within
thirty (30) days of the occurrence. Should immediate remedial action be required, appropriate States and
ICAO should be provided with the pertinent details as soon as the information is known and by the most suit-
able and quickest means available.
6.2.9 If possible, final reports should be sent within sixty (60) days by the appropriate authority of
each State (at least the State in which the occurrence originated and the State in which the occurrence was
terminated) to:
a) the State which instituted the investigation, if it delegated responsibility for the
investigation to another State;
b) the State of Registry;
c) the State of the Operator;
d) any States whose citizens were killed, injured or detained as a consequence of the
occurrence;

e) any State which provided relevant information, significant facilities, experts or other
assistance; and
f) ICAO.
6.2.10 In the interests of safeguarding civil aviation against acts of unlawful interference, the
investigating States should publish their final reports, and further updates if needed, on an occurrence as
soon as possible and provide a copy to ICAO.
6.2.11 The investigating authority should, at any stage of an inquiry into an occurrence,
immediately provide the appropriate authorities for security, including those in other States, with
recommendations on the remedial action which needs to be taken promptly to prevent similar occurrences.
Such action should not be deferred until completion of the final report.
Volume V - 39
APPENDIX-1
COMPILATION AND DISSEMINATION OF INFORMATION
CONCERNING AN AIRCRAFT WHICH IS BEING
SUBJECTED TO AN ACT OF UNLAWFUL
INTERFERENCE
OBJECTIVE
1. The purpose is to ensure that all pertinent information concerning an aircraft which is being
subjected to an act of unlawful interference is available to those States likely to be affected by the flight so
that timely and appropriate decisions and action may be taken to safeguard the passengers and crew
members, the aircraft, all other civil aircraft in its vicinity, and others likely to be affected by that aircrafts
operations.
WHAT INFORMATION IS REQUIRED
2. The pertinent information to be compiled, collated and disseminated consists of the:
a) intended or assumed route;
b) flight plan details;
c) airworthiness of the aircraft;
d) number and condition of injured persons on board;
e) numbers of crew, passengers and offenders on board;
f) number, type, and other details, of weapons, explosive and incendiary devices known or
believed to be in the possession of the offenders or explosive/incendiary devices found
on board the aircraft;
g) physical condition of flight crew members;
h) composition and competence of the flight crew for the intended flight;
i) number of hours previously flown by the flight crew and flight time limitations; and
j) navigation charts and associated documentation available on board for the intended
route and destination.
3. The sources from which the information may be obtained and the offices or officials who
might require it are tabulated in the attachment A to this appendix.

ASSIGNMENT OF RESPONSIBILITY
4. A number of variable factors will determine whether or not the required information is
available from the operator, Air Traffic Service (ATS) units or the security services. They include:
a) when, where and under what circumstances the unlawful act first became known;
b) what, if any, communication with the flight crew and/or offenders has been possible or
permitted;
c) the route and destination changes which ATS units observe or of which they are
advised;
d) the feasibility of determining: injuries to persons on board; the fuel reserves, stores,
including essential food and water, and airworthiness of the aircraft; status, composition
and competence of crew members; the number of hostages taken on board the aircraft
and the circumstances prevailing at that time;
e) feasibility of determining the number, type, etc., of weapons, explosive and incendiary
material and devices in the possession of the offenders, or explosive/incendiary devices
found on board the aircraft; and
f) the role of the operator, particularly in those cases where the operator:
is not represented at the aerodrome of most recent landing; or

has not participated in servicing the aircraft.
5. It is not desirable to assign responsibility for compilation and dissemination of all the
information required for security purposes to a non-governmental entity such as the operator who may not
always have a representative available at the airports where the aircraft has landed or is likely to land.
Further, assignment to ATS units of this responsibility for compiling non-ATS information, at a time when
ATS units may be carrying a maximum workload, will be undesirable. It is therefore recommended that
primary responsibility for the compilation and dissemination of the information required for security purposes
be assigned to a designated security service.
6. However, ATS units and the operator should be required to assist, to the extent feasible, in
compilation of the required information. Assignment of responsibility at this level and in the following manner
would be appropriate:
a) the operator: to provide all available pertinent details that are not contained in the flight
plan;
b) ATS units: to provide all ATS information available, assisting, when possible, in
obtaining from the pilot such other information as is required; and
c) the designated security service: to collect, compile and collate all of the required
information, including specialist advice requested by the pilot-in-command, and to
immediately transmit such information by the fastest available means to other security
services likely to be affected and to the pilot-in-command when deemed necessary or
desirable, at the same time informing the appropriate authority for security of the action
taken.
Volume V - 41
Note. In some cases, it will be desirable to use the operators communications capability as it may be the
fastest means available.
DISSEMINATION OF INFORMATION
7. The urgent nature of each act of unlawful interference makes it necessary for pertinent
information to be transmitted immediately as it becomes known and by the quickest means available to
permit the timely implementation of plans for safeguarding the affected aircraft and all other aircraft likely to
be affected by its operation. Therefore, the ATS unit which first becomes aware of an aircraft which is being
subjected to an act of unlawful interference should transmit an initial alerting message containing all
available pertinent information to those ATS units which might be affected having regard to the fuel
endurance of the aircraft, the possibility of sudden changes in destination and other relevant factors.
8. As the flight progresses ATS units should transmit updated information required for ATS and
SAR purposes in accordance with Annex 11 and the PANS ATM.
9. As a parallel action, the security services in the States concerned should transmit all the
available pertinent information to the security services at the aircrafts known or suspected destination and to
the security services in the States expected to be overflown.
10. The requirements for ATS units to forward information relating to an aircraft which is being
subjected to an act of unlawful interference are currently covered by provisions contained in Annex 11 and
the PANS ATM.
SUMMARY OF TYPICAL ACTIONS
11. To summarize the series of actions that are envisaged as a requirement to meet the
objective:
a) ATS informs the designated security services and the operator immediately when it is
known, observed or suspected that an aircraft has been subjected to an act of unlawful
interference;
b) if the aircraft is diverted from its original route and its destination is unknown, ATS units,
using the available flight plan details and all other reliable information, attempt to
determine the actual or suspected route(s) and/or destination and notify the designated
security services and the operator accordingly;
c) ATS transmits an alerting message to all ATS units which might be concerned with the
flight giving such details as are available;
d) ATS requests supplementary flight plan data from the ATS unit at the airport of
departure;
e) the operator assists in providing the required information to the designated security
services;
f) the security services collect all the data required and transmit it as specified in
paragraph 9;
g) these procedures are repeated as required during the flight;
h) the security services at the airport of intended or assumed landing initiate the airport

emergency plan for safeguarding injured or ill persons, the passengers and crew
members and the aircraft. If necessary, plans for dealing with a major disaster resulting
from an accident on landing or a subsequent explosion and/or fire on board the aircraft
will also be implemented by the airport security services; and
i) an arrival message, and any subsequent changes thereto, is sent by ATS to the airport
of departure and to all addressees on the alerting message when the aircraft arrives at
its final destination and the act of unlawful interference has been concluded, parallel
action being taken by the security services.
Volume V - 43
Attachment A to Appendix 1
TABULATION OF THE INFORMATION REQUIRED, BY WHOM AND THE POSSIBLE
SOURCE
(for an act of unlawful interference affecting more than one State or airport)
Information required Required by Possible source

FLIGHT PLAN DETAILS
intended or assumed route ATS units operator
flight levels rescue coordination centre pilot
deviations from the intended or designated security services if the pilot is not communicating
assumed route with the ground, radar-equipped
operator ATS units may be able to provide
useful information in respect of
deviation from the route
observations of other aircraft

DESTINATION
intended or assumed destination airport administrations ATS units
and estimated time of arrival
security services flight plan message
hours of fuel on board
ATS units operator
emergency and survival
equipment operator pilot
rescue coordination centre
if refuelled, airport administration

and/or operator, and the airport
security services
AIRWORTHINESS OF THE AIRCRAFT
impairment of the aircrafts airport administrations pilot
operating efficiency as a result
of an act of violence, explosion security services operator
or otherwise
ATS units airport security services
operator other persons who obtained the

information by observation

NUMBER OF CREW MEMBERS, PASSENGERS, HOSTAGES AND OFFENDERS AND THEIR

PHYSICAL CONDITION
total number on board airport administrations the number of crew and
passengers may be obtained
number seriously injured security services from:
whether any minimum essential ATS units the pilot

crew members have been
incapacitated. If so, the extent of operator ATS units at the airport of
the incapacitation departure
details of those in need of the operator
prescription drugs or special
medical attention immediately information on the physical
upon landing condition of persons and food,
water on board the aircraft may
number, type, etc., of weapons, be obtained from:
explosive and incendiary
devices, known or believed to be the pilot
in the possession of the
offenders or found on board the airport security services
aircraft
the operator
risk of an accident on landing or
a subsequent explosion and/or other persons who obtained
fire the information by observation
adequacy of essential food,

potable and other water on
board
CREW COMPOSITION, EXPERIENCE AND COMPETENCE IN THE ROUTES LIKELY TO BE FLOWN,
AND AT THE KNOWN OR PRESUMED DESTINATION
self-explanatory airport administrations operator
security services pilot
ATS units the airport security services

when crew changes have been
made without consulting the
operator
ADEQUACY OF THE NAVIGATIONAL CHARTS AND ASSOCIATED DOCUMENTATION ON BOARD
FOR THE INTENDED OR ASSUMED ROUTE AND DESTINATION
self-explanatory ATS units, if the flight is being operator
diverted into an area for which
adequate charts and associated pilot
documentation are not on board
Volume V - 45
APPENDIX-2
THREAT ASSESSMENT METHODOLOGY
INTRODUCTION
1. Annex 17 requires that each Contracting State constantly review the level of threat to civil
aviation operations within its territory and adjust relevant elements of its national civil aviation security
programme accordingly. This requirement addresses two concepts-threat assessment and risk
management-which together form the basis of a viable and cost effective security response to those threats
that target civil aviation.
2. One of the most difficult tasks for aviation security professionals is devising an effective
security plan that correlates to the threat against civil aviation. Accurately identifying the threat or threats
must be the first step in the process.
3. A methodology on threat assessment has therefore been developed and is described in this
appendix. There are multiple benefits to using this methodology. It is versatile enough to assess threats to
an aircraft operator, an airport or a State. Secondly, as most organizations have limited human and
technological resources, a valid threat assessment can still be made without receiving significant intelligence
information or employing a lot of specialized personnel because it uses a quantitative analytical approach.
Furthermore, one of the primary benefits to using this methodology is that it offers a reliable procedure to
identify the threat which, in turn, assists security professionals and other decision-makers in optimally
allocating funds, acquiring critical security equipment and deploying manpower. This last aspect is part of
the risk management concept and is addressed in the Appendix 3.
4. It is readily acknowledged that the responsibility for assessing the nature and level of
threats to civil aviation within a State may be delegated to another entity, such as an intelligence service or a
military component, and not to the Civil Aviation Authority. This guidance material is therefore provided
primarily to assist a Contracting State in meeting its requirement under Annex 17 if it has no other usable
threat assessment process for civil aviation. The intention is that the appropriate authority responsible for the
threat assessment considers adapting this model as necessary to fit the States particular circumstances.
ANALYTICAL PROCESS
5. In devising a threat assessment methodology, it is preferable to use a systematic and

quantifiable approach to evaluate what the specific threat or threats may be to an airport, an aircraft
operator, or a nation. The structure of this methodological approach therefore employs three core principles
of security: identify, implement and sustain. When making a threat assessment, the analyst mainly uses the
first principle, identify, while the other two principles play a significant role in the risk management process.
6. In undertaking the task of assessing the threat to civil aviation, there are several sources of
empirical evidence and statistical data available in the fields of intelligence and aviation security from which
to form an analysis of past trends of acts of unlawful interference involving international civil aviation. In
order to provide decision-makers with a current and credible threat assessment, however, multiple sources
of information should be explored. Because it is often difficult to come across dependable information
regarding threats to aviation, the analyst must optimise the sporadic and vague information that is available.
Analysts of this type of information, whether they be trained intelligence specialists, law enforcement officers
or aviation security professionals, should therefore routinely assess both current intelligence and historical
data in determining the threat and its impact on air operations and the safety of the air travelling public.
7. It is important to note that when making the threat analysis, the analyst must also avoid
being influenced by institutionalised standards such as those attitudes and habits an organization may
perpetuate as established norms which inhibit the thought process. The analyst should try not to be

