Sunteți pe pagina 1din 107

Incident Response to Terrorist Bombings

Training Support Package Participant Guide

Table of Contents
Table of Contents .......................................................................................................... 1
MODULE 6 RESPONDING TO PRE-DET. INCIDENTS Administration Page ............ 2
Duration ....................................................................................................................... 2
Scope Statement ......................................................................................................... 2
Terminal Learning Objectives (TLO) ............................................................................ 2
Enabling Learning Objectives (ELO)............................................................................ 2
Resources ................................................................................................................... 2
Instructor to Participant Ratio ...................................................................................... 2
Reference List ............................................................................................................. 3
Assessment Strategy ................................................................................................... 3
ICON MAP ...................................................................................................................... 4
MODULE INTRODUCTION ............................................................................................ 5
PRE-DETONATION ACTIONS ..................................................................................... 12
THE INCIDENT BEGINS .............................................................................................. 14
INCIDENT VALIDATION .............................................................................................. 30
EVACUATION CONSIDERATIONS ............................................................................. 41
SEARCH DECISION ..................................................................................................... 61
BOMB TECH RESPONSE DECISION ......................................................................... 69
EVIDENCE COLLECTION ............................................................................................ 71
RESUME STEADY STATE ........................................................................................... 73
PRE-DETONATION ACTIONS REVIEW ...................................................................... 75
CASE STUDY: TIMES SQUARE BOMBING ATTEMPT .............................................. 76
SUMMARY .................................................................................................................... 96
PERFORMANCE EXERCISE - Administration Page ....... Error! Bookmark not defined.
Duration ....................................................................... Error! Bookmark not defined.

January 2017 Version 01.2017 Page 6-1


Emergency Operations Sensitive
Incident Response to Terrorist Bombings
Training Support Package Participant Guide

MODULE 6 RESPONDING TO PRE-DETONATION INCIDENTS


Administration Page
Duration
2.75 Hours
Scope Statement
During this module, participants are introduced to basic explosive terms and processes.
Included in the presentation is information concerning the components required to
produce an explosive or incendiary event, the physical and chemical processes required
to cause an explosion, and the physical consequences of an explosion.
Terminal Learning Objectives (TLO)
At the conclusion of this module, course participants will be able to apply safe and
effective response procedures to a pre-detonation incident.
Enabling Learning Objectives (ELO)
6-1 Identify priority actions required when responding to pre-detonation
incidents.
6-2 Identify best practices for first responders regarding multiple devices.
6-3 Identify considerations that affect evacuation decisions, including shelter-
in-place options, time, distance, shielding, and structural surroundings.
6-4 Utilize the Bomb Threat Stand-off Card to determine safe evacuation
distances for pre-detonation scenarios.
6-5 Determine effective procedures for conducting a search.
6-6 Determine an appropriate operational/tactical response for a pre-
detonation incident based on situational variables.
Resources
• Incident Response to Terrorist Bombings (IRTB) Course Handouts, including
course evaluation forms, pre-test forms, registration forms, self-evaluation forms,
and travel reimbursement forms (one per participant).
• Pencil or pen, protective glasses, badge, and nameplate (one per participant).
• Flash drive containing Participant Guide, Video Library, Case Study Library, and
Additional Resources (one per participant).
• Digital projectors, flip-chart, and whiteboard.
• Slides and video clips.
Instructor to Participant Ratio
Conference (Classroom–2:50; Range–3:50).

January 2017 Version 01.2017 Page 6-2


Emergency Operations Sensitive
Incident Response to Terrorist Bombings
Training Support Package Participant Guide

Reference List
See Appendices.
Assessment Strategy
• Observation of the level and quality of classroom participation.
• Participation and quality of performance on the performance exercise.
• Administration of the post-test to assess mastery of module objectives (TLO and
ELOs).

January 2017 Version 01.2017 Page 6-3


Emergency Operations Sensitive
Incident Response to Terrorist Bombings
Training Support Package Participant Guide

ICON MAP
Question: Used when there is an opportunity to ask a question or start a class
discussion.

Key Points/Learning Objectives: Used to highlight each time lesson content is


directly relevant to an Enabling Learning Objective.

First Responder Safety: Used to highlight information that relates directly to the
personal safety of first responders.

January 2017 Version 01.2017 Page 6-4


Emergency Operations Sensitive
Incident Response to Terrorist Bombings
Training Support Package Participant Guide

MODULE INTRODUCTION

Slide 6-1 IRTB Module 6: Responding to Pre-Detonation


Incidents

This slide displays the Module 6 title slide.

The initial actions of first responders can impact dramatically on the


safety, effectiveness, and success of the response. In a pre-
detonation situation, care must be taken to avoid placing
responders or the public in harm’s way. Although most such
situations are benign and do not involve an actual explosive device,
it only takes one real situation to place responders and the public in
immediate danger. First responders must assume, in the absence
of evidence to the contrary, that every pre-detonation situation
poses a risk to them and to the public. However, they must also be
aware that responding repetitively to benign incidents often leads to
complacency on the part of responders.

Discussions throughout the course on these and other operational


considerations will be conducted with the focus on making
appropriate decisions from the outset—decisions that will reduce
risk to the public and responders and benefit the entire incident
response.

January 2017 Version 01.2017 Page 6-5


Emergency Operations Sensitive
Incident Response to Terrorist Bombings
Training Support Package Participant Guide

During this module, instructors describe appropriate actions for


executing safe and effective response to bomb threat and
suspicious item incidents. The course material highlights critical
decisions that must be made and problems that frequently develop.
There is a performance exercise (PE) at the end of the module that
will allow the participants to utilize information gained from this
module to make decisions and take actions during a pre-detonation
incident.

January 2017 Version 01.2017 Page 6-6


Emergency Operations Sensitive
Incident Response to Terrorist Bombings
Training Support Package Participant Guide

Slide 6-2 Terminal Learning Objective

This slide contains the Terminal Learning Objective for the module.

At the conclusion of this module, course participants will be able to


apply safe and effective response procedures to a pre-detonation
incident.

January 2017 Version 01.2017 Page 6-7


Emergency Operations Sensitive
Incident Response to Terrorist Bombings
Training Support Package Participant Guide

Slide 6-3 Enabling Learning Objectives

Slide 6-4 ELOs (cont.)

These slides contain the Enabling Learning Objectives and should


be summarized by the instructor.

January 2017 Version 01.2017 Page 6-8


Emergency Operations Sensitive
Incident Response to Terrorist Bombings
Training Support Package Participant Guide

The Enabling Learning Objectives (ELOs) for this module are:

6-1 Identify priority actions required when responding to pre-


detonation incidents.

6-2 Identify best practices for first responders regarding


multiple devices.

6-3 Identify considerations that affect evacuation decisions,


including shelter-in-place options, time, distance,
shielding, and structural surroundings.

6-4 Utilize the Bomb Threat Stand-off Card to determine safe


evacuation distances for pre-detonation scenarios.

6-5 Determine effective procedures for conducting a search.

6-6 Determine an appropriate operational/tactical response


for a pre-detonation incident based on situational
variables.

January 2017 Version 01.2017 Page 6-9


Emergency Operations Sensitive
Incident Response to Terrorist Bombings
Training Support Package Participant Guide

Slide 6-5 Course Map

This slide depicts the Course Map.

Modules 1-5 provided participants with knowledge about terrorist


threats and fundamentals of explosives, which will be useful in
assessing situations and making decisions concerning appropriate
response actions.

Modules 6, 7, and 8 address incident response to three different


types of terrorist bombing incidents: pre-detonation, post-
detonation, and special situations. Module 6 addresses pre-
detonation incidents, Module 7 addresses post-detonation
incidents, and Module 8 addresses special situations (including
multi-weapon and suicide bombing attacks). Much of the remaining
course will focus on plans, policies, procedures, and tactics for
responding to bombing incidents.

January 2017 Version 01.2017 Page 6-10


Emergency Operations Sensitive
Incident Response to Terrorist Bombings
Training Support Package Participant Guide

Slide 6-6 The Bottom Line

This slide provides a statement that should be reiterated throughout


this module, and throughout the course when applicable. That is,
that all the rules that dictate first responder action in the
participant's agency and or municipality should always be adhered
to. Failure to do so could expose the individual first responder and
others to unnecessary harm or danger.

If first responders feel that the rules that govern first responder
action are lacking or in error, it is their responsibility to suggest
change and provide the rationale to support the change.

Although this module will present recommended policies,


procedures, and protocols for pre-detonation incidents, it is
important that responders should always follow their department’s
approved policies, procedures, and protocols, even if they differ
from what is presented in this course.

It is recommended, however, that agencies carefully review such


policies and consider modifying them so they are consistent with
what is presented in this course. The material in this course was
developed from research and best practices learned during
thousands of incidents, and has been reviewed and approved by
FEMA and the Department of Homeland Security.

January 2017 Version 01.2017 Page 6-11


Emergency Operations Sensitive
Incident Response to Terrorist Bombings
Training Support Package Participant Guide

PRE-DETONATION ACTIONS

Slide 6-7 Pre-detonation Actions

ELO 6-1
Identify priority actions required when responding to pre-
detonation incidents.

This slide shows a framework that first responders may use to work
through a pre-detonation incident.

This slide lists the pre-detonation actions that may be implemented


or deployed when a pre-detonation incident begins. The sequence
depicted on this slide represents a common sequence in which
response actions can occur in a pre-detonation incident; however,
since every bomb threat incident is different, the exact order of the
actions is likely to vary. Pre-detonation incidents can begin when a
bomb threat is received or, independent of a threat, when a
suspicious item is identified. We will discuss each of the steps in
this series in greater depth in the upcoming slides.

The pre-detonation actions for which first responders should be


prepared include:
 Bomb Threat Received / Suspicious Item Found

January 2017 Version 01.2017 Page 6-12


Emergency Operations Sensitive
Incident Response to Terrorist Bombings
Training Support Package Participant Guide

 Incident Validation
 Evacuation Decision
 Search Decision
 Evidence Preservation and Collection
 Resume Steady State

Along with these six actions, we will also discuss the role of bomb
technicians and the need for continual assessment throughout a
response to a pre-detonation incident.

January 2017 Version 01.2017 Page 6-13


Emergency Operations Sensitive
Incident Response to Terrorist Bombings
Training Support Package Participant Guide

THE INCIDENT BEGINS

Slide 6-8 The Incident Begins

This slide contains two photos: the first, of a woman receiving a


phone call; the second, of an unattended bag as it rides the
AirTrain at JFK airport on December 27, 2009 in the Queens
borough of New York City, two days after the “Underwear Bomber”
bombing attempt on Northwest Airlines Flight 253 over Detroit.