constrained by traditional methods or processes but should blend traditional thinking with innovative
evaluation techniques.
DETERMINING THREAT AND VULNERABILITY CRITERIA
8. The analyst must first determine the threat and vulnerability criteria before conducting the
assessment by deciding on focal points or centres of gravity. Centres of gravity can be defined as those
factors or criteria that are estimated to have the most weight or value in a given process. Centres of gravity
change according to the system being studied. Examples of systems are a country, an airport, an aircraft
operator, or a group of people.
9. This methodological approach can be adapted to any system mentioned above, as long as
the process is constructed of quantifiable values ascribed to the chosen centres of gravity. In recognizing
that most organizations have limited human and technological resources, a quantitative analytical approach
requires less information to form a conclusion. It also directs the analyst to consider relevant data with
objectivity rather than with subjective speculation.
10. This process utilizes two facets of analysis that together form a credible means of assessing
the threat and determining a security response through application of risk management measures. First, it
must be understood that a deliberate act of unlawful interference against civil aviation must, by definition, be
premeditated and carried out with purpose by the perpetrators. This means that someone has a reason to
conduct an unlawful act and thus proceeds to plan and execute the act. Therefore, before assessing how an
act of unlawful interference may be carried out against a target, the analyst should first consider the reasons
why an unlawful act would be committed against civil aviation and the probability of its being committed.
(This premise eliminates the possibility of using this methodology to analyse a threat for any incident where
air operations are disrupted by an unruly passenger or mentally unstable individual whose actions cannot be
predicted and are spontaneous.)
11. The next step would be to create working tools to assist in the assessment process. The
working tool for this methodology has been named a vulnerability matrix. The two vulnerability matrices
described in this appendix can be combined to form the final analysis for a follow-on risk management
process, or they can be used independent of each other depending on the needs of the analyst. It should be
noted that in order to assess the vulnerabilities of an airport the matrix on aviation security threat categories
must be used, at a minimum.
12. For purposes of this guidance material, Vulnerability Matrix No. 1 profiles a group that has
the potential to perpetrate acts of unlawful interference (see Table A2-1). The second matrix covers aviation
security threat categories which can be adapted to assess the threat directed at a potential target such as an
airport or to evaluate the aviation security posture of an aircraft operator or of a State (see Tables A2-2 and
A2-3).
GROUP PROFILE
13. For the vulnerability matrix on profiling a group, one should subscribe to the assumption that
most human-based systems can be organized into five basic attributes. Therefore, any group can be
defined as having the following components: leadership, system essential, infrastructure, population and a
fighting mechanism. These five attributes will now become the centres of gravity for our evaluation of a
group which has the potential to commit unlawful acts, whether it be called a terrorist group, insurgent
faction or organized crime.
14. The leadership function includes the groups hierarchy, presence of legitimate political
representation and use of charismatic personalities, to name a few examples.
15. The system essential can be described as the will and means of a group to convert
theoretical goals, such as political agendas or religious causes, into practical application through
surveillance operations, acquisition of weapons, developing sources of funding and training of operatives.
Volume V - 47
16. Infrastructure combines several elements such as the size and number of group cells or
sub-units, an established communications network and effective use of transportation and supply lines.
17. The population attribute refers to the existence of an extended support network made up of
local sympathizers or others who may provide safe haven, food and money to the group whether in accord
with the groups goals, or possibly out of fear and coercion.
18. The fighting mechanism is the attribute assigned with carrying out the groups actions in
pursuit of achieving their goals. These group members can be referred to as warriors, for example
hijackers, or technicians, such as bomb-makers.
19. Under the five attributes mentioned, functional subcategories can be added according to the
depth of analysis desired by the analyst. Those subcategories could include factors such as the groups
capability to conduct violent action, location and history of known previous activities and level of commitment
to its ideological purpose (i.e. attacks by suicide bombers). Once the point values assigned to each centre of
gravity have been totalled, the bottom line will provide the analyst with a profile of a group and a reliable
estimate on the probability capability of the group to conduct an act of unlawful interference against civil
aviation.
AVIATION SECURITY THREAT CATEGORIES
20. The second vulnerability matrix is based on six threat categories. The matrix can be
expanded to include other factors judged to be important to the analyst, but for the purpose of this sample
matrix the number of categories has been limited to those most often affecting the aviation security mission.
21. The categories include the presence of a group which could commit an unlawful act, a
history of attacks against civil aviation, existence of internal strife, conditions of economic crisis, the volume
of flights and the transit of high risk flights. These six areas of focus represent different centres of gravity
from those of the group profile. It can be seen that these centres of gravity are better suited to the threat
assessment of States, aircraft operators or airports.
22. Once the point values are totalled, the analyst has a quantifiable method of predicting the
level of threat for the target being evaluated. If the sum totals are combined with the totals of a group profile,
the result can be directly linked to the application of security countermeasures commensurate to the
assessed threat.
23. It must be emphasized at this point that, as with any analytical method, the benefits of such
a process are only valid if the process is undertaken routinely. Prescribed periodic review of current data is
essential when evaluating any change to the assessed threat. Thus, with proper control and management,
this methodological approach to a threat assessment will continue to provide aviation security professionals
and other decision-makers the means for effective risk management and security response.
FINAL ANALYSIS
24. In completing the matrices explained in Tables A2-1 through A2-3, the analyst should:
a) first specify the criteria to be assessed;
b) fill in the columns according to the point values given for both matrices;
c) add up the total points in each row or column as appropriate; and
d) assign priorities for countermeasures in order of point value with the greater number of
points equalling a higher level of threat and vulnerability.

25. It may be generally assumed that a thorough explanation incorporating the rationale behind
the specified conclusions should accompany any threat assessment. A well-based explanation justifies the
resulting risk management programme that will be devised to counteract the assessed threat or threats to
civil aviation.
Volume V - 49
Table A2-1. Vulnerability Matrix No. 1
Sample criteria and point values of system attributes for a group profile
(More questions may be added as necessary.)
[NAME OF GROUP TO BE EVALUATED]
ATTRIBUTES CRITERIA POINT VALUES POINTS

Does the group have a senior Each YES answer equals 1 point.
LEADERSHIP leadership? Each NO or UNKNOWN answer
Is the leadership centralized? equals 0 points.
Is the leadership unified in its
objectives?
Does the group have a cause Each YES answer equals 1 point.
SYSTEM or motive? Each NO or UNKNOWN answer
ESSENTIAL Does the group make its cause equals 0 points.
public?
Is the group capable enough to
take action?
Does the group have a known Each YES answer equals 1 point.
INFRASTRUCTURE structure? Each NO or UNKNOWN answer
Is the structure extensive? equals 0 points.
Is it effective?
Does the group receive support Each YES answer equals 1 point.
POPULATION from local or foreign Each NO or UNKNOWN answer
government sources? equals 0 points.
Does the group have local
supporters?
Are the group members
dedicated?
Does the group actively recruit Each YES answer equals 1 point.
FIGHTING members? Each NO or UNKNOWN answer
MECHANISM Do the members receive equals 0 points.
operations training?
Has the group conducted
successful attacks?
TOTAL POINTS
Legend:
11 15 TOTAL POINTS = High probability that this group will commit an unlawful act.
6 10 TOTAL POINTS = Medium probability that this group will commit an unlawful act.
0 5 TOTAL POINTS = Low probability that this group will commit an unlawful act.

Table A2-2. Vulnerability Matrix No. 2
AVIATION SECURITY THREAT CATEGORIES
[AIR CARRIER] or PRESENCE HISTORY NUMBER

[AIRPORT] or OF A OF INTERNAL ECONOMIC OF HIGH RISK TOTAL
[STATE] GROUP ATTACKS STRIFE PROBLEMS FLIGHTS FLIGHTS POINTS
Volume V - 51
Table A2-3. Definitions and point values of aviation security threat categories
for Vulnerability Matrix No. 2
Presence of a Known presence of a group which has the potential to conduct unlawful acts.
group
Point values Present = Not applicable =

Point value of 1 Point value of 0
History of attacks Earlier attacks are recorded. This may include any form of violent action, but special
attention should be paid to any attacks directed against civil aviation, such as a
hijacking, bombing at an airport or aircraft operator ticket office, and other armed
attacks in the vicinity of the airport.
Point values Frequent = Occasional = Not applicable =

Point value of 2 Point value of 1 Point value of 0
Internal strife Conditions of turmoil such as on-going or impending civil war or other political unrest
exist.
Point values Serious = Minor = Not applicable =

Economic A state of economic crisis exists that is likely to result in severe funding cutbacks
problems which may impact on the ability to sustain aviation security measures.
Point values Serious = Minor = Not applicable =

Number of flights Volume of air traffic. (The higher the number of flights, especially those with
passengers, the greater the risk that an unlawful act will occur.)
Point values 50 + flights per week = 20 - 49 flights per week = 1 - 19 flights per week =
High risk flights Any aircraft operator or flight that could be considered especially vulnerable to an act
of unlawful interference. Examples of high risk aircraft operators or flights include:
having been a target of previous attacks; carrying passengers on one-time or
seasonal recurring flights such as international sports events or religious pilgrimages
where an attack would maximize media reporting; and frequent labour disputes.
Point values Present = Not applicable =

Point value of 1 Point value of 0

APPENDIX-3
RISK MANAGEMENT MODEL
Introduction
1. Annex 17 requires that each Contracting State keep under constant review the level of
threat to civil aviation within its territory, and establish and implement policies and procedures to adjust
relevant elements of its national civil aviation security programme (NCASP) accordingly, based upon a
security risk assessment carried out by the relevant national authorities. This requirement addresses two
concepts threat assessment and risk management which together form the basis of a viable and cost
effective security response to acts of unlawful interference with civil aviation. This appendix focuses on the
risk management model. Guidance material describing a methodology for conducting a threat assessment
may be found in Appendix 2.
Background
2. Security professionals have long recognized that implementing increased preventive

measures commensurate with a higher level of threat has an associated expense that may become a heavy
financial burden on the resources of a State or aviation authority. It is therefore considered more effective to
deploy defences where and when they are most needed rather than applying them universally. This concept
is called risk management.
3. Standards in Annex 17 consist of a baseline set of preventive security measures that are
expected to be applied equally at airports serving civil aviation in all Contracting States regardless of the
threat environment impacting on civil aviation operations. While these arrangements were established to
ensure minimum uniform standards at airports serving civil aviation, no specific standards exist to address
variable threat conditions. Whenever a State introduces additional security measures to meet a higher threat
level, it may find that implementation is difficult to sustain, especially when the extra measures have not
been tailored to the specific threat. Therefore, once a State has properly assessed the nature and level of
threat within its own territory, it can then apply appropriate enhanced measures at its airport(s) and for
aircraft operators operating to/from its territory. In order to encourage a consistent approach among all
Contracting States, this risk management model, which may be used and adapted as necessary, was
developed to aid Contracting States in their response to increased threat conditions.
4. States can profit from using a risk management approach whereby enhanced measures are
implemented either to prevent an unlawful act from being committed against airports or aircraft operators or,
at a minimum, to mitigate any consequences resulting from an unlawful act. Some of the more obvious
benefits include the optimum allocation of fiscal and personnel assets and the encouragement of public
confidence in the safety of air travel to and from that State.
Concept of risk management
5. Overall, the methodologies of threat assessment and risk management use three core
security principles: identify, implement and sustain. When making a threat assessment, the first principle is
primarily employed, while the second and third principles play a significant role in the risk management
process.
6. The main purpose of any security countermeasure is prevention. Therefore, after the first
step to identify the threat or threats to civil aviation is completed, the next task is to devise an appropriate
security response commensurate with that threat. This task employs the implement principle.
7. If the assumption is made that potential perpetrators with the intention to interfere with civil
Volume V - 53
aviation can defeat a security system if given enough information, time and opportunity, then the logical
objective is how best to deter the perpetrators from carrying out a successful act of unlawful interference. It
is therefore essential that the implementation of suitable preventive security measures be considered.
8. This operational intervention leads to the third principle, sustain, which can be described as
a State having the political will and accompanying capability to maintain appropriate reliable security
practices. Without the commitment to sustain effective aviation security measures, the efficacy of the other
principles is diminished. When taking steps to prevent acts of unlawful interference and other criminal
activity directed against airports and aircraft operators, it is necessary to evaluate the sustainability of
security measures through inspections, audits and surveys, such as provided by a national civil aviation
security quality control programme (NCASQCP).
Risk Management Matrix
9. This section provides criteria for three levels of threat conditions which correlate to the three
sets of suggested countermeasures laid out in the risk management matrix described in Table A3-1:
a) Level One Baseline: Indicates low threat conditions where, in the absence of
verifiable intelligence information to indicate that any aircraft operator or airport has
been targeted for attack, there may be the possibility of unlawful interference by
individuals or groups due to causes such as civil unrest, labour disputes and the active
presence of anti-government factions;
b) Level Two Intermediate: Intelligence information indicates there is a probability that

one or more aircraft operators and/or airports are targeted for attack; and
c) Level Three High: Intelligence information indicates that one or more aircraft
operators and/or airports are specifically targeted for attack.
10. Before assigning countermeasures the following actions should be considered:
a) evaluate the nature and level of threat to an operator or airport in accordance with a
valid threat assessment;
b) determine the duration for heightened threat conditions;
c) become familiar with the layout and operations of affected facilities;
d) conduct inventory of available security staff and equipment;
e) review the current security measures in place; and
g) appraise the number of flights and passengers and the volume of baggage and cargo
that would be subject to enhanced security procedures.