When does an explosive threat incident begin? It begins as soon as


a bomb threat is received and/or a suspicious item is found or
identified. Either event should indicate that first responders should
begin procedures to mitigate injury by implementing appropriate
pre-detonation actions. We will discuss specific details of these two
types of threats on the following slides.

January 2017 Version 01.2017 Page 6-14


Emergency Operations Sensitive
Incident Response to Terrorist Bombings
Training Support Package Participant Guide

Slide 6-9 Bomb Threats

This slide discusses some of the issues surrounding bomb threats.

Bomb threats are the most common type of pre-detonation incident,


and they are most commonly made by phone with an increasing
number of threats being made via social media. Many are hoaxes,
and they often occur in epidemics: when one occurs, you can
expect others. Bomb threat callers often communicate their threats
as a means of causing an evacuation of a workplace or school.

For many years, bomb threats were considered pranks. However,


many agencies—including school districts—now impose significant
penalties on citizens who communicate bomb threats. Statutes
covering these situations have been upgraded in many jurisdictions
and callers can face large fines and imprisonment.

Despite the fact that many bomb threats are a hoax, as a first
responder, you must approach a bomb threat with the
preconception that the threat is real until proven otherwise.
Each threat must be evaluated on a case-by-case basis.
Additionally, first responders must always assume that
multiple devices may be placed in the area to target first
responders.

January 2017 Version 01.2017 Page 6-15


Emergency Operations Sensitive
Incident Response to Terrorist Bombings
Training Support Package Participant Guide

Slide 6-10 Suspicious Items

This slide contains a picture of a suitcase IED and information


about suspicious items.

Pre-detonation incidents can also begin when a suspicious item is


discovered at a location that is a potential bombing target.
According to the Department of Homeland Security (DHS),
a suspicious item is defined as any item (e.g., package, vehicle)
identified as potentially containing explosives, an IED, or other
hazardous material that requires bomb technician diagnostic skills
and specialized equipment for further evaluation. Suspicious
indicators are based upon the prevailing and/or communicated
threat, placement and proximity of the item to people and valuable
assets, and more tangible aspects. These items caninclude, but are
not limited to unexplainable wires of electronics, other visible bomb-
like components, unusual sounds, vapors, mists, or odors.1
Suspicious items can vary in size from a letter envelope to a large
truck. They are typically found in areas where security is
emphasized, such as airports, government buildings, or large public
gatherings.

1
FBI and DHS Office for Bombing Prevention, “Bomb Threat Guidance” brochure, 2013.

January 2017 Version 01.2017 Page 6-16


Emergency Operations Sensitive
Incident Response to Terrorist Bombings
Training Support Package Participant Guide

Suspicious item reports are complicated. Most suspicious item


reports are false alarms, but at the same time, actual suspicious
activities at bombing incidents often go unreported. First
responders should be aware that suspicious item reports generally
increase as the perceived threat to the public increases. Citizens
report items that would otherwise go unnoticed when their
awareness has been heightened by news-media attention to past
and recent events or warnings from government or private sector
experts.

Examples
Four examples of suspicious items that were unobserved until they
turned out to contain bombs are:
 The backpack left under a park bench in the 1996 Atlanta
Olympics bombing.2
 The delivery truck parked unattended outside the Alfred P.
Murrah Federal Building in Oklahoma City, Oklahoma in
1995.3
 The unattended truck left running in front of Times Square in
the 2010 unsuccessful car bombing attempt by Faisal
Shahzad.4
 Two backpacks left unattended near the finish line of the
Boston Marathon on Patriot’s Day, April 15, 20135.

The initial first responder at a suspicious item incident is typically a


law enforcement officer. The officer should immediately isolate the
item by evacuating persons from near and around the suspected
item, keeping in mind the minimum evacuation distance per the
Combined Bomb Threat Stand-off Card (see Appendix B) and time,
distance, and shielding aspects that are discussed later in this
course. In no case should anyone other than a certified bomb
squad attempt to handle or render safe the suspected explosive
device.

2
Sack, K. (1996, July 28). Bomb at the Olympics: The Overview; Olympics Park Blast Kills One, Hurts 111; Atlanta
Games Go On. The New York Times. Retrieved from: http://www.nytimes.com/1996/07/28/us/bomb-
olympics-overview-olympics-park-blast-kills-one-hurts-111-atlanta-games-go.html?pagewanted=all
3
After Action Report: Alfred P. Murrah Federal Building Bombing. The Oklahoma Department of Civil
Emergency Management.
3
Criminal Complaint: United States of America V. Faisal Shazad, (2010). United States District Court for the
Southern District of New York
5
After Action Report for the Response to the 2013 Boston Marathon Bombings, (2014). Massachusetts
Emergency Management Agency.

January 2017 Version 01.2017 Page 6-17


Emergency Operations Sensitive
Incident Response to Terrorist Bombings
Training Support Package Participant Guide

Law enforcement agencies typically serve as the lead agency in


suspicious item incidents. The senior law enforcement officer on
the scene will initially act as the incident commander to establish
control over the scene and direct and coordinate responders. In
private buildings like malls or offices, the commercial security
personnel typically cooperate with and accept direction from the law
enforcement personnel. Respectful interaction is always the best
practice for involving commercial security personnel and
maximizing their in-depth knowledge of the location, individuals,
and specific threats.

The International Association Chiefs of Police (IACP) offers a


model bomb incident management plan. Their model plan can
serve as a useful starting point in creating response plans that meet
most operational requirements. Access to this and other models is
available to any IACP member through the IACP website or by
contacting the organization. The IACP website is found at:
http://www.iacp.org/

A Note about Suspicious Packages: Suspicious packages should


be treated as an explosive and should not be touched, handled, or
opened to investigate the contents. The package should be isolated
by leaving it in place and immediately evacuating all personnel
away from the item and notification/request of bomb tech(s) made.
Signs of a suspicious package include:
 No return address
 Excessive postage
 Stains
 Strange odor
 Strange sounds
 Unexpected delivery
 Wires or unusual protrusions
 Poorly handwritten
 Misspelled words
 Incorrect titles
 Foreign postage
 Restrictive markings such as “personal” or “confidential”
 Lopsided package
 Addressed to someone no longer in office or department
 Presence of small bulges, powder, or granules6

6
FBI and DHS Office for Bombing Prevention, “Bomb Threat Guidance” brochure, 2013.

January 2017 Version 01.2017 Page 6-18


Emergency Operations Sensitive
Incident Response to Terrorist Bombings
Training Support Package Participant Guide

The actions of first responders at a suspicious item incident


could be observed or recorded by personnel who do not have
a legitimate requirement to document such actions. Written
summaries and audio or video recordings can be used by
terrorists in planning subsequent attacks. Preventing such
recordings is one important reason to establish a large
enough perimeter that the public will not be able to videotape
tactics.

January 2017 Version 01.2017 Page 6-19


Emergency Operations Sensitive
Incident Response to Terrorist Bombings
Training Support Package Participant Guide

Slide 6-11 Video: Suspicious Bag in Ankara, Turkey

This slide contains a video of a suspicious bag that was found at


the scene of a bombing near government buildings in Ankara,
Turkey in 2003. Sixteen officers were injured in the blast, two of
them critically.7 This video provides a chilling demonstration of what
first responders should NOT do when a suspicious item is located.
WARNING: Graphic violence.

7
(2003, Aug. 1). Turkey Bomb Injures Police. BBC News. Retrieved from:
http://news.bbc.co.uk/2/hi/europe/3116183.stm

January 2017 Version 01.2017 Page 6-20


Emergency Operations Sensitive
Incident Response to Terrorist Bombings
Training Support Package Participant Guide

Slide 6-12 Educating the Public

First responders are seldom the people who actually receive a


bomb threat or first encounter a suspicious package. Secretaries,
receptionists, bus drivers, custodians, doormen, postal workers,
and others are more likely to have the first contact with a bomb
threat. These individuals’ actions in the first minutes after receiving
a threat can have a tremendous impact on the safety of people in
the vicinity and the outcome of an investigation. Ideally, the person
receiving the bomb threat has received some basic training in how
to respond, but this is not guaranteed. Once first responders have
been notified, it becomes the first responders’ responsibility to
advise the individuals who receive a bomb threat or locate a
suspicious item in how to take the appropriate next steps.

How do we get the message out to the public in a cost-effective and


productive way? A good approach is to find ways to use the
knowledge and resources available in your agency. One effective
approach is to have the bomb squad share their knowledge and
expertise by providing awareness level presentations to key
members of the community. Those who receive this training, such
as school resource officers, public information officers (Police and
Fire), and patrol divisions, can become force multipliers in
educating schools and businesses in the area.

January 2017 Version 01.2017 Page 6-21


Emergency Operations Sensitive
Incident Response to Terrorist Bombings
Training Support Package Participant Guide

The Additional Resources folder on the IRTB Flash Drive contains


some valuable documents that can help agencies educate their
communities. Some sources of information include:
 A Bureau of Alcohol, Tobacco, Firearms and Explosives
(BATFE) document and video titled “Bomb Threats and
Physical Security Planning” is included on the IRTB Flash
Drive.
 Schools can get a free CD and packet on bomb threat
training from the Department of Justice and Department of
Education by going to http://www.threatplan.org/. This
source will also send information to police departments.

January 2017 Version 01.2017 Page 6-22


Emergency Operations Sensitive
Incident Response to Terrorist Bombings
Training Support Package Participant Guide

Slide 6-13 Educating the Public: Bomb Threat Checklist

This slide shows an image of the Bomb Threat Checklist.

A Bomb Threat Checklist is a simple document that an individual


can complete at the time a bomb threat is received, or soon
thereafter. It is a valuable tool that can assist first responders in
validating bomb threats. First responders should keep in mind that
the Bomb Threat Checklist is only as effective as how thoroughly it
is completed. For this purpose, first responders should educate
those who might receive a bomb threat on how to effectively
complete a Bomb Threat Checklist. As discussed previously, this
audience might include school secretaries, receptionists, bus
drivers, custodians, doormen, private security officers, or others.

If the Bomb Threat Checklist has not been completed when first
responders arrive at a pre-detonation incident, the first responders
should work with the individual who received the threat to obtain
information that would have been on the Bomb Threat Checklist,
had it been utilized.