Table A3-1. Suggested security measures for baseline, intermediate and high threat conditions
NO FOCUS AREA BASELINE INTERMEDIATE HIGH
Establish boundaries Apply baseline Apply intermediate

between landside and measures plus measures.
Landside and airside areas. Protect increased vigilance and
1 airside and inspect all patrols.
boundaries passages through such
boundaries at irregular
intervals.
Control access into Apply baseline Apply baseline

security restricted areas measures plus search measures plus search
at all times. Employ a at least 20% of staff, 100% of staff, items
pass system or other items carried and carried and vehicles
2 Security means for vehicles,
10
vehicles before access before access is
restricted areas staff and crew. Check is allowed. allowed.
all IDs and passes at
access points. Inspect
vehicles and supplies
on a random basis.
Search all departing Apply baseline Search all departing

passengers by hand or measures plus search passengers again at the
screen them with metal 10% of passengers by departure gate by hand
detection equipment hand at the departure or screen them with
before access is gate. metal detection
Passenger allowed into the security equipment before
3a screening restricted area. boarding the aircraft.
(where Search 20% of
centralized) passengers by hand
who have been
screened by metal
detection equipment.
Same as for 3a. Same as for 3a. Same as for 3a.

Passenger
3b screening
(at departure
gate)
Search all cabin Apply baseline Search the cabin

baggage of departing measures plus search baggage of all departing
passengers either by 10% of cabin baggage passengers again at the
hand or by X-ray by hand (or by departure gate either by
equipment. 10% of approved advanced hand or by X-ray
Cabin baggage cabin baggage technology) at the equipment before being
screening screened by X-ray departure gate. taken on board an
4a equipment to be aircraft. Search 20% of
(where searched by hand. cabin baggage by hand
centralized) (or by approved
advanced technology)
which has been
screened by X-ray
equipment.
10
Background checks to be carried out before pass is issued.
Volume V - 55
Same as for 4a. Same as for 4a. Same as for 4a.

Cabin baggage
4b screening
(at departure
gate)
Separate screened Apply baseline Apply baseline

departing passengers measures. measures and enhance
from inbound monitoring of
passengers. Where compensatory
physical separation measures.
Separation of cannot be achieved,
5 screened and application of
unscreened compensatory
passengers measures in
accordance with threat
assessment by national
authority.
Check/search (in case Apply baseline Conduct thorough

of aircraft entering in measures. search of aircraft
service) originating supported by
aircraft prior to appropriate detection
Aircraft security departure and aircraft in techniques at the
6 checks and transit to ensure no discretion of the
searches weapons, explosives or appropriate authority.
other dangerous
devices have been
placed or left on board.
Access to aircraft Apply baseline Access to aircraft to be

restricted to authorized measures. strictly controlled with
staff having duties on guards at each door in
board, and passengers. use. All staff seeking
7 Access control to Aircraft doors should be access to be searched
aircraft closed and steps by hand together with
removed when items carried.
unattended or air
bridges withdrawn.
No requirement. No requirement. All passengers

subjected to a system
of passenger risk
8 Passenger risk assessment with
assessment selected passengers
subject to enhanced
screening.
Conduct positive hold Apply baseline Apply baseline

baggage match with measures. measures but use or
crew and passengers automated means or
Reconciliation of before loading by either positive passenger/bag
9 manual or automated identification.
hold baggage
means. All
unaccompanied
baggage to be
identified.

Screen 100% of Apply baseline Apply intermediate

originating and transfer measures plus where measures but
hold baggage either by conventional X-ray is use best available
hand, conventional used, 10% of bags also technology and
X-ray equipment or to be searched by hand procedures.
EDS equipment. With or subjected to
respect to transfer hold advanced X-ray
baggage, an exception technology.
can be made where a
validation process and
Hold baggage continuous
10
screening implementation of
procedures have been
established for
screening at the point of
origin, and baggage is
subsequently protected
from unauthorized
interference from the
originating airport to the
departing aircraft at the
transfer airport.
Screen all Screen all Apply intermediate

unaccompanied hold unaccompanied measures.
baggage except when baggage either by hand
its origins and or explosive detection
11 Unaccompanied ownership can be system equipment, or
2
hold baggage verified. subject to flight
simulation using
compression chamber,
or do not carry.
Protect hold baggage Apply baseline Apply baseline

from unauthorized measures. measures plus keep
interference from the hold baggage under
point of its screening or constant supervision by
acceptance, whichever designated security
is earlier, until departure guards or transported in
12 Protection of of the aircraft. If the sealed, tamper-evident
hold baggage integrity of hold containers and verified.
baggage is jeopardized,
it shall be re-screened
before being placed on
board an aircraft.
All items to be Apply baseline All air cargo to be

subjected to security measures with added subjected to security
controls by aircraft random screening and controls or subject to
operators and/or increased checks. full flight simulation and
13 designated regulated (Exception for regulated then protected until
Air cargo agents and/or any agents.) loaded. Aircraft carrying
appropriate entity only cargo apply
before being placed on intermediate measures
the aircraft. only.
Volume V - 57
Protect air cargo from Apply baseline Apply baseline

unauthorized measures. measures plus keep air
interference from the cargo under constant
point security controls supervision by
14 Protection of air are applied until designated security
cargo departure of the aircraft. guards or transported in
sealed, tamper-evident
containers and verified.
All items to be Apply baseline All mail to be screened

subjected to security measures with added or subject to flight
controls by aircraft random screening and simulation in
operator and/or increased checks. compression chamber,
15 designated regulated (Exception for regulated then protected until
Mail agents and/or any agents.) loaded. Aircraft carrying
appropriate entity only cargo apply
before being placed on intermediate measures
the aircraft. only.
Protect mail from Apply baseline Apply baseline

unauthorized measures. measures plus keep
interference from the mail under constant
point security controls supervision by
16 Protection of are applied until designated security
mail departure of the aircraft. guards or transported in
sealed, tamper-evident
containers and verified.
All items to be Search a reasonable All catering supplies

subjected to appropriate proportion of catering and stores to be
security controls, i.e., to supplies and stores and prepared under direct
prevent introduction of either escort to the aircraft operator
dangerous items into aircraft or transport in security supervision or
Aircraft catering catering supplies or sealed, tamper-evident searched before loading
17 supplies and stores taken on board containers. and either escorted to
stores an aircraft, and the aircraft or sent
thereafter protected under seal.
until loaded onto the
aircraft.
No requirement. No requirement. Designate a dedicated

Designate security coordinator to
18 security ensure all measures are
coordinator properly implemented.
Patrol public areas or Apply baseline Consider closing public

subject to surveillance measures. areas near relevant
where close to aircraft aircraft movement
19 Public areas movement areas. areas or apply
appropriate access
control measures.
2
In this context, unaccompanied hold baggage means hold baggage which has become unintentionally
separated from its passenger.

APPENDIX-4
ACTION BY THE RECIPIENT OF A BOMB THREAT
TELEPHONE CALL
CHARACTERISTICS OF BOMB THREATS
1. Experience has shown that bomb threats may be directed against:
a) aircraft on the ground or in the air;
b) airport installations, facilities and buildings; or navigation aids on or in the immediate

vicinity the airports; and
c) air cargo designated for shipment by air; or cargo installations, facilities and buildings.
RECEIPT OF BOMB THREATS
2. Telephoned bomb threats may be received by airports, aircraft operators and cargo agents
either directly from the people issuing the threats or from intermediaries, for example, the media or press
agencies. In either case, recipients should try to obtain as much information as possible about the threat in
order to facilitate assessment of it and identification of the person issuing it.
3. To facilitate the collection of information, aircraft operators and airports should install tape
recording facilities on appropriate exchanges and/or telephones. Continuous loop equipment, which should
be kept running continuously, is preferable to conventional recording equipment which must be switched on
when a recording is to be made. When a bomb threat has been recorded, the tape should be retained as
evidence.
STAFF INSTRUCTIONS AND TRAINING
4. Staff such as telephone switchboard operators and aircraft operator ticket sales people who
are likely to receive bomb threat calls should be briefed on the action they should take before taking up their
duties, and the responses required from them should be incorporated into appropriate staff instructions.
5. They should be provided with checklists to facilitate their reactions. Supervisors should be
similarly aware of the response required and of the need to relay information about bomb threats to trained
bomb threat assessors.
ACTION BY RECIPIENT OF A BOMB THREAT
6. Any person receiving a bomb threat directly by telephone should:
a) listen carefully and make a note of the actual words used by the caller;
b) either take action to trace the call or alert a colleague in order that they may do so;
c) take such action as may be necessary to tape record the call, where this is not done
automatically;
d) prolong the call to obtain as much information as possible;
Volume V - 59
e) ask the caller the following questions:
WHERE is the bomb? Asked first so that that an evacuation can be planned
WHEN will it go off? So that a time factor is known for the evacuation
WHAT does it look like? To help in recognition of the device during a search
WHO are you? To see if the caller is from a credible group
WHY are you doing this? To build up a better picture of the incident and keep the caller on
the line to assist in tracing the call
Note 1. The questions should be posed as open questions rather than as leading ones. For example,
ask, Where exactly is the bomb? rather than, Is the bomb in the hold of the aircraft?
Note 2. The order in which the questions are asked is important as the caller may hang up before all
the questions can be asked.
f) if possible, test the credibility of the caller by making up a non-existent flight number,
flight time or location and asking the caller whether that is the one to which he or she is
referring; and
g) inform a supervisor who should inform the nominated bomb threat assessor, the police
or security services.
7. People receiving calls from intermediaries should:
a) ask for, and make written note of, the precise time at which the threat was issued and
the exact words used by the caller; and
b) ask whether the intermediary obtained answers to any of the questions detailed above
and about the origin of the call and the callers identity.
8. The recipient of a written bomb threat should preserve the message and deliver it to the
supervisor with precise information about its discovery. Messages discovered in flight should be referred to
the pilot-in-command immediately.
9. Supervisors should interview the recipient of any call or message in order to complete the
Bomb Threat Report Form shown below and relay it without delay to the nominated bomb threat assessor.

SAMPLE BOMB THREAT REPORT FORM
Name of person receiving threat message: Time: Date:

Message: (Callers exact words)
WHERE IS THE BOMB?

Terminal Fuel storage facility Cargo area Airline offices Other
or maintenance area
Aircraft Flight number Departing Going to
Did the caller appear to be familiar with the aircraft or building when describing the location? YES / NO
WHEN WILL IT EXPLODE?
Time : Day : Date :
In flight?: YES/NO If moved?: YES/NO Other :

WHAT DOES IT LOOK LIKE?
Briefcase Shopping/carrier bag Suitcase
Box/parcel Other (describe)

WHO ARE YOU?
Name : Organization :
Where are you now?

WHY ARE YOU DOING THIS?
BACKGROUND DETAILS (Circle appropriate answer)

Origin of call
Local Long distance Internal (from within building) Public telephone/cellular/mobile
Attempt made to trace call? Yes/No
Callers identity
Sex: Approximate age: Language spoken:
Voice characteristics
Loud Soft High-pitched Deep
Raspy Pleasant Other

Speech
Fast Distinct Stuttering Slurred
Slow Distorted Nasal Other
Volume V - 61
Background noise
Noisy Quiet Trains Aircraft
Street traffic Voices Office machines Factory machines
Kitchen Party atmosphere Animals Music
Mixed (describe)
Accent
Local Not local Colloquial Regional Foreign
Manner
Angry Calm Irrational Rational
Coherent Incoherent Deliberate Emotional
Intoxicated Laughing Righteous Obscene
Other (describe)
Command of language
Excellent Good Fair Poor
COMPLETE FORM AND PASS TO NOMINATED BOMB THREAT ASSESSOR
DISCUSS THREAT CALL ONLY WITH BOMB THREAT ASSESSOR

OR POLICING AUTHORITIES.

APPENDIX-5
BOMB THREAT ASSESSMENT
1. A systematic procedure to assess bomb threats is necessary to ensure, as far as humanly

possible, that whenever there exists an actual bomb or other device the assessment leads to positive action,
and where the threat is a hoax the assessment results in the minimum disruption to operations.
2. Along with technique called Positive Target Identification (PTI) described in this volume,
States should ensure that contingency plans provide for:
a) a controlled response by persons receiving bomb threats;
b) an assessment of the threat and the risk involved by designated and accredited personnel
(bomb threat assessors) employing PTI;
c) coordination of any action taken which should be appropriate to the risk as assessed;
d) detection of persons responsible for bomb threats; and
e) follow-up action.
3. Contingency plans should be exercised frequently.
CHARACTERISTICS OF BOMB THREATS
4. Experience has shown that bomb threats may be directed against:
a) aircraft on the ground or in the air;
b) airport installations, facilities and buildings, or navigation aids on or in the immediate vicinity
of the airports; and
c) air cargo designated for shipment by air, or cargo installations, facilities and buildings.
RECEIPT OF BOMB THREATS
5. Telephoned bomb threats may be received by airports, aircraft operators and cargo agents
either directly from the people issuing the threats or from intermediaries, for example, the media or press
agencies. Action to be taken by the recipient of a bomb threat telephone call is outlined in Appendix 4.
BOMB THREAT ASSESSMENT ON THE GROUND
6. Bomb threat assessment carries substantial responsibility. Bomb threat assessors should
be appropriately trained and available 24 hours a day. Each aircraft operator and airport should have at least
one assessor on duty or on call within the company at all times. Where a threat is received against an
aircraft on the ground, the targeted aircraft operator and the appropriate airport security services agency
should agree on assessment.
7. Aircraft operators may require pilots-in-command to refer bomb threats received on board
aircraft in flight to operations staff on the ground for assessment, or they may authorize the pilots-in-command to
assess threats themselves. Where pilots-in-command are authorized to assess bomb threats, they should be
provided with guidance from the police or State security services.
Volume V - 63
8. It is important that the bomb threat assessor obtain full details of the threat message ideally
in the form of a completed Bomb Threat Report Form (see Appendix 4) from the person who received it and by
the fastest possible means.
9. The bomb threat assessor should assess the threat by working methodically through the form
which is designed to lead the assessor to a logical assessment of the threat as GREEN, AMBER or RED
described below with the actions required.
GREEN A warning, which may not identify a target or a specific Present countermeasures negate
group of targets, or which otherwise lacks credibility. threat. No extra precautions
necessary.
AMBER A warning that can be related to one or more targets but This may involve danger and
where there is doubt about its credibility or about the may require augmentation of
effectiveness of existing countermeasures. countermeasures.
RED A specific warning where the threat is of a nature which Likely to involve a danger to
permits identification of a specific target, or where the caller people, property or commercial
has positively identified himself or the organization involved activities and therefore merits
and is judged credible. countermeasures.
Take all necessary

countermeasures.
Note. Category RED warnings against aircraft in flight should be notified immediately to the pilot-in-command of
the aircraft and the destination or nominated diversion airport.
10. Although the procedure is largely dependent upon the provision of Yes or No answers to
a series of questions, the assessor must also take account of other factors that may bear upon the credibility
of the threat including, but not limited to, the following:
a) the recent history of warnings and incidents for the airport and the main aircraft
operators;
b) the possible influence of current events such as:
industrial disputes concerning the aircraft operator of the flight concerned or airport;
disputes with neighbouring communities or environmental protest groups concerned

with, for example, airport expansion or development;
similar incidents having been recently reported in the media which may have
prompted a hoax call; and
high-profile persons who may attract a threat at the airport or are passengers on the
flight; and
c) any reported incidents such as overbooked passengers, a passenger refused boarding,

or disputes at check-in or the gate involving friends or relatives;
d) anything particular or unique about the cargo being carried on the flight; and
e) additional security measures that have been taken and the local police or security
authoritys opinion of the warning.

BOMB THREAT ASSESSMENT IN THE AIR
11. Written bomb threats discovered on board aircraft in flight are likely to be spurious, but each
one should be considered on its merits in order to assess the risks involved. Where pilots-in-command are
authorized to assess threats, aircraft operators should provide them with guidance to enable them to assess
the risks and decide upon a course of action. They should consider the following:
a) the circumstances surrounding the threat to determine if it originated before the

aircrafts departure or during the flight. The pilot-in-command should consider whether
the threat could have been discovered during the pre-flight search of the aircraft, or at
an earlier stage in the flight;
b) the precise wording of the threat, to determine whether it suggests there is a credible
reason for the threat having been given. A threat is most likely to be genuine if there is a
reason for it, such as a desire to avoid the casualties that would result from an explosion. It
is likely that a person issuing such a threat will seek to ensure that it gets through and that
there is time to react to it. Where no clear reason for the threat can be deduced, the threat
is less likely to be genuine;
c) whether there is any person on board (e.g. a political figure or other well known person)
who might attract a threat;
d) whether there are passengers on board who might be responsible for a threat (e.g. a
potentially disruptive passenger, deportee or inadmissible, young people or rowdy
passengers);
e) whether the aircraft operators operations centre can be contacted by radio to establish
whether this is an isolated incident or one of a series of similar events affecting the aircraft
operator; and
f) if the pilot-in-command is not satisfied that the incident is a hoax, he or she should seek
information through the aircraft operators operations centre about the current threat to the
aircraft operators interests at the airport of departure, with a view to establishing whether
there are credible motives for attacking the aircraft or disrupting the flight and the quality of
security measures at the airport of departure. Aircraft operators should therefore develop
procedures for making such information available to the pilot-in-command with the least
possible delay.
DETERRING AND DETECTING PERSONS RESPONSIBLE FOR BOMB THREATS
12. Details of bomb threat incidents should be recorded by aircraft operators and airports and
detailed in a report which should be sent to the States civil aviation and security policy and regulatory
section so that trends may be considered, and to the appropriate police authority in order that the
circumstances may be investigated.
13. When a person initiating a bomb threat is identified, that person should be prosecuted under
the relevant laws of the State; evidence of the cost and concern caused by the incident should be submitted for
consideration by the court, and convictions should be publicized to deter potential offenders.
ACTION AFTER POSITIVE THREAT ASSESSMENT
14. In consultation with the police and other appropriate agencies, each aircraft operator and
airport should develop contingency plans to be implemented when bomb threats issued against it are assessed
Volume V - 65
as RED or AMBER to reduce the risks arising from such bomb threats. Actions which should be included in
contingency plans relating to aircraft are outlined in Appendix 6.

APPENDIX-6
RESPONSE TO BOMB THREATS AGAINST AIRCRAFT
AIRCRAFT ON THE GROUND
1. When a bomb threat is associated with an aircraft that is still on the ground, and once the
warning has been assessed, aircraft operators in consultation with airport authorities should:
a) disembark all passengers and crew with all cabin baggage by steps or jetties. Escape
slides should only be used in extreme emergencies;
b) move the aircraft to a remote location such as the isolated parking position;
c) isolate and re-screen all passengers and their cabin baggage and hold them in a
separate area until the crew members, hold baggage, cargo and catering supplies have
been inspected/screened, searched and declared safe;
d) unload all hold baggage and require passengers to identify their baggage, which should
then be screened or searched before it is re-loaded;
e) unload all cargo which should then be screened or searched before it is re-loaded;
f) unload and check the integrity of catering supplies; and
g) search the aircraft.
AIRCRAFT IN FLIGHT
2. When a bomb threat is associated with an aircraft in flight, and once the threat has been
assessed as positive, the aircraft operator should contact the pilot-in-command, directly or through the air
traffic services unit, to provide information about the threat and device and about how to respond.
3. On receipt of the information, the pilot-in-command should require a discreet search of the
aircraft by crew members insofar as this is possible in flight and conducted in such a manner as to not cause
passengers to panic.
4. In those cases where the bomb threat assessment indicates that it is unlikely that there is a
bomb on board the aircraft, but where an aircraft operator or a pilot-in-command wishes to be prudent
before committing, for example, to an extended flight across water the aircraft should be diverted to an
airfield at which it can land safely. Once it has landed, consideration should be given to taking the actions
described above for threats against an aircraft on the ground.
5. When the pilot-in-command has reasonable grounds for believing that there is a bomb on
board the aircraft, consideration should be given to the potential effects of an explosion on board the aircraft
to people on the ground, particularly within densely populated areas. Action as described in the following
guidelines should be taken:
a) an aircraft emergency should be declared to the ATS unit stating the nature of the
emergency, and the aircraft should be diverted to the nearest civil or military airfield at
which it can land safely. The route to the nominated nearest suitable airfield should
Volume V - 67
avoid densely populated areas;
b) if the aircraft is required to make an approach to land over a densely populated area, it
should be permitted to land at that airfield in accordance with current emergency
procedures. Its time in the air should not be prolonged in order to divert to another
airfield;
c) if an immediate landing cannot be made, consideration should be given to seeking

expert advice by communicating on radio with the ATS unit or other ground station
which should, in turn, provide a landline link with the States explosive disposal experts.
The possibility of radio communications between aircraft and ATS units being
monitored, with the attendant risk of compromise, should be taken into account during
transmissions. Consideration should be given to the use of on-board aircraft telephone
communications or digital cellular telephones; and
d) the pilot-in-command may also consider making discreet inquiries to establish whether
any passenger has bomb disposal (BD) or explosive ordnance disposal (EOD)
expertise. Only the initials for these skills should be used in order to reduce the
likelihood of alarming other passengers. Caution should be exercised about the skills
any passengers may say they have and where possible a check on their background
should be initiated through the ATS unit or ground station with which the aircraft is in
communication.
6. In addition to the above guidelines, if a suspect explosive device is discovered on board an

aircraft, the pilot-in-command should direct that:
a) the suspect object not be moved, touched or opened;
b) passengers should be moved as far away as possible, instructed to fasten their seat
belts and keep their heads below the tops of the seat backs; and
c) portable oxygen, bottles of alcohol and first aid kits should be removed from the vicinity.
Fire extinguishers should be readily available.
7. If an immediate landing can be made, the item should be left in place, covered with
polythene and then packed around with pillows, blankets, coats and other blast absorbent materials. The
item itself must be kept dry (hence the polythene) but surrounding materials should be wet in order to reduce
the risk of fire.
8. If an immediate landing cannot be made, the pilot-in-command should take expert advice
from explosives disposal experts as described above and consider moving the item, especially if its position
poses a real threat to the aircraft. Reference to the aircraft flying manuals should identify the type-specific
least risk bomb location. If this is a door, a stable platform of hard, blast-attenuating materials, such as cabin
baggage, upon which the suspect item can be placed, should be built to the centre of the door.
9. It is unlikely that an explosive device placed on an aircraft will be fitted with an anti-handling
triggering mechanism. Nevertheless, if the device is to be moved, the following actions should be taken:
a) the suspect object should not be opened;
b) a check should be made to ensure that it is free to move i.e. that there is, for
example, no thread joining it to the aircraft structure which may indicate an anti-handling
triggering mechanism;