Regardless of how the information is transmitted to the authorities,


these are the elements of information that are most valuable to first
responders. As in any investigation, who, what, when, where, why
and how should be asked, including:

January 2017 Version 01.2017 Page 6-23


Emergency Operations Sensitive
Incident Response to Terrorist Bombings
Training Support Package Participant Guide

• Location of bomb(s)
• What it looks like
• Type and size of bomb(s)
• Time of detonation
• How it will detonate: time, actions, command, etc.
• Information about terrorist and motivation

A sample Bomb Threat Checklist is provided in Appendix C; this


document can also be downloaded from the DHS website at
http://www.dhs.gov/publication/dhs-bomb-threat-checklist.

January 2017 Version 01.2017 Page 6-24


Emergency Operations Sensitive
Incident Response to Terrorist Bombings
Training Support Package Participant Guide

Slide 6-14 Educating the Public: Gather, Protect, Preserve

This slide shows a logic tree or an action process for working


through a bomb threat or suspicious package. Each threat must be
looked at individually—there should not be a static response to all
incidents.

This chart contains valuable information for anyone who may


receive a bomb threat or a suspicious item. It can be used to help
educate key members of the public about appropriate actions to
take when a bomb threat is received. The chart lists the different
Modes by which a bomb threat may be received, then describes
appropriate actions to Gather information and Protect people and
property, and actions to Preserve evidence. We will discuss each
mode and related actions as they relate to what an individual
should do if he/she receives a bomb threat.

Phone: Landline, cellular, or Internet


Mode: According to DHS, most bomb threats are received by
telephone.8 It is essential to act quickly, but remain calm and obtain
information. Increasingly, threats may also be received by text
messages. A bomb threat received via text messaging can seem a

8
Bomb Threat Call Procedures and Threat Checklist. U.S. Department of Homeland Security

January 2017 Version 01.2017 Page 6-25


Emergency Operations Sensitive
Incident Response to Terrorist Bombings
Training Support Package Participant Guide

little more personal since the terrorist has identified a specific


person’s personal cell phone number.

Gather and Protect: The first responder should advise the person
who received the call not to hang up the phone and, if possible, to
keep the caller on the line. If the threat is communicated by
telephone or fax, instruct the caller to complete the Bomb Threat
Checklist (especially information related to vocal characteristics and
any background noises or activity). If the person receiving the
threat did utilize some sort of Bomb Threat Checklist, the first
responder should go over the checklist with them to ensure all
items were covered and to possibly gather more specific
evidentiary detail.

Preserve: If the phone has not been hung up, do not hang up the
phone or dial any numbers in an attempt to recover caller
identification until information is gathered regarding the
phone’s capacity. If the phone has a display, copy and/or
photograph the information on the display. The connection must be
protected, therefore isolating the phone as evidence is essential.

Even if the caller has hung up, the person receiving the call should
not hang up, in order to prevent any other calls from coming in on
the line, and allow for the potential use of the Star 69 (*69) feature,
which will give the telephone number of the last incoming call, for a
small charge. If this procedure is not followed, the information might
be lost. Check with the IT person on the premises or phone service
provider to ascertain if this feature is available. Another potential
action is to contact the telephone service provider from a different
phone, advise them that you have an open line, and ask if they can
retrieve the origination of the previous incoming call. If a cell phone
was used, the telephone service provider may be able to use
triangulation to locate the phone from which the bomb threat was
received. The same procedure of contacting the telephone service
provider should be followed with the fax-dedicated telephone line, if
the bomb threat was received by fax. In cases where threats are
received via text message, the text message can be obtained from
the phone itself and/or through the phone service provider based
upon the time and date call was received.

In-Person
Mode: In person means a person has come into a facility and
advised a member of facility that there is a bomb in the facility and

January 2017 Version 01.2017 Page 6-26


Emergency Operations Sensitive
Incident Response to Terrorist Bombings
Training Support Package Participant Guide

then leaves. This includes “second party” situations, where the


bomber forces someone else to personally deliver the bomb threat.

Gather and Protect: There should be no attempt by the person


receiving the threat to detain or confront the terrorist delivering the
threat, but if possible, encourage the terrorist to stay in the area.
The first responder will need to immediately interview the person
that received the threat (and any other witnesses) to ascertain if
they have filled out a bomb threat procedure form. If a bomb threat
procedure form has not been filled out, the first responder can then
review the form with them to fill out the necessary information such
as description of the subject, age, gender, height, weight, etc. and
possible details of the bomb and its location (see bomb threat call
procedures form). Ascertain if the person delivering the threat
touched anything, for example the reception counter, a door handle
or frame, a piece of paper, or left anything behind. Also ascertain
which way the person exited, if there is audio video equipment on
the premises that can be reviewed, and if a vehicle was used and
which direction it traveled.

Preserve: Immediately document and preserve details of the


subject’s appearance, mannerism, and other vital information as
gathered. Secure video or surveillance recordings if available.

Written (Letter or Parcel)


Mode: The next type of bomb threat is one received by letter, or a
suspicious package. It should be noted that a suspicious
package can, by itself, set in motion a response to a bomb
threat without being opened, because actual bombs have been
and can be delivered in various size packages to include a
manila envelope to packages of various shapes and sizes.
Letters or parcels should be handled as little as possible and
placed in an area where they will not be handled by someone
uninformed about the threat.

Gather and Protect: If the letter has been opened, the first
responder should treat the letter as evidence and handle it following
the appropriate procedures for securing evidence by protecting the
letter and envelop from contamination. The first responder should
ascertain who has handled the letter and envelope, and document
and interview those individuals if possible. If readable, the letter
could contain valuable information concerning the type of device,
time, date and location of bomb detonation.

January 2017 Version 01.2017 Page 6-27


Emergency Operations Sensitive
Incident Response to Terrorist Bombings
Training Support Package Participant Guide

Preserve: Do not handle the letter, envelope, or package. Bomb


threats received by letter can contain valuable evidence such as
fingerprints, paper manufacturer identification, postal stamp
origination, and DNA under the adhesive stamp as well as in the
adhesive to close the envelope. Isolate the letter, envelope, or
package. First responders should be notified or requested. Upon
arrival, first responders should notify and request bomb technicians
and take measures to isolate the letter or package until the area
has been cleared by the bomb squad.

Facsimile
Mode: Threats received by fax. A person receiving a bomb threat
electronically should safeguard the threat by taking a photo of the
screen and leave the window open until a first responder can view
the evidence.

Gather and Protect: If the fax has been received, the first responder
should treat the fax as evidence and handle it following the
appropriate procedures for securing evidence by protecting the fax
and the facsimile device from contamination, until it has been
processed for evidence. The first responder should ascertain who
has handled the paper fax and machine and document those
individuals as such. If readable, the fax could contain valuable
information concerning the type of device, time, date and location of
bomb detonation, in addition to the number from where the fax may
have been sent.

Preserve: Treat all items recognized as being part of the delivery


system of the bomb threat to be evidence that must be handled
according to policies and procedures concerning protection from
contamination for forensic analysis. Facsimiles can contain
information on the paper fax and the machine itself regarding the
number from which the fax was sent and should be handled as
evidence. In any event, the device should be secured in the
condition when first observed, treated as evidence, and measures
against contamination taken. The organization’s IT person and
security can be utilized in assisting in the aforementioned
measures.

Email and Social Media


Mode: e-mail and social media including, Facebook, Twitter, Apps
(examples: Burnbook, Afterschool, Yik Yak, Whisper, and Kik) and
Websites. Social media bomb threats have increased using these
forms of communication. Schools, airlines, military bases, and

January 2017 Version 01.2017 Page 6-28


Emergency Operations Sensitive
Incident Response to Terrorist Bombings
Training Support Package Participant Guide

businesses have received social media bomb threats. Be aware


that “swatting” is also occurring. Swatting involves a hacker using
social media to trick a 911 system into sending the local police and
Special Weapons and Tactics (SWAT) to a specific location for a
bomb threat or other emergency. The FBI has arrested several
individuals for swatting.

Gather and Protect: If the threat is received by e-mail or social


media, is still on the screen, and has not been printed, do not close
the e-mail or social media. Try to take a screen shot or a
photograph of the threat as it appears, and then print the page. The
threat should be safeguarded until a first responder can view the
evidence.

Preserve: E-mail should not be closed or the computer shutdown


until a screenshot is taken and the message printed, including the
header, if possible. In the event that the e-mail was closed prior to
first responder arrival, information is still obtainable and the
computer should be retained as evidence. If the bomb threat is still
on a smart phone, laptop, or PC screen, the message can be
photographed and a screenshot taken before attempting any other
investigatory measures such as printing the message. In any event,
the device should be secured in the condition when first observed,
treated as evidence, and measures taken to prevent contamination.
The organization’s IT person and security can be utilized in
assisting in the aforementioned measures. Bomb threats received
via email and social media provide the same opportunities to
observe and track the origin of the threat.

First responders should work with the community to ensure


procedures for email and social media bomb threats are
incorporated into their bomb threat response plan.9,10

9
Decarr, Kristin. (2015, April 10). Anonymous Social Media Generating School Bomb Threats. Retrieved from
http://www.educationnews.org/k-12-schools/anonymous-social-media-generating-school-bomb-threats/.
10
(2013, September 3). The Crime of ‘Swatting’. Retried from https://www.fbi.gov/news/stories/2013/september/the-
crime-of-swatting-fake-9-1-1-calls-have-real-consequences.

January 2017 Version 01.2017 Page 6-29


Emergency Operations Sensitive
Incident Response to Terrorist Bombings
Training Support Package Participant Guide

INCIDENT VALIDATION

Slide 6-15 Incident Validation

This slide lists considerations to assist in evaluating the validity of


the threat. Some of the most useful interviews are with custodial
staff, who are likely to be the most aware of what may be out of
place or suspicious in a large building or complex.

Each pre-blast incident must be evaluated on its own merits to


determine the best course of action for first responders. The task of
evaluating the bomb threat is accomplished by validating the
individual aspects of the threat and the scene. The information
collected is then used to formulate a response plan specific to the
incident. As is the case in any investigation, first responders should
gather information regarding the “Who, What, When, Where, Why
and How” of the situation, to assist in evaluating the validity of
bomb threats.

To validate the threat, a face-to-face interview should be conducted


with the person that actually received the threat. This interview may
supply information that may or may have not been logged on the
Bomb Threat Checklist. If the telephone conversation was

January 2017 Version 01.2017 Page 6-30


Emergency Operations Sensitive
Incident Response to Terrorist Bombings
Training Support Package Participant Guide

recorded, listen to and review the actual conversation prior to, or


during the interview.

To validate the security at the scene of a threat, an interview with


the person in charge of the facility can often provide more of a big
picture regarding the status of the facility. For example, often the
manager, or person in charge, can provide important background
information concerning previous threats.

Probably one of the most important people to interview at a facility


is the maintenance custodian. While individual occupants of the
facility may supply good information on their specific area, a
maintenance custodian has the most knowledge of common areas
such as building perimeters, halls, stairways, lounges, restrooms,
and any other part of the facility where a potential bomber could
visit without being discovered or challenged by an occupant.

When interviewing, the person receiving the threat and any other
witnesses should be questioned concerning the route or ingress
and egress of the terrorist and if they touched anything like the
desk, front counter, door frames, door knobs, papers, any
equipment, etc. Any audio or video recordings from security
cameras should be located and reviewed for possible
contemporaneous identification of the terrorist and secured for its
evidentiary value.

Of course all bomb threats are taken seriously and every step
should be taken to validate the authenticity of the threat. When any
suspicious package or device is found, it should be isolated through
evacuation measures away from the device or package, and the
area not repopulated until a bomb technician clears the scene. A
standard minimum evacuation distance is 1000 feet; greater
distance is always better, if possible. Evacuation recommendations
are discussed in greater detail later in this module.

Upon notification, the initial responder at the scene should


determine the method used to communicate the threat and guide
the person providing the notification to accomplish certain actions
to preserve evidence and identify factors that may aid in the
apprehension of the terrorist.

The individual who received the threat should be interviewed as


soon as possible while details are still fresh in his or her memory. If
the individual who received the threat completed a Bomb Threat

January 2017 Version 01.2017 Page 6-31


Emergency Operations Sensitive
Incident Response to Terrorist Bombings
Training Support Package Participant Guide

Checklist, the responding officer should verify the information on


the checklist with the individual. If the Bomb Threat Checklist was
not completed, the responding officer should use the checklist as a
guide in interviewing the individual who received the threat.
Appendix C contains an example of a Bomb Threat Checklist.

In some cases, the senior official at the site (business owner,


school principal, or senior government official) may try to speak for
individuals with immediate knowledge of the incident. While such
officials can sometimes provide useful information, it is critical that
those with first-hand knowledge of the incident be interviewed first.

January 2017 Version 01.2017 Page 6-32


Emergency Operations Sensitive
Incident Response to Terrorist Bombings
Training Support Package Participant Guide

Slide 6-16 Incident Validation, Cont.

This slide lists information that can help validate a bomb threat.

Obviously, responders will want as much information as possible


concerning the bomb itself. However, to evaluate the credibility of
the threat, it is also useful to obtain information concerning the
length of the call, any background noises on the line, and features
unique to the caller’s voice. Voice characteristics are important for
investigators when attempting to identify a caller. Some
characteristics can provide information useful to first responders
when evaluating the call.

For example, giggling on the part of a caller or in the immediate


background could suggest a hoax. A calm, slow, deliberate voice
could suggest a legitimate threat. Another indicator of a potentially
legitimate threat is if the caller identifies specific details of the
bomb, such as its size, materials utilized, and time it will detonate.

Although responders should not plan their entire response based


on voice characteristics, these characteristics can assist in making
decisions about the credibility of the threat and delivering the
appropriate level of response. Background noises can be a key. If
the noise on the line is similar to background noise at the site, then
the call may have originated close to the target.

January 2017 Version 01.2017 Page 6-33


Emergency Operations Sensitive
Incident Response to Terrorist Bombings
Training Support Package Participant Guide

If the threat is determined to be credible, a dispatch center should


be contacted to request the appropriate resources through the
chain of command and to ensure the incident commander is
dispatched to the scene to establish command and control of the
response. Communicate all information regarding the threat to the
dispatch center and incident commander through the most
expedient and clear medium. Based upon area and communication
capabilities, the use of a landline telephone might be the best
option to make recommendations for appropriate response
resources, such as explosive detection canine units, bomb
technicians, special weapons and tactics teams (SWAT), fire
department, and emergency medical technicians (EMTs).

January 2017 Version 01.2017 Page 6-34


Emergency Operations Sensitive
Incident Response to Terrorist Bombings
Training Support Package Participant Guide

Slide 6-17 Avoid Complacency

This slide contains a photograph of Chicago Police officers


responding to a bomb threat at Wrigley Field in August 2015.

We have discussed that many bomb threats are pranks or hoaxes,


but we have also emphasized that every bomb threat or suspicious
item must be treated as a legitimate threat until proven otherwise.
As many first responders gain experience and see more fake bomb
threats, it becomes a challenge to avoid complacency and continue
to treat each bomb threat with the serious response such situations
require.

First responders can serve their community best when they


maintain situational awareness and avoid complacency.
 Be aware of your surroundings. Alert personnel should ask
questions like:
o What is that out-of-place item?
o Why would someone leave a backpack alone?
o Why is a delivery truck parked here today?
 Don’t get caught up with the task at hand and forget to notice
what’s going on around you.
 Use a buddy system.
 Trust your intuition; if something looks wrong, let someone
know and have it checked out.

January 2017 Version 01.2017 Page 6-35


Emergency Operations Sensitive
Incident Response to Terrorist Bombings
Training Support Package Participant Guide

 Make it a habit to look everywhere and think three-


dimensionally.

All suspicious items should be treated as a bomb until proven


or deemed otherwise by a first responder having the proper
training and equipment to do such an evaluation, which means
a Bomb Technician.

January 2017 Version 01.2017 Page 6-36


Emergency Operations Sensitive
Incident Response to Terrorist Bombings
Training Support Package Participant Guide

Slide 6-18 Multiple Devices

This slide contains a video of the explosion of a second bomb after


the initial blast at an abortion clinic in Sandy Springs, GA in 1997.

ELO 6-2
Identify best practices for first responders regarding multiple
devices.

When responding to a pre-detonation incident, first responders


should always be aware of the possibility that there may be multiple
explosive devices. Terrorists and perpetrators of bombing events
sometimes use multiple devices, usually with the intent to harm first
responders who arrive in response to the detonation of an initial
bomb. These devices have often been called “secondary devices,”
but the term “multiple devices” is more appropriate, since
“secondary” suggests there may be only one additional device,
when there could in fact be many. Using the term “multiple devices”
reminds first responders that they should be cognizant of the fact
that terrorists utilize multiple devices to kill or injure first responders.

The video on this slide depicts the explosion of a second device


while first responders and news crews were standing near the site
of an abortion clinic bombing carried out by Eric Robert Rudolph at

January 2017 Version 01.2017 Page 6-37


Emergency Operations Sensitive
Incident Response to Terrorist Bombings
Training Support Package Participant Guide

Sandy Springs, GA in January 1997. Rudolph used a secondary


device again when he bombed the Otherside Lounge, an Atlanta-
area gay bar, in February 1997, although in that case, a bomb
squad was able to find and safely detonate that device before any
more people were harmed.

While Rudolph did not invent the concept of using multiple


explosive devices, his additional devices, deliberately planted and
timed to injure first responders, changed the way law enforcement
and emergency personnel respond to bomb threat incidents in the
United States. They forced agencies/departments to change first
responders’ response and tactics. In the past, agencies or first
responders did not consider the possibility of multiple devices at a
scene. First responders have to face the reality that there are
people and organizations out there trying to harm or kill first
responders.

The possibility of multiple devices should affect every choice you


make as a first responder when responding to a bombing incident.
As we begin discussing how to respond to bombing incidents in this
module and throughout the remainder of this course, keep in mind
the importance of being aware of the possibility of multiple devices.

January 2017 Version 01.2017 Page 6-38


Emergency Operations Sensitive
Incident Response to Terrorist Bombings
Training Support Package Participant Guide

Slide 6-19 Multiple Devices, Cont.

This slide contains a list of recommended guidelines for first


responders regarding multiple devices. The slide also contains a
photo taken immediately after a second device detonated at the
abortion clinic in Sandy Springs, GA, in January 1997.

The following guidelines are recommended for first responders by


the U.S. Fire Administration (USFA):

(1) Anticipate the presence of additional devices at any


suspicious incident.
(2) Search for additional devices before moving into the incident
area.
(3) Avoid touching or moving anything that may conceal an
explosive device.
(4) Effectively manage the scene with boundaries, exclusion
zones, triage areas, etc.
(5) Evacuate survivors and non-essential personnel as quickly
as possible.
(6) Preserve the scene as much as possible for evidence
collection and crime investigation.

Life safety measures should be paramount at any incident


while attempting to saves lives and mitigate a scene. The

January 2017 Version 01.2017 Page 6-39


Emergency Operations Sensitive
Incident Response to Terrorist Bombings
Training Support Package Participant Guide

search for potential multiple devices should include the


identification of ingress and egress routes as well as any
staging areas that have been cleared. The use of canines,
unmanned aerial vehicles (UAVs or “drones”), or robots
should be implemented as soon as possible, even after a first,
second, or more devices have been found.

January 2017 Version 01.2017 Page 6-40


Emergency Operations Sensitive
Incident Response to Terrorist Bombings
Training Support Package Participant Guide

EVACUATION CONSIDERATIONS

Slide 6-20 Making Evacuation Decisions

This slide serves as an overview of the considerations that must be


weighed in association with the decision to shelter-in-place or
evacuate.

ELO 6-3
Identify considerations that affect evacuation decisions,
including shelter-in-place options, time, distance, shielding,
and structural surroundings.

How should evacuation decisions be made? Who should make


them? As always, local policies and procedures often determine the
answers to these questions.

Managers or administrators will often ask for advice from first


responders concerning whether to evacuate. First responders and
incident commanders at the scene should provide information as
available to the responsible parties in order to assist them in
making decisions on search, evacuation, or reentry. First
responders have the responsibility to advise decision-makers about
the possible levels of life and property loss and to participate in

January 2017 Version 01.2017 Page 6-41


Emergency Operations Sensitive
Incident Response to Terrorist Bombings
Training Support Package Participant Guide

discourse concerning the possible length of time it will take to


resolve the threat. If the manager or administrator decides not to
evacuate, it is appropriate to document his/her decision by
preparing a written acknowledgement. Appendix E, “Building
Evacuation Notice,” can be used as a liability release form to
document such a situation as needed.