c) it should be moved gently and kept in the same attitude in which it was found; and
d) it should be placed, in the same attitude, in the prepared least risk bomb location and
packed around as described above and suitably restrained against movement during
flight or during deceleration or landing.
Note 1. No procedures which involve disconnecting or cutting electrical circuits in the suspect items should
be attempted.
Note 2. As a general rule, a suspect package or article should not be jettisoned from an aircraft in flight,
particularly through a dorso-lateral door, emergency exit or hatch. Tests have shown that such a course of
action will subject the object to severe buffeting by the airflow. This could cause an explosion in close
proximity to the fuselage, or engine(s) of the aircraft, resulting in a loss of control and possible consequential
destruction of the aircraft.
10. If no suspicious item is found and an immediate landing cannot be made, the pilot-in-
command should consider the following:
a) although a bomb threat may have been received and assessed as RED, aircraft should
be flown as normally as possible, striking a balance between the need for a rapid
landing and the risk arising from undue haste;
b) an emergency should be declared and the aircraft should divert to the nearest suitable
airfield. The choice of airfield should take into account landing performance
requirements, approach aids, emergency facilities and the proximity of approach paths
to densely populated areas;
c) the ATS unit should be fully briefed on flight intentions so that the appropriate ground
measures can be initiated at the airfield of intended landing;
d) the cabin crew should be briefed to be prepared for a possible emergency landing and
prepare for the possible use of crew oxygen/smoke masks;
e) if operationally possible, the cabin differential pressure should be reduced to zero by

descending the aircraft to the cabin altitude. Do not raise the cabin altitude. Maintain
this cabin altitude until the top of descent. When the minimum safe altitude and range
considerations permit, descend aircraft to below 10 000 ft;
f) all efforts should be taken to minimize aircraft manoeuvres and to try to avoid
turbulence;
g) careful consideration should be given to the choice between flying fast to minimize
airborne time and flying slowly to minimize air loads and damage in the event of
fuselage rupture. In most cases, the turbulent air penetration speed will be a reasonable
compromise;
h) consideration should be given to establishing the aircraft-landing configuration as soon

as possible; and
i) details of remote parking requirements and the immediate availability of passenger

steps should be requested from the airfield of landing. The airfield should be advised of
the need to remove passengers from the vicinity of the aircraft to at least 200 m in an
upwind direction as quickly as possible after landing.
Volume V - 69
11. When an aircraft lands following receipt of a bomb threat that has been assessed RED or
AMBER, provision should be made to disembark passengers and crew with a minimum of delay (with their
cabin baggage when circumstances permit). The necessary emergency services should be provided to
preserve life and prevent injury, and the aircraft should be parked where it will not hazard people or
premises in the event of an explosion. The actions for a bomb threat against an aircraft on the ground
should then be implemented.

APPENDIX-7
AIRCRAFT SECURITY SEARCH CHECKLIST
1. The regular search of aircraft for suspect explosive devices and weapons may be conducted
prior to commencing each flight, based on a risk assessment conducted by the appropriate authority. A
similar search will be required when an aircraft is suspected of being the target of an act of unlawful
interference. The difference between the two types is only in the degree and thoroughness of search
undertaken, and these will be dictated by the total circumstances applicable to each situation.
2. The large number of aircraft in service throughout the world makes it impossible to provide
guidance here for recommended aircraft inspection procedures that will be adequate in all cases. Aircraft
operators should develop an aircraft search procedure checklist for each type of aircraft in service and
include this checklist as part of the flight crew security kit. Use of such a checklist by ground crews will be
particularly helpful at locations where the only persons familiar with the particular type of aircraft or
configuration of aircraft are flight deck and cabin crew members.
3. The designated isolated parking position will likely prove to be the best location on the
airport at which an aircraft subjected to a specific threat can be searched, but contingency plans should
recognize that it may not always be possible to access this position.
4. Aircraft searches should be carried out in good lighting conditions; this may require the use
auxiliary power units or the attachment of ground power lines to the aircraft. It will be necessary to impose
and maintain control of access to the aircraft before starting the search, which should be carried out with the
minimum number of persons on board.
5. To avoid duplication of effort the search of an aircraft should be conducted systematically by

staff familiar with the particular aircraft, provided with a checklist and assigned to specific areas of the
aircraft. Attention should be given to those areas to which passengers have had access, such as main
cabins, galley areas and toilets, but the search should also include the flight deck exterior of the aircraft and
cargo holds.
6. Before starting the search, strict control of access must be implemented to the aircraft being
searched. This is necessary to ensure devices are not introduced into the aircraft once it has been cleared.
Control of access must then be maintained until the aircraft doors are closed prior to push back.
7. Searchers should be briefed not to touch suspicious objects but to notify the search
coordinator, mark the location with a prominent object (but not touching the device) and withdraw from the
immediate area to await further instructions. When a suspect device is discovered the possibility of
secondary devices should not be discounted.
8. Hand-held communications are useful for coordination of the search and are often the only
way of ensuring appropriate and speedy lifesaving procedures for search and evacuation. However, once a
suspect device has been located those using hand-held communications should immediately move away
and ensure that they and anyone else in the area move outside the cordon as quickly as possible. Radios
should not be used to transmit within 25 m of a suspect device.
9. All entrance doors, hatches, inlet and exhaust ducts, service and access doors, etc., must
be opened to allow the necessary access to all areas to be inspected. However, a check must be made to
ensure that all doors and covers which were opened for inspection purposes are closed on conclusion of the
search.
Volume V - 71
10. It is difficult to give guidance to search teams about the appearance of suspect explosive
devices as they can be disguised in many ways. Search teams should be briefed to look for unidentified
objects or anything:
b) that cannot be accounted for; and
AIRCRAFT INTERIOR
Seats, including pouches, cushions and underside of seats

Log book and flight manual stowage
Crew oxygen mask stowage
Entire floor, including area forward of rudder pedals and beneath all flight deck seats
Ceiling, side and rear walls
Life-jacket stowage
Crew coatroom and luggage stowage area
Table and drawer of third crew members position
Area around rudder/brake pedals
Inside first-aid kit
Forward entrance
Stairway including underside

Connection of stair to fuselage, as well as shelf at this point
Escape chute stowage
Cabin attendant seat, life-raft stowage and seat back
Forward windscreen and storage unit, including compartments
Oxygen mask compartment
Ceiling and wall
Fire extinguisher stowage
Companionway flight deck
Walls, ceiling and floor

Coatroom
Overhead baggage storage entire area with baggage removed
Compartments above baggage rack and coatroom
Drinking fountain, cup dispenser, cup disposal compartment and drain valve access
Area above and along sidewall of stowage compartment, forward side of forward toilet
Forward compartment
Coatrooms and enclosed mask and vest stowages

Flight attendants and passengers seats (including underside of seats)
Passenger berth
Ceiling, floor and walls
Crew and passenger life vest stowages
Portable oxygen stowage cupboard
Seats (pouches and oxygen mask compartment)
Table between rear lounge chairs and its compartment


Literature containers
Forward galley
Remove all containers, food boxes and ovens, if not already done
Open and inspect all galley compartments, bar and refrigerator
Inspect containers removed from galley and bar
Oxygen mask stowage (bar)
Galley service door (tape stowage; hinge recess)
Compartments above service doors
Forward toilets
Remove soiled and waste material not already removed

Remove containers under sinks, inspect contents and areas around sink
Inspect towel compartment
Tissue dispenser
Toilet
Mirror and compartments
Door
Oxygen mask stowage
Access to drinking fountain
Waste water receptacle
Main cabin
Seats (pouches, oxygen mask stowage, cushions and underside of seats)

Pillow racks, blankets and hand rail
Floor do not remove carpet unless presence of foreign object is suspected
Side walls, including windows and curtains
Bulkheads and foot recesses and oxygen mask stowage
Ceiling
Light recesses
Compartments at aft end of each handrail
Compartments behind rear cabin seats
Stretcher equipment stowage above hat rack
Demonstration life vest stowage
Emergency escape rope compartments
Escape chute stowages
Main door and recess with door closed
Magazine racks
Life raft stowages
Life vest pouches
Passenger berths
Oxygen cabinet
Cargo tie-down stowage
Literature containers
First-aid kit, only if unsealed
Passenger oxygen service units drop them down and inspect
Oxygen and CO2 cylinder stowage drawers, forward sides of 1 and 3 galleys and aft
Volume V - 73
toilets
Overwing emergency exit release covers
Aft entry door cabin attendants seat
Drinking fountain, cup dispenser, cup disposal compartment and drain valve access at
floor
Portable emergency exit lights remove light and inspect
Centre galley and bar
Remove all containers, food boxes and ovens, if not already done
Open and inspect all galley compartments, bar and refrigerator
Inspect all containers removed from the aircraft
Glass stowage in bulkhead forward of bar
First-aid kit in compartment aft side of aft unit only if unsealed
Compartment above service door
Service door and recess
Escape chute stowages
Cabin attendants seats in aisle No. 2 galley
Oxygen mask compartment in ceiling
Portable emergency exit light, remove light and inspect
Rear galley area and bar
Flight attendants seat

Galley remove all containers
Open and inspect all compartments
Compartments in front bulkhead
Inspect containers removed from aircraft
Diplomatic mail locker
Galley service door hinge recess
Escape slide stowages (each door)
Aft entrance door hinge recess
Life raft stowages
Oxygen bottle ceiling stowage
Aft toilets
Remove soiled and waste material

Remove and inspect container under sink
Inspect sink and area around sink
Towel container
Tissue dispenser
Toilet seat and lid
Mirror and compartments
Flight attendants seat
Door
Oxygen mask stowage
Access to drinking fountain
Waste water receptacle

Aft wardrobes and coatrooms
Remove coats and hand baggage

Inspect entire area
Sky cots and flight cradles
Oxygen mask stowage
First-aid kit, only if unsealed
Life vest stowage
AIRCRAFT EXTERIOR
Fuselage (the areas behind/in the following doors and openings should be checked)
Radom
Ground pneumatic connector panel
Cabin compressor air-inlets
Cabin compressor access panels
Doppler navigation antenna door
Cabin compressor air-outlets
Heat exchanger control access panels
Heat exchanger outlet guide vanes
Radio rack air-outlet
Beacon-holder (beacon removed)
Security locker and contents
Flashlights (check batteries)
Seals of first-aid kits for proper condition
Seals of life raft panels for proper condition
Accessory compartment door
Auxiliary tank fuel sump doors
Cabin pressure safety valves
Aft waste water service panel
Cabin pressure regulator valve
Aft waste system service panels
Access door to stabilizer-mechanism
Tail cone access door
Aft potable water service panel
Aft cargo doors
Forward cargo doors
Forward potable water service panel
Ground air conditioning connector door
External power fuser door
External power receptacle
Cabin compressor compartment
Entire compartment, especially area of hollow spaces and cavities
Accessory compartment
Entire compartment as well as all installations
Volume V - 75
Cargo compartments
Forward cargo compartment, especially area underneath hinge snap-panel of cargo

door floor covering
Waste water tank compartment
Flight-kit boxes
Aft cargo compartment (especially area of cargo door hinge joints)
Zone immediately behind aft cargo compartment
Landing gear wheel wells and gears
Nose wheel well area behind access and zip-fastener panels

Entire main wheel wells and zone of wing roots LH + RH
Gears, wheels tires, rims, brakes and parts such as struts, drag-braces, beams,
arms, actuators, frames and trucks
Wings
Trailing edge flap sections

Snap-covers to fuel X-feed tube
Snap-covers to fire-extinguisher bottles
Pressure refuelling adapters
Inspection snap-covers
Fuel vent openings
Engines and pylons
Engine air-intake, exhaust and fan-duct

Engine oil and pneumatic heat exhanger air-inlet scoop
Engine oil refill cover
Engine heat exchanger air-outlet door
Constant speed drive oil refill cover
Open engine cowl doors and fan cascade vanes. Entire engine installation and all
openings on the cowl doors and pylons to be checked.