In some jurisdictions, first responders may have an obligation to


direct an evacuation in situations where they can articulate a
credible threat and anticipate significant risk to citizens in the area
of a device or suspected device. Again, first responders should
know the policies and procedures of their departments and comply
with them explicitly. Violation of those policies and procedures
could leave first responders personally liable for the consequences
of an evacuation decision.

When a suspected explosive device has been identified, the


evacuation decision is more clear-cut than in situations involving
only a bomb threat. In fact, the presence of a suspected device
may create an obligation to evacuate the area. Again, local policies
and procedures apply.

The responsible individuals and first responders must weigh a


number of considerations when deciding whether and how to
evacuate. Some of these considerations include: shelter-in-place
options, time, distance, available shielding, and structural
surroundings. We will discuss these considerations on the following
slides.

January 2017 Version 01.2017 Page 6-42


Emergency Operations Sensitive
Incident Response to Terrorist Bombings
Training Support Package Participant Guide

Slide 6-21 Evacuation vs. Shelter-in-Place: Considerations

In some cases, the decision to evacuate can move people from a


location of relative safety to a far more dangerous location.
Criminals have been known to use bomb threats, fire alarms, or
other similar ruses to cause evacuation of building occupants to
exterior locations where they can be targeted more easily (see the
Westside Middle School example on the following slide).

At the same time, a decision not to evacuate can be costly. If


employees or students are directed to remain in place and a bomb
subsequently explodes, injuries and deaths may occur. Everyone
will second-guess the decision. Such losses can have significant
and long-standing impact on both public and private institutions.

There is no foolproof formula to determine whether evacuation or


shelter-in-place is the best option in a given scenario. Each
decision must be made through evaluation of the totality of
circumstances in that particular explosive threat situation. Some
important considerations include:

Time
In most cases, you cannot be one hundred percent certain about
the time of detonation. Even when a terrorist communicates the

January 2017 Version 01.2017 Page 6-43


Emergency Operations Sensitive
Incident Response to Terrorist Bombings
Training Support Package Participant Guide

information, it could be inaccurate (deliberately or accidentally).


Terrorists often lie to increase the potential success of their attack.
Fuses and other bomb components often do not function as
designed or intended. However, if you have information concerning
the time of detonation, you should consider it when making
evacuation decisions. For example, before deciding whether to
evacuate or shelter-in-place, the time required to evacuate a
building should be compared to the suspected time to detonation.
The shorter the period of time available for evacuation, the more
you must rely on structural protection to minimize injuries.

The key concept to remember is: The less time you are around the
device, the odds of survivability go up, while the longer you are
around the device, the odds of survivability go down.

Distance
When determining distance, first responders should always assume
the worst and figure that more distance is better.

Obviously, evacuation distances can be limited by the time


available. However, in the absence of identified time restrictions,
distances should be determined based on the size (and potential
destructive power) of the explosive and the availability of suitable
shielding. When estimating the potential destructive power of an
explosive device, always assume the worst case. Consider the size
of the container and assume that it contains the maximum amount
possible of the most powerful explosives.

Reminder: First responders should move the people away from the
bomb, not the bomb away from the people.

Shielding
For evacuation decisions, more shielding is always better. Greater
distances mean fewer injuries. As a rule of thumb, first responders
should evacuate citizens to a point where they cannot see the
device. When considering shielding, always use the largest and
densest structure you can find to place between you and the
device. A thin sheet of plywood or other objects where shrapnel
and fragmentation could pass through is not considered appropriate
shielding. Additional structural considerations related to shielding
will be discussed later in this module.

January 2017 Version 01.2017 Page 6-44


Emergency Operations Sensitive
Incident Response to Terrorist Bombings
Training Support Package Participant Guide

Safety of Evacuation Routes


First responders need to be alert to the possibility of multiple
devices or other types of weapons being used by terrorists along
evacuation routes. They should also consider whether the route
provides adequate shielding should the device detonate while
people are in process of evacuating. If the only evacuation path
would cross the area where the device is located, then sheltering in
place is probably a better option. Building structures can often
supply protection (shielding) unavailable to evacuees in the open
when an explosion occurs.

Safety of Evacuation and Shelter-in-Place Locations


In some cases, citizens are safer if they do not evacuate.
Obviously, those in the immediate vicinity of a suspected device
should evacuate regardless of circumstances. However, citizens in
other areas of a building or in other buildings might be safer inside
than on the streets outside.

When selecting an evacuation location, consideration should be


given to establishing and maintaining line-of-sight security. In all
cases, assembly or evacuation areas should be thoroughly
searched for suspicious items immediately before they are
occupied or as soon as possible after they are occupied.

If shelter-in-place is determined to be the best choice, individuals


should move as far away from the suspicious device as possible.
Seek shelter in areas where structural collapse is not likely, such as
under a stairwell. Sheltering in place must take into consideration
the location of glass windows and similar materials. Use whatever
shielding is available, like desks, file cabinets, or upholstered
furniture.

Needs of Population to be Evacuated


Shelter-in-place is often a safer option for difficult-to-evacuate
populations, such as those in hospitals, nursing homes, and
prisons. First responders should also consider whether and how the
population might handle the anxiety, discomfort, and potential
medical issues of an extended shelter-in-place scenario. Also
consider whether the location offers water, food, restrooms, or
other necessities that might be important if the render safe
operations take a long time or the group becomes trapped.

January 2017 Version 01.2017 Page 6-45


Emergency Operations Sensitive
Incident Response to Terrorist Bombings
Training Support Package Participant Guide

Slide 6-22 Example: Westside Middle School, Arkansas,


1998

This slide shows photos of the two perpetrators in the Westside


Middle School event: Mitchell Johnson and Andrew Golden. The
slide also shows Britthney Varner, Paige Ann Herring, Shannon
Wright, Stephanie Johnson, and Natalie Brooks, the five individuals
who lost their lives in this event.

An example of lessons learned regarding pre-search of evacuation


location is provided by the Westside Middle School event in
Jonesboro, Arkansas. On March 24, 1998, Mitchell Johnson, 13,
and Andrew Golden, 11, shot their classmates and teachers at
Westside Middle School in Jonesboro. Golden, the younger of the
two boys, asked to be excused from his class, pulled a fire alarm,
and then ran to join Johnson in a wooded area 100 yards away
from the school’s gym. As the students streamed out of the
building, Johnson and Golden opened fire and killed four students
and a teacher. Ten other children were wounded. On the night
before the shooting, Golden assisted Johnson in loading his
mother's Dodge Caravan with camping supplies, snack foods, nine
weapons (Remington 742 .30-06 rifle, Universal .30 M1 carbine
replica, Smith & Wesson .38 revolver, Double Deuce Buddie .22
two-shot derringer, FIE .380 pistol, Star .380 pistol, Ruger Security
Six .357 revolver, Davis Industries .38 two-shot derringer and a

January 2017 Version 01.2017 Page 6-46


Emergency Operations Sensitive
Incident Response to Terrorist Bombings
Training Support Package Participant Guide

Charter Arms.38 revolver),[4] which had been stolen from Golden's


grandfather's house, and 2,000 rounds of ammunition.

The two boys were caught soon afterward. In their possession were
thirteen fully loaded firearms, including three semi-automatic rifles,
and 200 rounds of ammunition. It is believed that the two boys
knew the routes of evacuation from previous fire drills.11

11
A School Shooting in Jonesboro, Arkansas, Kills Five. History.com. Retrieved from
http://www.history.com/this-day-in-history/a-school-shooting-in-jonesboro-arkansas-kills-five

January 2017 Version 01.2017 Page 6-47


Emergency Operations Sensitive
Incident Response to Terrorist Bombings
Training Support Package Participant Guide

Slide 6-23 Determining Evacuation Distances

January 2017 Version 01.2017 Page 6-48


Emergency Operations Sensitive
Incident Response to Terrorist Bombings
Training Support Package Participant Guide

Slide 6-24 Determining Evacuation Distances, Cont.

ELO 6-4
Utilize the Bomb Threat Stand-off Card to determine safe
evacuation distances for pre-detonation scenarios.

There are a variety of resources available allowing a first responder


to estimate the effects of an IED initiation, and then be able to use
that information to determine evacuations, evacuation routes, rally
locations, as well as personal protection issues associated with the
interdiction of an attack using an IED. These resources are
available from Homeland Security, FBI, the Technical Support
Working Group (TSWG), and have been consolidated into a single
Combined Bomb Threat Stand-off Card. The card is a valuable
incident response resource that is frequently referred to during this
course of instruction.

Determination of a safe evacuation distance for an explosive event


can vary dependent on many factors, including the presumed
amount of explosive, and/or the location of explosives both indoor
and outdoor. The Combined Bomb Threat Stand-off Card is based
on the maximum amount of explosive that could possibly be
contained in the items listed. Basically, this card lists the worst case
scenario for each type of bomb. It is an excellent resource in
determining your initial safe evacuation distance.

January 2017 Version 01.2017 Page 6-49


Emergency Operations Sensitive
Incident Response to Terrorist Bombings
Training Support Package Participant Guide

Your knowledge of the area and previous training, combined with


what you have learned in this course, will assist you in augmenting
your decision process on the best evacuation plan for the
circumstances of your specific incident.

The following is the information contained in the Bomb Threat


Stand-off Card:

The far left column provides a visual representation of the type of


IED threat, ranging from a pipe bomb up to a semi-tractor trailer
VBIED.

Two of the IED threats have application in the area of worn or


carried IEDs, the remaining IEDs are vehicle borne. Note that
although this chart does not list backpack bombs, a briefcase
carries approximately the same amount of explosives and can be
used to calculate distances for a backpack bomb threat.

The first column titled Threat Description provides the common


name of the IED, and corresponds to the visual representation in
the first column.

The second column titled Explosive Capacity lists the explosive


capacity of each threat, equivalent to the amount of TNT. The TNT
equivalency is the recognized standard by which all energetic
materials are compared.

The third column titled Mandatory Evacuation Distance provides a


distance where all personnel must evacuate both inside of buildings
and out. This distance represents an area where buildings could
potentially become structurally unsound as the result of a high
explosive detonation.

The forth column titled Shelter-in Place Zone provides evacuation


distances where someone can seek shelter immediately inside a
building away from windows and exterior walls. Avoid having
anyone outside, including those evacuating in the area.

The fifth column titled Preferred Evacuation Distance is the


preferred area beyond this line for evacuation of people in buildings
and mandatory for people outdoors.

January 2017 Version 01.2017 Page 6-50


Emergency Operations Sensitive
Incident Response to Terrorist Bombings
Training Support Package Participant Guide

The DHS Science & Technology Directorate and OBP worked in


collaboration with the private sector to develop the First Responder
Support Tools (FIRST) application for first responders’ smart
phones and laptop computers. The application allows first
responders to quickly define safe stand-off distances around a
potential bomb location, calculate rough damage and injury
contours, suggest appropriate roadblocks, and identify other nearby
facilities of concern (e.g. schools, hospitals, and care centers).

DHS bomb stand-off data is considered sensitive and is only made


available to those that register the application using a .gov, .mil, or
.us email address. For additional information on downloading the
application, please visit: http://www.dhs.gov/science-and-
technology/bomb-threat-app-too.

January 2017 Version 01.2017 Page 6-51


Emergency Operations Sensitive
Incident Response to Terrorist Bombings
Training Support Package Participant Guide

Slide 6-25 Activity: Evacuation Distances

This slide shows two photos to illustrate the scenarios for the
evacuation distances activity.

Use the Bomb Threat Stand-off Card to answer the following


questions:

Scenario 1: Pipe bomb inside a store front business on a busy


street
a. What is the mandatory evacuation distance?
b. What is the explosive capacity of a pipe bomb?

Scenario 2: VBIED (Vehicle Borne Improvised Explosive Device)


passenger van in front of the Albuquerque International Airport
c. What is the shelter-in-place zone?
d. What is the preferred evacuation distance?
e. What might be the structural damage if the van was
placed in the underpass at the Airport or in the parking
garage?
f. What other issues should be considered at this location
(air traffic control, de-embarking of airplanes with
passengers, jet fuel storage tanks and other hazards)?

January 2017 Version 01.2017 Page 6-52


Emergency Operations Sensitive
Incident Response to Terrorist Bombings
Training Support Package Participant Guide

Slide 6-26 Video: Shielding Behind Vehicles

This slide contains a video showing how fragmentation and


shrapnel can pierce a van being used as a shield. This detonation
consisted of 3 lbs. of C-4 with added shrapnel, which was 3 ft. off
the ground and 15 ft. away from the vehicle.

Vehicles are often present at a bomb scene and can provide some
shielding, after a quick non-invasive scan for multiple devices or
other hazards. However, this video depicts fragmentation and
shrapnel piercing a van, providing an example of the level of
protection (or non-protection) a vehicle can provide.

Vehicles furnish some shielding from explosions. Responders


should find the largest and most substantial vehicle to provide
shielding, such as a fire truck. They should take advantage of the
vehicle’s wheels and tires. In other words, do not stand at a location
near the vehicle where there is no structural protection for feet and
lower legs.

January 2017 Version 01.2017 Page 6-53


Emergency Operations Sensitive
Incident Response to Terrorist Bombings
Training Support Package Participant Guide

Slide 6-27 If you can see the BOMB, the BOMB can see
YOU!

This slide contains a video of a camera being struck by a piece of


fragmentation off of an IED detonation. The camera was set up
1,000 feet from a prone suicide bomber test shot containing four
pounds of Composition C-4 and added shrapnel.

Generally speaking, the more shielding available, the better the


protection. Keep in mind, however, that all materials do not provide
the same level of protection. A wall constructed of plywood will offer
less protection than a wall of cinder blocks. Reinforced concrete
supplies greater protection than non-reinforced materials.

Keep in mind that the minimum evacuation distances


recommended by BATFE often cannot be met. In those situations,
responders will be forced to rely on structural shielding to
supplement the protection afforded by distance. Distance and
shielding are not synonymous and shielding does not protect from
many of the effects of a blast.

January 2017 Version 01.2017 Page 6-54


Emergency Operations Sensitive
Incident Response to Terrorist Bombings
Training Support Package Participant Guide

 Shrapnel can travel at speeds up to 3,000 feet per second,


faster than a round from a sniper rifle. For comparison, the
speed of sound is 343.2 meters per second (1,126 ft/s).12
 The distance shrapnel can travel is only limited to the type
and size of the explosive device of which the shrapnel is a
component. Utilize the Bomb Evacuation Stand-off Card to
establish safe evacuation and shelter-in-place distances for
various explosive devices.
 Shrapnel is used to increase the amount of projectiles
emitted from an explosive device with the intent of causing
more damage, injuries, and deaths.

12
Smith, J. (2009). A Law Enforcement and Security Officers’ Guide to Responding to Bomb Threats. Charles C
Thomas Publisher.

January 2017 Version 01.2017 Page 6-55


Emergency Operations Sensitive
Incident Response to Terrorist Bombings
Training Support Package Participant Guide

Slide 6-28 Glazing & Construction Material Test: Pre-blast


and Post-blast

This slide depicts a building prior to and following a blast as an


example of the damage done to glass and other construction
materials.

Numerous tests have been conducted to assess the effects of the


blast-pressure wave on different kinds of glass. This slide depicts
the effects of 5,147 pounds of composition C-4 placed 656 feet
from a building. Forty-two windows of different types and
thicknesses were placed in the building for the test. The photo on
the left shows the building as it looked prior to the test. Notice the
color-coded window glass on the various floors of the building.

The photo on the right shows the building as it looked after the
detonation. Notice how some glass was blown into rooms during
the positive pressure phase. Notice, however, that there is also
glass on the ground in front of the building. This glass was pulled
out of the building during the negative pressure phase. A number of
calculations were done during this test—one involved the velocity of
the shock front, which was calculated at 1,405 feet per second.
Glass was measured flying from the window at up to 37 feet per
second.

January 2017 Version 01.2017 Page 6-56


Emergency Operations Sensitive
Incident Response to Terrorist Bombings
Training Support Package Participant Guide

This data illustrates how important it is for first responders to


make evacuation decisions while evaluating the glass hazards
in the area near the potential explosive and in the possible
evacuation locations and routes.

January 2017 Version 01.2017 Page 6-57


Emergency Operations Sensitive
Incident Response to Terrorist Bombings
Training Support Package Participant Guide

Slide 6-29 Glass Hazard Window Video

This slide contains a slow-motion video showing how glass shatters


in an explosion; a 90-pound piece of glass hits the camera.

Standard glass will shatter into thousands of small shards from the
impact of a blast pressure wave. In this video, the laminated glass
is 7.5 mm thick, of a special composition designed to withstand the
shatter effect. Obviously, glass windows pose a significant potential
hazard to people within a room.

January 2017 Version 01.2017 Page 6-58


Emergency Operations Sensitive
Incident Response to Terrorist Bombings
Training Support Package Participant Guide

Slide 6-30 Window Shard Hazard Zones

This slide shows a graphic depicting the three safety zones for
falling glass.

Common sense would dictate that people move as far away from a
window as possible. However, in a confined space, the ability to
shield behind a wall may not be an option. Furthermore, an attempt
to back up to wall opposite a window to create distance might be
even more deadly, as the wall is likely to sustain the most effects of
an explosion as glass shards and pieces of the window are
propelled into a building’s interior area. The safest place to be is
called the “Break Safe” area, which is 0-3 feet from the window and
on the floor. Although common sense would suggest that people be
moved as far away from windows as possible, that clearly is not the
case in situations where a wall is likely to withstand the effects of
an explosion, but window glass is likely to be propelled into a
building’s interior areas.

The videos you just watched were part of tests to reveal the safest
areas to stand in relation to windows during explosive blasts. The
test results revealed three window-shard-hazard zones: high
hazard, low hazard, and break safe.

January 2017 Version 01.2017 Page 6-59


Emergency Operations Sensitive
Incident Response to Terrorist Bombings
Training Support Package Participant Guide

1. High hazard zones are located on back walls above three


feet in height. In these areas, glass shards are likely to be
lethal.

2. Low hazard zones include areas where glass shards impact


from three to nine feet behind the window, landing either on
the floor or up to three feet high on the back wall. These
have the potential to cause serious injury.

3. Break-safe zones are where glass simply breaks, with


shards impacting from zero to three feet behind the window
on the floor, thereby causing far less potential for injury.

January 2017 Version 01.2017 Page 6-60


Emergency Operations Sensitive
Incident Response to Terrorist Bombings
Training Support Package Participant Guide

SEARCH DECISION

Slide 6-31 Search Considerations

This slide lists search considerations.

ELO 6-5
Determine effective procedures for conducting a search.

Most agency executives would prefer to avoid involving their


personnel in searches. However, all first responders at a bomb
threat scene should be prepared and trained to assist in a search in
unusual circumstances, including an extended search area or the
high likelihood of locating a device.

Bomb technicians do not normally participate in searches. Their


involvement in an incident typically begins when a suspicious
item—one that could contain explosives—is discovered.

In most cases, supervisors and employees at a bomb threat


location are the best candidates for conducting searches for
suspicious items. The reason is quite simple-people who work in an
area are probably better able than outsiders, to identify things that

January 2017 Version 01.2017 Page 6-61


Emergency Operations Sensitive
Incident Response to Terrorist Bombings
Training Support Package Participant Guide

are out of place. Because they know what is normal, they are more
likely to detect something that is abnormal.

Likewise, they are probably better able to discount items that would
appear suspicious to an outsider, as not suspicious. Consider, for
example, the presence of two briefcases in an office. A first
responder might assume that the presence of more than one
briefcase is suspicious. However, an employee might recognize
both briefcases as belonging to the individual assigned to the office.

In-house security, maintenance, and janitorial personnel should be


used to search such areas as hallways, restrooms, stairwells,
elevator shafts, utility closets, and areas outside the structure. In-
house personnel should check their immediate work areas to
determine if any object is noted that was not placed there by the
employee, or a package was brought in by the employee without
knowing its content, or a document or package was delivered to the
employee by someone the employee cannot readily identify.

A method to identify cleared areas rapidly should be utilized, such


as chalk, tape, or sign. Verbal (not via radio or cellular telephone)
reports should be forwarded to the incident commander. A
sign/marker indicating, search complete, nothing found should be
posted, including the completion time and date.

What about situations where employees refuse to stay in a


threatened facility or refuse to reenter to participate in a search?
Situations of this kind are extremely difficult to resolve because
business owners or senior managers in government agencies may
request support from law enforcement or other emergency
responders when employees make themselves unavailable for a
search. Local departments should have policies governing
response in situations of this kind.

Explosive detection canine teams are often used to search facilities


for explosives and explosive devices. Explosive detection canines
can play an important role in search operations. However, they are
somewhat limited in their capabilities and do not provide total
assurance that materials or devices will be located when present.
First, dogs, like humans, can concentrate on their task for limited
periods of time. Therefore, the area that one dog can search is
limited. The dog’s handler should be able to estimate how long the
dog will work and how much area the dog can cover.