APPENDIX-8
SUSPECT EXPLOSIVE DEVICES
ACTIONS TO BE TAKEN WHEN FINDING SUSPECT EXPLOSIVE DEVICES
1. There are four generic steps that should be taken by anyone finding a suspicious item
during a search to ensure the safety of personnel and the minimum disruption to operations. By training staff
to follow these four steps in conjunction with local contingency plans a safe conclusion to the incident with
the minimum loss of life can be achieved in most circumstances. The four steps and the order in which they
should be executed are as follows:
a) CONFIRM
b) CLEAR
c) CORDON
d) CONTROL
CONFIRM
2. Confirm that the item found should actually be reported as a suspect explosive device.
Check for labels or tags giving possible information of the owner. Do not attempt to move the item in order to
gain better access to it since the device may be equipped with an anti-handling device which may cause it to
detonate.
3. Eliminate the possibility that the suspect item is private property left unattended by anyone
in the immediate area, e.g. crew baggage. Do not take too long in carrying out this action since the device
may be on a timer or able to be detonated by remote control.
4. Note its exact location; make brief notes of its appearance and mark its position (if
necessary) with a distinct item to assist police or explosive disposal staff in identifying the item on their
arrival.
5. Assess the validity and likelihood of the suspect item being in that particular location.
a) is the suspect item placed in a position to kill personnel or destroy resources?; and
b) is the target valuable, vital, attractive or under threat from possible attack?
6. Once satisfied that the suspect item could be an explosive device, carry out the next three
steps and take the necessary actions as defined in local contingency plans.
IF IN ANY DOUBT, TREAT AS A SUSPECT EXPLOSIVE DEVICE.
CLEAR
7. Evacuate all persons, including any search teams, from the immediate area of the suspect
device. A minimum initial distance of 100 m should be achieved but the actual circumstances, i.e. the
presence of large areas of glass, the presence of flammable or explosive substances in the vicinity of the
Volume V - 77
suspect explosive device, the possibility of building collapse or local contingency plans, may dictate a larger
distance.
8. At the same time ensure that the relevant duty personnel such as the airport security officer
or duty airport officer are notified about the suspect device according to local contingency plans.
CORDON
9. Establish a cordon to prevent anyone gaining access to the area. Size will depend on the
site of the incident, the size of the suspect explosive device and the protection of cordon personnel. A good
baseline is to ensure that cordon personnel are out of line of site of the device.
10. Establish one cordon entry point and ensure that nobody approaches the device unless
authorized by the incident commander. It is not unusual for senior management and other persons to insist
that they view the device to give a second opinion; they should be politely denied access until explosive
disposal experts have arrived and agree it is safe to do so.
11. The police may deploy a further outer cordon on access routes to ensure safe evacuation
and the speedy arrival of emergency services.
CONTROL
12. Inform the relevant personnel according to local contingency plans about the suspect device
if not already carried out. The persons who discovered the device should remain to assist police and
explosive disposal agencies. Establish an incident control point to act as the central control for the incident
until police or specialized staff arrive on the scene and take command. The police should assume control on
their arrival and dictate further actions as necessary.
13. Nominate a rendezvous point outside the cordon for all other agencies that will be arriving at
the incident. Follow further local procedures or instructions for suspicious explosive device incidents.
14. Emergency services such as fire and ambulance crews should stand by at the rendezvous
point outside the cordon to deal with the results an explosion or fire.
15. In the event of an explosion, first aid to injured personnel should be rendered immediately,
followed by established damage control procedures.
16. After the effects of the explosion are under control, the search should be continued in case
there are secondary explosive devices.
DEFINITIONS
17. When dealing with suspect explosive devices incidents, it is important to use common
terminology so as to minimize misunderstandings. The following definitions are used by many explosive
disposal experts and agencies, and it is recommended they should be adopted by Contracting States when
dealing with incidents and reporting incidents to ICAO.
18. Improvised Explosive Device (IED). An explosive device placed or fabricated by terrorists or
criminals. These devices may incorporate military explosives stores (shells, grenades, etc.) but are normally
devised from non-military components.
19. Bomb threat. The manner in which an IED incident starts; this is usually by telephone, but
also covers an alarm raised by the discovery of a device.

20. Bomb alert. The bomb threat has been investigated or assessed, and discredited. No device
was found, any precautionary measures have been relaxed and normal activity resumed.
21. False alarm. A suspect IED was discovered and explosive disposal resources tasked.
Investigation of the item by explosive disposal experts reveals the item to be innocent, i.e. left without evil
intent and containing no explosive device or substance.
22. Hoax. A suspect IED was discovered and explosive disposal resources tasked. Investigation
of the item by explosive disposal experts reveals it to be constructed to resemble a viable IED but containing
no explosive or dangerous substance.
Volume V - 79
APPENDIX-9
SEARCH AND EVACUATION GUIDELINES
GENERAL PRINCIPLES
1. For searches to be effective they should be conducted systematically by staff familiar with
the area concerned. The main reason for this is that outside personnel will be unlikely to know the layout of
the aircraft or terminal building and the various places in which a device could be concealed and therefore
will not so easily be able to spot anything that is out of place or unfamiliar. Search plans should be prepared
in advance and staff trained to use them. A search coordinator must assigned to provide control of the
search process and, if necessary, take the decision to evacuate.
2. Searchers should be briefed not to touch suspicious objects but to notify the search
coordinator, mark the location with a prominent object (without touching the device), and withdraw from the
immediate area to await further instructions. When a suspect device is discovered the possibility of
secondary devices should not be discounted.
3. Hand-held communications are useful for coordination of the search and are often the only
way of ensuring appropriate and speedy lifesaving procedures for search and evacuation. However, once a
suspect device has been located those using hand-held communications should immediately move away
and ensure that they and anyone else in the area move outside the cordon as quickly as possible. Radios
should not be used to transmit within 25 m of a suspect device.
4. Before starting the search, strict control of access must be implemented in the area being
searched. This is necessary to ensure devices are not introduced into the area once it has been cleared.
5. Effective and systematic searching takes time. If the warning received indicates a possible
detonation time for the device which will prevent a thorough search being conducted, the best and safest
option is to evacuate all personnel to a safe area and wait for the arrival of specialist explosive disposal
personnel.
INITIATION OF A SEARCH
6. The coordinator can initiate a search by:
a) sending a message to the search teams over a public address system. It should be
coded to avoid unnecessary disruption and alarm to the public;
b) using personal radios, pagers or mobile/cellular phones; or
c) using a telephone cascade system: the coordinator rings, for example, three
members, who in turn each ring a further three members and so on until all the teams
have been alerted.
What searchers should be looking for
7. It is difficult to give guidance to search teams about the appearance of suspect explosive
devices as they can be disguised in many ways.

8. Search teams should be briefed to look for unidentified objects or anything:
b) that cannot be accounted for; or
GUIDANCE FOR SEARCHING AIRCRAFT
9. The large number of aircraft in service throughout the world makes it impossible to provide
in this manual recommended aircraft inspection procedures that will be adequate in all cases.
10. Aircraft operators should develop an aircraft search procedure checklist for each type of
aircraft in service and include this checklist as part of the flight crew security kit. (Refer to Appendix 7 for
assistance in this process.) Use of such a checklist will be particularly helpful at locations where the only
persons familiar with the aircraft are flight deck and cabin crew members.
11. The designated isolated parking position will likely prove to be the best location on the
airport at which an aircraft subjected to a specific threat can be searched but contingency plans should
recognize that it may not always be possible to reach this position.
12. Aircraft searches should be carried out in good lighting conditions; this may require the use
auxiliary power units or the attachment of ground power lines to the aircraft. It will be necessary to impose
and maintain control of access to the aircraft before starting the search which should be carried out with the
minimum number of persons on board.
13. To avoid duplication of effort, the search of an aircraft should be conducted systematically
by staff familiar with the particular aircraft, provided with a checklist, and assigned to specific areas of the
aircraft. Attention should be given to those areas to which passengers have had access, such as main
cabins, galley areas and toilets, but the search should also include the flight deck exterior of the aircraft and
cargo holds.
14. If a suspect explosive device is found either within or in the immediate vicinity of an aircraft,
the initial action should be to withdraw all personnel to a safe distance and await the arrival of explosive
disposal experts. Any further decision to move the aircraft away from the device or the device away from the
aircraft should take into account the main priority which is the preservation of life. Moving the aircraft will
involve putting at risk additional personnel, such as the ground engineers, marshalling staff and aircraft tug
drivers, whereas leaving the aircraft in situ and evacuating all personnel to a safe location may result only in
damage to the aircraft and terminals or facilities, should the suspect device explode.
GUIDANCE FOR SEARCHING TERMINAL BUILDINGS
Search plans
15. It is vital to have search plans prepared in advance and staff trained in them. The objective
is to make sure that the whole terminal building is checked as quickly and effectively as possible.
16. Search plans must be readily available at all times. Architects drawings, checked for
accuracy and appropriately adapted, are suitable for this purpose. Sufficient spare copies should be
available for use during search operations. Searchers and the coordinator can then eliminate sections from
the plan as they are declared clear.
Volume V - 81
Search sectors
17. The first step in preparing a search plan is to divide the terminal building into sectors. The
building may already be segregated into various zones and therefore it may be convenient to make these
the sectors. Each sector must be of manageable size for the number of searchers nominated to it.
Remember that effective and systematic searching takes time.
18. The sector may be one large room, such as a check-in area, concourse or baggage reclaim
area, or perhaps a number of small aircraft operator operations offices in an office suite. It is most important
that cloakrooms, stairs, corridors and elevators be included in the search plans as well as car parks and
other areas outside the building.
Search teams
19. Search teams should be formed from staff nominated to search those areas with which they
are most familiar. The numbers required will depend upon the size of the search task. Reserves should be
appointed in case of absence. Staff should be trained and rehearsed.
Search priorities
20. Those areas that will be used as evacuation assembly areas, together with those areas
where the greatest number of the public or staff are likely to be vulnerable, should be searched first.
Consider also, as a priority, those public areas to which the perpetrator may have had easy access such as
restrooms, elevators, stairways and hallways. Those areas to which access is normally controlled may be
searched last. Do not overlook car parks, the outside area of the terminal building and the perimeter.
How to search
21. The conduct of searches will depend on local circumstances and local knowledge. The
overriding principle is that they should be conducted in a systematic and thorough manner so that no part is
left unchecked. The searchers need to practise in order to get a feel for the logical progression through their
area (whether it be in a terminal building, baggage reclaim area or administrative or operations office suite)
and the length of time it will take.
22. With this in mind the method outlined in this example is of a room search in a sector. It
should be adapted to reflect the peculiarities of the actual area being searched.
23. A search should begin at the entrance to the room. Each searcher or team should first stand
still and look around the room. They should note the contents of the room and make a quick assessment of
those areas that will need special attention. They should look for any unusual lights (including small light
sources known as light emitting diodes which are often used in the arming circuits of improvised explosive
devices). They should also listen carefully for any unusual noises-particularly ticking or whirring sounds. If
nothing unusual is seen, the search should begin.
24. If anything unusual is seen, the searcher or team should alert the coordinator who will
decide whether to evacuate the building.
25. The search should be conducted methodically, moving in one direction around the area to
be searched. It should be carried out in three sweeps.
26. The first sweep is to work around the edges of the room, taking in the walls from top to
bottom and the floor area immediately beneath the wall. Look inside fireplaces, behind curtains and window