January 2017 Version 01.2017 Page 6-62


Emergency Operations Sensitive
Incident Response to Terrorist Bombings
Training Support Package Participant Guide

In addition, the presence of materials such as food items or


ammunition can mask the scent of an explosive or distract the dog
from concentrating on the search task. Therefore, explosive
detection canine handlers are not likely to state that a facility is all
clear of explosives. Rather, they are likely to report that the dog did
not alert during the search. There are subtle and important
differences between the two statements, particularly when incident
commanders have to make a decision to release a crime scene to
the owner.

Remember that, if a suspicious object is located, personnel


involved in the search effort should never touch, move, or jar the
object, or make loud noises in the area surrounding the object.
Confirm that cellular telephones and other electronic transmission
equipment are in the off mode.

Remember: responders should move individuals away from the


suspicious object—never move the object. Notify bomb technicians.
If possible, and as time and safety considerations permit, open
windows and doors to minimize potential blast damage.

The best way to conduct a search will vary depending on the


location, the threat, and many other variables. However, some
basic principles always apply:

 Use a search party


 Search areas with public access first
 Listen for any unusual noises, such as ticking sounds
 Divide room into equal parts
 Determine height search starting from the floor up
 Look for anything out of place or unusual and rely on the
training from this course to identify bomb making material
 Be aware that moving any object could set off or activate a
device

The BATFE has put together a chart13 describing advantages,


disadvantages, and the level of thoroughness for three different
systems of searching a bomb threat location. This chart can be
found in your Participant Resources.

13
Bureau of Alcohol, Tobacco and Firearms United States of America. (1976). Bomb Threats and Search
Techniques [Abstract]. National Criminal Justice Reference Service. Abstract retrieved from
https://www.ncjrs.gov/App/Publications/abstract.aspx?ID=60899

January 2017 Version 01.2017 Page 6-63


Emergency Operations Sensitive
Incident Response to Terrorist Bombings
Training Support Package Participant Guide

Slide 6-32 Search Decision: Flow Chart

This slide shows a logic tree that illustrates the thought and reaction
processes that first responders will go through when the decision
has been made to search a location.

Identify Need to Search Facility


Identifying the need to search a facility can be very simplistic or
complex, based on totality of the circumstances and validity of the
bomb threat. The search decision often initiates at the request of
the responsible party or the incident commander. The responsible
party could be anyone from the business owner/manager to a
school principle who is responsible for the everyday operation of
the facility.

Note: Some municipalities mandate by order of the city manager


that any city building receiving a threat shall be evacuated and
searched. As a first responder you should make yourself aware of
the specific procedures in your jurisdiction involving bomb threats.

Conduct Search
Once the need to search a facility has been identified, the first
decision is to determine who will conduct the search. There are
three divisions or groups of possible searchers:

January 2017 Version 01.2017 Page 6-64


Emergency Operations Sensitive
Incident Response to Terrorist Bombings
Training Support Package Participant Guide

 Facility personnel or teams


 First responders assisting facility personnel or teams
 Only first responders

Facility personnel or teams have the best ability to recognize


something that is out of the ordinary because of their familiarity with
the area. Their participation makes the search process less time-
consuming and more efficient. All persons conducting or
participating in any search should be instructed not to touch
anything that looks out of the ordinary, avoid the item(s), and notify
experts immediately.

A combination of first responders working with facility personnel will


add a degree of safety to the search process, especially if
something suspicious is located. However, the small numbers of
responders at a given scene often make it impractical to facilitate a
rapid and competent search.

Having first responders only conduct the search is the least


desirable search arrangement, because of the difficulty first
responders may have in determining if something is out of the
ordinary. Once again, the reduced number of available responders
often makes it nearly impossible to quickly and thoroughly search a
location.

Suspicious Item Located / Evacuate


If during a search something is deemed to be suspicious or out of
the ordinary, all personnel and first responders should immediately
evacuate away from the item and all other search teams should be
recalled. Normally a signal to recall search teams is a
predetermined sequence of siren or air horn blasts.

Bomb Technicians Called


As we have discussed previously, devices can be detonated
through various methods therefore, it is important not to utilize a
two-way radio, activate fire alarm, or touch or move a suspicious
package.

Bomb Technicians Validate Suspicious Item


Only the bomb squad should evaluate or validate a potential threat.
If the item is determined not to be a hazard or threat, or associated
with a crime, the remainder of the facility will be searched. If the
item turns out to be a threat, hazard, or even a hoax device, the

January 2017 Version 01.2017 Page 6-65


Emergency Operations Sensitive
Incident Response to Terrorist Bombings
Training Support Package Participant Guide

facility will be searched by the bomb squad or the resources that


they have at their disposal. The bomb squad will now be in charge
of the scene.

First responders will evacuate occupants to a minimum of one


thousand feet from the facility. Keep in mind that all occupants may
need to be interviewed as part of the criminal investigation.

January 2017 Version 01.2017 Page 6-66


Emergency Operations Sensitive
Incident Response to Terrorist Bombings
Training Support Package Participant Guide

Slide 6-33 Search Safety: Radio Frequency Hazards

This slide provides information associated with radio use.

As always, first responders should follow their own


agency/department’s policies on the use of radios during bomb-
related incidents. As discussed in Module 3, the National Bomb
Squad Commanders Advisory Board (NBSCAB) endorses a
position statement on the use of radios by first responders. The
information is also part of the DHS National Strategy for Improvised
Explosive Devices.14

Unfortunately, most IEDs in the U.S. do not contain commercial


blasting caps, but rather use improvised initiation methods such as
light bulbs or high resistance wires, which may be more sensitive or
less sensitive than commercial blasting caps. Additionally, IEDs
today have the possibility of containing electromagnetic switches
that can be far more sensitive to RF than commercial blasting caps.

Based on these factors, the use of radios in bombing response


situations becomes a subjective matter involving the balancing of
risk and benefit. The benefit to having a radio on and in the
receiving (listen) mode may outweigh the risks that arise from not

14
National Incident Management System, (2004). U.S. Department of Homeland Security.

January 2017 Version 01.2017 Page 6-67


Emergency Operations Sensitive
Incident Response to Terrorist Bombings
Training Support Package Participant Guide

having communications at all with personnel searching a building


following a bomb threat. Some incidents have been reported, for
example, of finding a suspect package in one part of a building and
not being able to alert an officer assisting with the search in another
part of the building.

If a specific suspect package is identified, it is certainly advisable


not to transmit from a position near the package. At the point of
identifying any suspect item, an evacuation should begin, working
from the package outward, and a notification to contact the bomb
squad should take place. Any use of hand held radios (usually 5
watts or less) in the transmit mode for this purpose should be done
with consideration being given to placing as much distance as
possible and shielding as many strong barriers (sheetrock walls
may not provide much protection from blast and fragmentation)
between the suspect device and the responder using the radio.
First responder vehicles have transmitters that put out 100 watts or
more, and need to have even more distance from the suspect item
for safe transmissions.

January 2017 Version 01.2017 Page 6-68


Emergency Operations Sensitive
Incident Response to Terrorist Bombings
Training Support Package Participant Guide

BOMB TECH RESPONSE DECISION

Slide 6-34 Supporting the Bomb Squad

This slide shows a photo of a bomb robot as it inspects the


underside of a patrol car after a bomb threat in Los Angeles, CA on
December 18, 2012.

There are two priorities during render safe operations: (1) safety
and (2) preservation of evidence. During render safe operations,
the first responders on scene will be responsible for scene security,
ensuring that the units working inside the perimeter are safe. An
efficient and secured perimeter accomplishes both objectives of
safety and evidence preservation.

Only trained bomb technicians should conduct render safe


operations. Normally, render safe is conducted in a controlled
environment. However, in special situations, render safe may have
to be conducted under hostile conditions with terrorists still in the
area and active. Emergency response agencies responsible for
render safe operations should prepare contingency plans for
conducting operations in an active threat situation. Such plans
should include providing over watch protection in order to neutralize
any threat against render safe activities. Experience in these

January 2017 Version 01.2017 Page 6-69


Emergency Operations Sensitive
Incident Response to Terrorist Bombings
Training Support Package Participant Guide

situations suggests that bomb technicians should also be


particularly observant for signs of booby traps and other devices.

January 2017 Version 01.2017 Page 6-70


Emergency Operations Sensitive
Incident Response to Terrorist Bombings
Training Support Package Participant Guide

EVIDENCE COLLECTION

Slide 6-35 Identify and Safeguard Evidence

This slide lists important points for identifying and collecting


evidence.

All responders at the scene of a pre-detonation incident are


responsible for identifying and preserving evidence. Law
enforcement agencies generally are responsible for collecting and
safeguarding evidence; however, there may be cases where the
absence of a law enforcement officer makes it imperative that
firefighters or emergency medical technicians act to ensure that
critical evidence is not lost or destroyed. It may be necessary for
first responders to become involved in identifying and collecting
evidence, no matter what discipline they work in. Observation and
cooperation among disciplines and agencies will assist in
prosecution. Chain of custody requirements must be satisfied.

Information from the person who received the bomb threat is


invaluable. Similarly, if an explosive device is found, it is important
to identify any person who might have knowledge of how it might
have been delivered.

January 2017 Version 01.2017 Page 6-71


Emergency Operations Sensitive
Incident Response to Terrorist Bombings
Training Support Package Participant Guide

It is critical that evidence be collected from pre-detonation crime


scenes. Evidence is essential in the identification of terrorists.
Successful investigations and prosecutions can discourage future
bomb threats.

It is important that original copies of any items associated with the


event be collected, including completed Bomb Threat Checklists,
recordings, and written threat documents. Any other items that can
be used to document the event should also be collected and
processed as evidence.

A hot wash or debriefing should be conducted with all responding


personnel before their departure from the scene, to identify and
capture anything of evidentiary matter.

January 2017 Version 01.2017 Page 6-72


Emergency Operations Sensitive
Incident Response to Terrorist Bombings
Training Support Package Participant Guide

RESUME STEADY STATE

Slide 6-36 Resuming Steady State

This slide lists some of the criteria that first responders will evaluate
before reoccupying a location after a bomb threat. This slide also
contains an image of evacuated office workers at Adventist Health
Roseville in California after a bomb threat.