blinds, behind and beside furniture around the edges of the room. The sweep should finish at the doorway
where it began.
27. The second sweep should take in the furniture and the floor. Furniture should not be
removed but drawers should be opened and searched and gaps in and under furniture should be explored. If
the floor covering shows signs of recent disturbance, it should be lifted.
28. The third sweep should cover the ceiling if it is of a kind in which objects might be
concealed. Start at one corner and systematically search the whole surface.
29. After the search has been completed, and if nothing has been found, the coordinator should
be informed immediately so that the sector can be marked clear on the search plans.
30. Searching should continue until the whole area has been cleared. Do not forget that
secondary devices are not unknown.
31. If a suspicious object is found, follow the golden rules:
a) do not touch or move the device;.
b) if possible leave a distinctive marker near (not touching) the device;
c) move away from the device to a designated control point, leaving lights on;
d) inform search team leader or coordinator;
e) the coordinator should implement the evacuation plan;
f) stay at the control point and draw an accurate plan of the location of the suspicious
package or device for the assistance of the police and explosive disposal experts; and
g) the person finding the object should be immediately available for interview by the police
or security services.
EVACUATION
32. The purpose of evacuation is to move people from an area where they might be at risk to a
place of safety. This may be achieved by:
a) internal movement to a safe area;
b) partial evacuation (where large buildings are involved and only a suspect letter bomb or
small device has been found); and
c) full evacuation.
33. In all cases where a bomb threat is received, the coordinator should immediately inform the
airport security officer and police and advise them of what action is being taken.
Volume V - 83
MAKING THE DECISION TO EVACUATE
34. The decision to evacuate must normally be taken by the coordinator but the police or airport
security officer may be ready to advise on request.
35. In exceptional circumstances, where for example the police or security services have
received specific information, they may themselves order an evacuation, if necessary overruling the decision
of the coordinator.
36. On the other hand, it may be necessary for the police or security services in some
circumstances to insist that the terminal building not be evacuated. They might, for example, have reason to
believe that there may be an explosive device outside the terminal building and evacuation would place
people at greater risk.
37. There are four actions open to the Coordinator. Which one is chosen depends upon the
assessment of the threat which the situation presents. The choices are:
a) to do nothing; or
b) to search, and then to evacuate if a suspicious object is found; or
c) to evacuate all persons except search teams and essential staff, and then carry out a
search and evacuate fully if a suspicious object is discovered; or
d) to evacuate all staff immediately then re-occupy using trained searchers.
Option 1: Do nothing
38. This option may appear attractive if the threat appears to come from an intoxicated person
or a child, but it should not be adopted unless the coordinator is absolutely sure that it is a malicious call or
prank. If there is the slightest doubt, the coordinator must turn to one of the other options.
Option 2: Search and then evaluate if necessary
39. This choice means, of course, that people will be in the terminal building for a longer period
should there be a bomb present. However, if a bomb is found, they can then be evacuated away from
danger. If nothing is found and there are no other significant factors, the coordinator may consider this
option appropriate if assessing the threat level as low.
Option 3: Search and partial evacuation
40. When the threat level is considered to be moderate but there is no reason to believe an
explosion may be imminent, or if the suspect device is small (e.g. a letter bomb) and parts of the terminal
building may be some considerable distance from the device, the coordinator might consider evacuating part
of the terminal building alone or retaining only essential staff and search teams within the terminal building.
Option 4: Evacuate immediately
41. If a call is received which the coordinator considers to indicate the existence of a high risk,
there will be a case for evacuating as quickly as possible without conducting a search, especially where
there is a possibility of an imminent explosion.

42. When the time of explosion has been disclosed in a threat call, the coordinator must ensure
that any searches are finished and staff cleared at least 20 minutes before the deadline, irrespective of
whether any device has been found or not.
EVACUATION PLANS
43. As in the case of search plans, the Coordinator should have up-to-date drawings of
evacuation routes. This is especially necessary when there are a number of exits from the terminal building.
The purpose is twofold:
a) to evacuate as quickly and efficiently as possible using all available exits. A public
address system can help in directing staff to particular exits. When no other form of
communication is available, the fire alarm can be used providing that it can be sounded
in a way which distinguishes it from a fire warning, that staff have been trained to
recognize the signal, and that the fire alarm is not part of an automatic system
connected to the local fire service. Use of the fire alarm is a poor alternative to a public
address system and should only be employed temporarily pending the installation of
something better; and
b) to provide alternative routes for evacuation so that people can leave the terminal
building without being placed in danger by passing close to the suspect explosive
device. For example, if there are four evacuation routes but one of the routes runs
closer to a suspect explosive device than the others, the coordinator can decide at once
to evacuate using the other routes only.
44. To ensure the safe evacuation of the public, the coordinator should consider using members
of the staff as evacuation marshals to ensure that the public can leave quickly and without panic by the
pre-selected routes. Evacuation marshals need to be selected in advance and trained in their role.
45. The evacuation plan should also show two designated assembly areas in opposite
directions where people should congregate after evacuation. Sometimes fire assembly points can be utilized
for this purpose, as long as they are located at a minimum 400 m from the terminal building. In some
circumstances, assembly areas may need to be up to 1 000 m away from the building. Explosive disposal
experts advice should be sought as to whether this is necessary.
46. Ideally, all employees and members of the public should be asked to take personal
belongings and baggage which is still in their possession with them, since this will help to avoid unnecessary
suspicion over articles of property left behind after evacuation. However, this will be difficult to implement
unless a public address system or other suitable means of communication is readily available and used
properly.
47. Personnel and passengers who have been evacuated may have to remain outside for a
long time before the terminal building is declared safe, so it is best if shelter can be provided under cover. It
may be possible to seek accommodation by arrangement in alternative buildings. This provides the
opportunity to shelter from weather, maintain good communication and cater to individual needs.
48. If possible, car parks should not be designated as assembly areas, especially if they are
adjacent to the evacuated terminal building since they may contain secondary explosive devices hidden
within vehicles.
49. Evacuation assembly areas should be included in the search plans and checked whenever
search procedures are initiated or an immediate evacuation is ordered.
Volume V - 85
50. When an evacuation is initiated, doors and windows should, whenever possible, be left
unlocked, especially in the vicinity of a suspect explosive device. Lights should be left on, but plant and
machinery shut down where practicable. Procedures should be established to ensure concessionaire
kitchen facilities are left in a safe condition. It is recommended that utilities such as gas and water (unless
this affects the building fire fighting sprinkler system) not required to facilitate the search of an area in a
building be turned off in order to minimize damage in the event of an explosion.
51. A method must be devised to check that everyone has left the terminal building after the
evacuation and that all personnel, staff and visitors are accounted for. Nobody should be allowed to re-enter
until the terminal building is declared safe.
THE DECISION TO RE-OCCUPY
52. Once an evacuation has been completed, the coordinator will have to decide when the
building can be re-occupied. Of course, where a suspect explosive device has been found, the decision to
re-occupy will require close coordination with the police and security services until the device is declared
safe.
53. It should be remembered that there may be another suspicious object somewhere in the
terminal building undiscovered because the search was terminated and the terminal building evacuated
due to the discovery of the first suspect object. The coordinator should, therefore, have the rest of the
terminal building searched before considering re-occupation. Where the evacuation was carried out before
any search, the coordinator will have to initiate a search before considering the question of re-occupation.
54. Where the time has been given for an explosion, but no explosion occurs, the coordinator
must ensure that at least one hour is allowed to lapse after that time before search procedures are initiated
or recommenced.
STAFF TRAINING
55. Good training is essential so that in the event of a need to search and evacuate, not only
the search teams but also every airport employee will know what to do. Regular search and evacuation drills
will help maintain staff awareness and vigilance. All staff should be made aware of the evacuation assembly
points. Telephonists, information desk staff and any other persons likely to answer a telephone number
available to the public should be instructed how to handle a bomb threat call (refer to the checklist for
telephonists at Appendix-4).
56. Other key staff such as evacuation marshals need to know their role and be regularly
trained. It is important that all staff recognize those who have been specially nominated and obey their
instructions. Procedures must ensure that nominated staff are replaced when they leave or are temporarily
absent, so that there are no lapses of cover.

APPENDIX-10
OFFICIAL REPORT ON ACT OF UNLAWFUL
INTERFERENCE
INFORMATION PROVIDED IN
THIS REPORT IS RESTRICTED
AND WILL ONLY BE DISCLOSED
TO AUTHORIZED PERSONS
PRELIMINARY FINAL (CHECK )
REPORT ON ACT OF UNLAWFUL INTERFERENCE
File Number: .............................................
Date of Report: ..........................................

[Day/month/year]
THE PRELIMINARY REPORT SHOULD BE COMPLETED AND FORWARDED TO ICAO

WITHIN THIRTY DAYS OF THE OCCURRENCE
Reporting requirements under Annex 17, Article 11 of The Hague Convention or

Article 13 of the Montreal Convention
Successful Act Attempted Act
a) Act of unlawful seizure of aircraft
b) Attack against airport and air navigation facilities
c) Attack against persons within airport terminal facilities
d) Act of sabotage of aircraft
e) Attack against aircraft while in flight
f) Other acts not specified above
PART I: INFORMATION CONCERNING THE OCCURRENCE
A. GENERAL INFORMATION
1. State providing the Report: ................................................................................................................
2. Date of the Occurrence: .......................................

[Day/month/year]
3. Time of the Occurrence: .......................................

[Local time 24-hour clock]
4. Duration of the Occurrence: ...............................................................................................................
Volume V - 87
B. PARTICULARS OF AN ACT OF UNLAWFUL INTERFERENCE
1. Flight information
Flight departure date: ...........................................

[Day/month/year]
Flight departure time: ...........................................

[Local time 24-hour clock]
Flight identification: ..............................................
Type of aircraft: ....................................................
Operator: .............................................................
Number of passengers: ........................................
Number of crew: ..................................................
In-flight security guards (if any): ...........................
Number of perpetrator(s): .....................................
Type of operation (scheduled, chartered, etc.): ...............................................................................................................
Airport of departure: ........................................................................ ..................................................................

Name State
Intended destination: ........................................................................ ..................................................................

Name State
2. Aircraft
State of registry: .............................................................................................................................................................
Registration number: ......................................................................................................................................................
Aircraft type: ..................................................................................................................................................................
Airport where the sabotage device/substance was (believed) loaded on the aircraft: ......................................................
.......................................................................................................................................................................................
3. Airport buildings or facilities affected: .......................................................................................................................
.......................................................................................................................................................................................
.......................................................................................................................................................................................
.......................................................................................................................................................................................

C. THE OCCURRENCE
1. Location of the aircraft: 2. Ground facility:
On the ground On airport
During flight Off airport
3. Weapons/devices Describe Real Fake
Weapon No. 1: ...................................................................................................................................
Weapon No. 2: ...................................................................................................................................
Weapon No. 3: ...................................................................................................................................
Weapon No. 4: ...................................................................................................................................
Weapon No. 5: ...................................................................................................................................
Explosives: ........................................................................................................................................
Incendiary: .........................................................................................................................................
Other (describe): ............................................................................................................................................................
.......................................................................................................................................................................................
.......................................................................................................................................................................................
4. Communications
4.1 Source of threat:
Written message
Telephone call
Other (describe): ......................................................................................................................................................
..................................................................................................................................................................................
..................................................................................................................................................................................
4.2 Who received the threat:
Flight crew
Cabin crew
Airline ground staff
Passenger
Other (describe): ......................................................................................................................................................
..................................................................................................................................................................................
..................................................................................................................................................................................
Volume V - 89
Yes No
4.3 Were there specific demands made? (if yes, please explain)
.....................................................................................................................................................................................
.....................................................................................................................................................................................
4.4 Who transmitted the demands to authorities on the ground: Yes No
The pilot?
The perpetrator?
Other (describe): ..........................................................................................................................................................
.....................................................................................................................................................................................
.....................................................................................................................................................................................
5. Counter measures
Yes No
5.1 Was there any attempt to stop the action of the perpetrator(s)?
5.2 If so, by what means?
Negotiations Force Other
5.3 Results:
Successful Unsuccessful
Yes No
5.4 Did the perpetrator(s) enter the cockpit?
If yes, describe: ............................................................................................................................................................
.....................................................................................................................................................................................
.......................................................................................................................................................................................
Yes No
5.5 Were crew members in possession of a bomb threat search list?
5.6 Were crew members familiar with least risk bomb location?
5.7 Did the perpetrator(s) have:
Technical knowledge of the aircrafts operation?
Familiarity with the design of the aircraft?
Knowledge of the airport or essential navigation facilities?
If yes, please explain: ...................................................................................................................................................
.......................................................................................................................................................................................
.......................................................................................................................................................................................

6. Diversion of the aircraft (Please answer only if aircraft was diverted)
6.1 List airports in chronological order: Landing

Arrival Departure permitted
Airport State date and time date and time Yes No
a) ........................................ ........................ ................................. .................................
b) ........................................ ........................ ................................. .................................
c) ........................................ ........................ ................................. .................................
d) ........................................ ........................ ................................. .................................
e) ........................................ ........................ ................................. .................................
6.2 Was there sufficient fuel to reach all of the destinations ordered? List below. Yes No
a) ....................................................................................................................................................
b) ....................................................................................................................................................
c) ....................................................................................................................................................
d) ....................................................................................................................................................
e) ....................................................................................................................................................
If yes, describe: ............................................................................................................................................................
.....................................................................................................................................................................................
.....................................................................................................................................................................................
6.3 Did the crew have the necessary charts available for the destinations? List below. Yes No
a) ....................................................................................................................................................
b) ....................................................................................................................................................
c) ....................................................................................................................................................
d) ....................................................................................................................................................
e) ....................................................................................................................................................
If yes, describe: ............................................................................................................................................................
.....................................................................................................................................................................................
.....................................................................................................................................................................................
Volume V - 91
6.4 Were any of the passengers allowed to leave the aircraft at any of the airports? List airports in chronological
order:
Airport Yes No
a) ....................................................................................................................................................
b) ....................................................................................................................................................
c) ....................................................................................................................................................
d) ....................................................................................................................................................
e) ....................................................................................................................................................
If yes, describe: ............................................................................................................................................................
.....................................................................................................................................................................................
.....................................................................................................................................................................................
6.5 Was action taken at any of the airports to resolve the occurrence? List below.
Airport Yes No
a) ....................................................................................................................................................
b) ....................................................................................................................................................
c) ....................................................................................................................................................
d) ....................................................................................................................................................
e) ....................................................................................................................................................
If yes, describe: ............................................................................................................................................................
.....................................................................................................................................................................................
.....................................................................................................................................................................................
6.6 Was maintenance undertaken at any of the airports? List below.
Airport Yes No
a) ....................................................................................................................................................
b) ....................................................................................................................................................
c) ....................................................................................................................................................
d) ....................................................................................................................................................
e) ....................................................................................................................................................
If yes, describe: ............................................................................................................................................................
.....................................................................................................................................................................................
.....................................................................................................................................................................................

D. THE PERPETRATOR (use additional sheets if more than 3)
Total number of perpetrators: ...............
1. Name ....................................................................................................................................................... (male/female)
Alias: .............................................................................................................................................................................
Date of birth: ..................................... Place of birth: ................................. Nationality: ..................................

[Day/month/year]
Airport of embarkation: ............................................................... ..................................................................

Name State
How did the perpetrator(s) gain access to the aircraft/building facility?
.......................................................................................................................................................................................
.......................................................................................................................................................................................
2. Name ....................................................................................................................................................... (male/female)
Alias: .............................................................................................................................................................................

[Day/month/year]

Name State
.......................................................................................................................................................................................
.......................................................................................................................................................................................
3. Name ....................................................................................................................................................... (male/female)
Alias: .............................................................................................................................................................................

[Day/month/year]

Name State
.......................................................................................................................................................................................
.......................................................................................................................................................................................
Volume V - 93
E. AIRPORT SECURITY
Yes No
1. Is there an airport security programme where the perpetrator(s) boarded the aircraft?
2. Does the security programme provide for protection of the air side
(fences, guards, locked gates, patrols, identification system, etc.)?
3. Are the identification cards issued to ground personnel and auxiliary services reviewed
regularly?
4. Inspection/screening of passengers, crew and cabin baggage:
a) Are all passengers and cabin baggage subjected to inspection/screening for all
international flights?
b) Are all passengers and cabin baggage subjected to inspection/screening for all
domestic flights?
c) Are all crew members subjected to security control?
d) Are all passengers and their cabin baggage which have been subjected to
inspection/screening re-screened before boarding the aircraft if they mix or have
contact with persons who have not been subjected to inspection/screening?
5. Inspection/screening system used:
Gate plan (direct access to aircraft)
Sterile hold area plan (pre-boarding lounge)
Sterile concourse plan
6. System of security control in use:
Metal detection device:
Walk-through
Hand-held
X-ray unit
Physical inspection
Other

Yes No
7. Was the operation of the metal detection devices and X-ray units recently examined
using test objects?
8. Has training regularly been provided to security personnel who operate metal detectors and
X-ray units?
9. Matching baggage:
a) Is a reconciliation made of the number of checked-in passengers with the pieces of

baggage loaded on the aircraft?
b) Does the procedure in a) above include transfer passengers and their inter-line checked
baggage?
10. Did the perpetrator(s) circumvent the security measures in place by use of:
Force
Other
Describe briefly: .............................................................................................................................................................
.......................................................................................................................................................................................
.......................................................................................................................................................................................
11. What new measures and procedures have been taken or are contemplated to prevent recurrence of a similar event?
.......................................................................................................................................................................................
.......................................................................................................................................................................................
.......................................................................................................................................................................................
Volume V - 95
F. TERMINATION OF THE OCCURRENCE
1. Position of the negotiator (explain if the negotiator had

decision-making authority or acted only as an intermediary): .........................................................................................
.....................................................................................................................................................................................
2. Airport/aircraft
Number of persons affected:

Killed Injured
Crew ...................... .....................
Passengers ...................... .....................
Perpetrator(s) ...................... .....................
Others ...................... .....................
3. Circumstances surrounding death or injuries: .................................................................................................................
.......................................................................................................................................................................................
.......................................................................................................................................................................................
.......................................................................................................................................................................................
.......................................................................................................................................................................................
4. Damage to the aircraft/airport facilities (short description

to include cost of damage, time loss and flights affected): ..............................................................................................
.......................................................................................................................................................................................
.......................................................................................................................................................................................
.......................................................................................................................................................................................
5. Furnish any additional information relevant to circumvention of security procedures during this Occurrence:
.......................................................................................................................................................................................
.......................................................................................................................................................................................
.......................................................................................................................................................................................
.......................................................................................................................................................................................

PART II: INFORMATION CONCERNING THE ACTION TAKEN FOR THE RELEASE OF PASSENGERS AND CREW AND
THE RETURN OF THE AIRCRAFT, IF APPLICABLE
1. Action taken for the release of passengers and crew: ...................................................................................................
.....................................................................................................................................................................................
.....................................................................................................................................................................................
.....................................................................................................................................................................................
.....................................................................................................................................................................................
.....................................................................................................................................................................................
2. Action taken to facilitate the continuation of the journey of the passengers and crew as soon as practicable:
.......................................................................................................................................................................................
.......................................................................................................................................................................................
.......................................................................................................................................................................................
.......................................................................................................................................................................................
.......................................................................................................................................................................................
3. Action taken to return the aircraft and its cargo, without delay, to the persons lawfully entitled to possession:
.......................................................................................................................................................................................
.......................................................................................................................................................................................
.......................................................................................................................................................................................
.......................................................................................................................................................................................
.......................................................................................................................................................................................
Volume V - 97
PART III: INFORMATION CONCERNING THE MEASURES TAKEN IN RELATION TO THE PERPETRATOR(S)
1. Action by the competent authorities to take the perpetrator(s) into custody or other measures taken to ensure
his/her/their presence:
.....................................................................................................................................................................................
.....................................................................................................................................................................................
.....................................................................................................................................................................................
.....................................................................................................................................................................................
2. Action taken to institute extradition proceedings or to submit the case to the competent authorities for the
purpose of prosecution; advise of the results of such proceedings, if available (otherwise provide such
information separately as soon as practicable).
.......................................................................................................................................................................................
.......................................................................................................................................................................................
.......................................................................................................................................................................................
.......................................................................................................................................................................................
PART IV: INFORMATION CONCERNING THE ACTION TAKEN TO REMEDY WEAKNESSES SO AS TO PREVENT
PART IV: RECURRENCE OF ACTS OF UNLAWFUL INTERFERENCE AS SPECIFIED IN ANNEX 17, STANDARD 3.4.6.
.....................................................................................................................................................................................
.....................................................................................................................................................................................
.....................................................................................................................................................................................
.....................................................................................................................................................................................
.....................................................................................................................................................................................
.....................................................................................................................................................................................
.....................................................................................................................................................................................
.....................................................................................................................................................................................
.....................................................................................................................................................................................
.....................................................................................................................................................................................
.....................................................................................................................................................................................
.....................................................................................................................................................................................

PART V: ANY ADDITIONAL RELEVANT INFORMATION
............................................................................................................................................................................................
............................................................................................................................................................................................
............................................................................................................................................................................................
............................................................................................................................................................................................
............................................................................................................................................................................................
............................................................................................................................................................................................
............................................................................................................................................................................................
............................................................................................................................................................................................
............................................................................................................................................................................................
............................................................................................................................................................................................
............................................................................................................................................................................................
............................................................................................................................................................................................
............................................................................................................................................................................................
............................................................................................................................................................................................
...................................................................................
Name
...................................................................................
Title
...................................................................................
Department
END
Volume V - 99

ICAO Security Manual Volume V

Încărcat de

Informații document

Drepturi de autor

Formate disponibile

Partajați acest document

Partajați sau inserați document

Opțiuni de partajare

Vi se pare util acest document?

Este necorespunzător acest conținut?

Drepturi de autor:

Formate disponibile

ICAO Security Manual Volume V

Încărcat de

Drepturi de autor:

Formate disponibile

Doc 8973/7

Approved by the Secretary General

INTERNATIONAL CIVIL AVIATION ORGANIZATION

The issue of amendments is announced regularly in the ICAO Journal

RECORD OF AMENDMENTS AND CORRIGENDA

Crisis management and response to acts of unlawful interference

legal framework and security oversight;

airport design, infrastructure and equipment;

human resources recruitment, selection, training and certification; and

procedures and the implementation of security measures.

In order to achieve a high degree of sustainable performance, it is necessary to apply a

Crisis management and response to acts of unlawful interference

Volume III-Airport Security, Organization, Programme and Design Requirements, is

The Secretary General

Acts of Unlawful Interference (Definition given for guidance purposes)

unlawful seizure of aircraft in flight,

unlawful seizure of aircraft on the ground,

hostage-taking on board aircraft or on aerodromes,

forcible intrusion on board an aircraft, at an airport or on the premises of an aeronautical

introduction on board an aircraft or at an airport of a weapon or hazardous device or

communication of false information such as to jeopardize the safety of an aircraft in flight

Crisis management and response to acts of unlawful interference

Baggage container. A receptacle in which baggage is loaded for conveyance in aircraft.

Cabin baggage. Baggage intended for carriage in the cabin of an aircraft.

Check-in position. The location of facilities at which check-in is carried out.

Crisis management and response to acts of unlawful interference

Freight. See Cargo.

Identification cards. See Permits.

Mishandled baggage. Baggage involuntarily, or inadvertently, separated from passengers or crew.

Crisis management and response to acts of unlawful interference

Small arms. A general description applied to all hand-held firearms.

State of Registry. The State on whose register the aircraft is entered.

Transfer passengers/baggage. Passengers/baggage making direct connections between two different

Crisis management and response to acts of unlawful interference

CHAPTER 2 GENERAL PRINCIPLES

2.1 OPERATIONAL ASPECTS

a) injury to persons on board an aircraft;

b) damage resulting from an in-flight explosion;

d) mechanical failure; and/or

e) other unforeseen emergencies.

Crisis management and response to acts of unlawful interference

f) in general, persons in a position to make decisions on the demands made by offenders

g) procedures and equipment to ensure secure communications channels between the

2.1.10 In addition to the requirements included in Annex 6, Chapter 13 Operation of Aircraft

b) pilots-in-command should submit reports on acts of unlawful interference promptly;

c) a checklist should be available on-board detailing bomb search procedures; and

d) the flight crew compartment door on passenger-carrying aircraft should be capable of

Crisis management and response to acts of unlawful interference

CHAPTER 3 COLLECTION AND TRANSMISSION OF

a) the known or anticipated route of flight;

b) the known or suspected destination and the estimated time of arrival;

e) the presence of In-Flight Security Officers (IFSOs) on board the aircraft;

b) the number and condition of injured persons on board;

b) each State whose citizens suffered fatalities or injuries;

c) each State whose citizens are/were detained as hostages;

Crisis management and response to acts of unlawful interference

3.1.15 Notification should follow well-established communication procedures and be sufficiently

CHAPTER 4 AIR TRAFFIC CONTROL

4.1.4 Air traffic controllers should:

a) be prepared to recognize plain language or covert messages that indicate the

be discreet in communications with the pilot and be responsive to the pilots

Crisis management and response to acts of unlawful interference

CHAPTER 5 CONTINGENCY PLANS

b) action to be taken in respect of unlawful seizure or sabotage of aircraft;