Steady State is defined as returning to activities during normal


operation. This is one of those areas where department policies
might differ. As stated earlier, ultimately the rules or policy from the
first responder's jurisdiction should govern reoccupation actions.
The all clear determination is a difficult decision. It is impossible to
be 100% sure that a location is safe to reoccupy. Even after a
thorough facility search, questions can still remain:
• Is there no explosive device or did we just not find it?
• Is it certain that it was a hoax or false alarm?
• If a device is found, are there multiple devices?

Any decision to declare an area clear of an explosive device must


be based on the total information available and made by the
incident commander. The decision to reoccupy must also be in

January 2017 Version 01.2017 Page 6-73


Emergency Operations Sensitive
Incident Response to Terrorist Bombings
Training Support Package Participant Guide

accordance with the responders’ departmental policies and


procedures.

January 2017 Version 01.2017 Page 6-74


Emergency Operations Sensitive
Incident Response to Terrorist Bombings
Training Support Package Participant Guide

PRE-DETONATION ACTIONS REVIEW

Slide 6-37 Pre-Detonation Actions Review

This slide contains a visual representation summary of the pre-


detonation actions.

On May 10, 2010, an attempted car bombing in Times Square, New


York City’s busy tourist destination, was discovered and stopped.
The details of this event form an excellent case study for first
responders in how to deal with pre-detonation events, especially in
an urban setting. We will review each of the pre-detonation actions
as they occurred in the Times Square bombing attempt.

January 2017 Version 01.2017 Page 6-75


Emergency Operations Sensitive
Incident Response to Terrorist Bombings
Training Support Package Participant Guide

CASE STUDY: TIMES SQUARE BOMBING ATTEMPT

Slide 6-38 Times Square Case Study: Suspicious Vehicle


Found

This slide contains a traffic camera picture of the dark blue Nissan
Pathfinder as it pulls into Times Square.

Timeline of events on Saturday, May 1, 201015

6:28 PM - The suspect's vehicle, a dark blue 1993 Nissan


Pathfinder Sports Utility Vehicle (SUV) with dark tinted windows,
entered Times Square on Saturday evening, May 1, 2010.

6:30 PM - Two minutes later, two street vendors, a T-shirt seller


and handbag seller notice smoke drifting from vents near the back
seat of the unoccupied, haphazardly-parked vehicle. They also
described what they thought were firecrackers going off inside
vehicle. The vehicle had been parked with its engine running and
its hazard lights on, on a tourist-crowded block at the intersection of
West 45th Street and7th Avenue, near Broadway and the entrance
to the Minskoff Theatre, which was showing a musical at the time of

15
Criminal Complaint: United States of America V. Faisal Shazad, (2010). United States District Court for the
Southern District of New York.

January 2017 Version 01.2017 Page 6-76


Emergency Operations Sensitive
Incident Response to Terrorist Bombings
Training Support Package Participant Guide

the attempted bombing. The street vendors brought the suspicious


vehicle to the attention of a mounted policeman.

January 2017 Version 01.2017 Page 6-77


Emergency Operations Sensitive
Incident Response to Terrorist Bombings
Training Support Package Participant Guide

Slide 6-39 Times Square Case Study: Incident Map

This slide shows an aerial view of Times Square in New York City.

Let’s consider the location and circumstances of this threat. The car
bomb was first spotted on May 1, 2010, on the corner of 45 th Street
and 7th Avenue. It was early evening between the matinee and
evening shows in the Times Square Theater District, and there
were a large number of pedestrians present. Because tourists from
around the world visit Times Square, it was a multi-national crowd.

January 2017 Version 01.2017 Page 6-78


Emergency Operations Sensitive
Incident Response to Terrorist Bombings
Training Support Package Participant Guide

Slide 6-40 Times Square Case Study: Incident Validation

This slide shows a picture of New York Police Department (NYPD)


mounted police officer Wayne Rhatigan.

6:33 PM – Horse mounted Officer Wayne Rhatigan a 19-year


veteran of the NYPD circled the SUV on horseback. He observed
smoke emanating from the Pathfinder and smelled gunpowder. He
immediately called for backup and the fire department. He grabbed
two officers and began moving people away from the smoking
Pathfinder.

Fire Department City of New York (FDNY) arrived and ascertained


that it was more than a vehicle fire because of the white smoke,
sparks and crackling noise coming from the vehicle. The NYPD
Emergency Services Unit was called and it was determined by
FDNY and NYPD that the bomb disposal unit should be called for a
possible bomb.

January 2017 Version 01.2017 Page 6-79


Emergency Operations Sensitive
Incident Response to Terrorist Bombings
Training Support Package Participant Guide

Slide 6-41 Times Square Case Study: Evacuation Decision

This slide shows a map showing the evacuation perimeters


established during the incident.

The following paragraphs summarize what happened after first


responders realized the car was a threat:

The car bomb was first spotted in the early evening of May 1, 2010,
on the corner of 45th Street and 7th Avenue.

6:36 PM – Police hurriedly evacuated thousands of tourists and


theatre-goers. Times Square, normally bustling with tourists on a
warm evening, would be shut down for approximately 10 hours.
Heavily armed police and FBI agents were deployed on the empty
streets as bomb disposal experts used a robot to break the
windows on the vehicle and remove explosive material.

January 2017 Version 01.2017 Page 6-80


Emergency Operations Sensitive
Incident Response to Terrorist Bombings
Training Support Package Participant Guide

Slide 6-42 Times Square Case Study: Search Decision /


Bomb Tech Response

This slide shows pictures of bomb technicians dismantling the


vehicle device.

6:36 PM – 11:30 PM – The New York Police Department bomb


squad was called in and went to work dismantling the device,
defusing it by 11:30 p.m. The bomb had been ignited, but failed to
explode and was disarmed before it caused any casualties.

SUNDAY, May 2

2:20 a.m. Mayor Michael Bloomberg and Police Commissioner


Raymond Kelly hold news conference two blocks from where the
SUV was discovered to announce that a potentially lethal bomb
was found in the vehicle. This is an example of the success of the
“see something, say something” campaign to help ordinary citizens
recognize potential threats and take action.

3:00 a.m. Guests of the Marriott Hotel in rooms facing West 45th
Street are allowed to return to their rooms after being evacuated
hours earlier.

January 2017 Version 01.2017 Page 6-81


Emergency Operations Sensitive
Incident Response to Terrorist Bombings
Training Support Package Participant Guide

7:30 a.m. All streets reopened to pedestrian and vehicular traffic.16

16
Criminal Complaint: United States of America V. Faisal Shazad, (2010). United States District Court for the
Southern District of New York.

January 2017 Version 01.2017 Page 6-82


Emergency Operations Sensitive
Incident Response to Terrorist Bombings
Training Support Package Participant Guide

Slide 6-43 Times Square Case Study: Bomb Tech Response


& Evidence Collection

This slide contains an illustration of the contents of the Nissan


Pathfinder used as a car bomb in Times Square.

The Nissan Pathfinder contained the following materials,


haphazardly arranged into a crude attempt at a bomb:
 2 clocks on the floor behind the driver’s seat
 2 five-gallon cans of gasoline
 More than 40 “M-88” brand fireworks inside a 20 oz. soda
can, wrapped in duct tape, with the end removed
 3 20-gallon propane tanks
 More M-88s in a metal container
 Green metal gun locker (55” x 32”) hidden inside a
cardboard box, which contained:
o 8 grocery store bags packed with 250 lbs. of urea
based fertilizer
o A pressure cooker filled with 120 M-88 firecrackers
and a tangle of wires
 Various electrical wires connecting the other components17

17
Criminal Complaint: United States of America V. Faisal Shahzad, (2010). United States District Court for the
Southern District of New York.

January 2017 Version 01.2017 Page 6-83


Emergency Operations Sensitive
Incident Response to Terrorist Bombings
Training Support Package Participant Guide

Slide 6-44 Times Square Case Study: Evidence Collection

This slide shows a map of Times Square with a dashed line


illustrating the established evacuation perimeters.

Maintaining perimeters at the scene of an explosion or bombing


plays a vital role in preserving evidence that may identify, charge,
and convict individuals engaged in terrorist activities. It is essential
that all evidence be collected in a professional manner to increase
the likelihood it will yield evidence useful during laboratory analysis.
One of the best ways to ensure evidence obtained is of the highest
quality and utility is to follow sound protocols in all investigations.

When the homemade bomb failed to detonate in Times Square, the


exterior was dusted for prints, the interior searched, and a wealth of
evidence resulted for investigators. Those elements included
fingerprints, hair, and skin. Bombs are typically built to destroy the
evidence as they explode, so this incident was a good opportunity
for forensic experts to learn about the bomb and suspect. Further,
the Nissan Pathfinder’s vehicle identification number led
investigators to the registered owner who sold the car for cash in
Bridgeport, Connecticut. Of equal importance, each component of
the intact bomb offered information about the suspect, the intended
design of the bomb and the origins of the components.

January 2017 Version 01.2017 Page 6-84


Emergency Operations Sensitive
Incident Response to Terrorist Bombings
Training Support Package Participant Guide

Slide 6-45 Times Square Case Study: Investigation

This slide lists some of the facts in the investigation of the Times
Square Bombing incident.

FACTS:
 The vehicle (Pathfinder) was abandoned at the scene and left
running with keys in the ignition and hazard lights flashing.
 The public VIN plate was removed from the Nissan’s dashboard
but not removed from engine compartment. License plates from
a junkyard car had been put on the Pathfinder.
 The engine compartment VIN led investigators to a woman in
Bridgeport, CT, who had sold the Pathfinder for cash
approximately three weeks prior to bombing attempt. She said
the man had purchased the car in a supermarket parking lot
without paperwork or receipts, had explained that a bill of sale
was unnecessary, and had seemed uninterested in the vehicle’s
condition or long-term prospects.
 The seller of the car provided the phone number from which the
buyer had contacted her. That led investigators to a prepaid
phone activated April 16, which had also received four phone
calls from a Pakistani number in the hour before he made the
final calls to arrange the purchase of the vehicle. The prepaid
phone had also made a call to a rural Pennsylvania fireworks

January 2017 Version 01.2017 Page 6-85


Emergency Operations Sensitive
Incident Response to Terrorist Bombings
Training Support Package Participant Guide

store that sold M-88 fireworks, the type that were located in the
Pathfinder.
 A sketch artist worked with the seller of the car to develop a
sketch of the suspect. That sketch and other information led to
the selection of photographs of six men. From that photographic
lineup, the seller of the car identified Faisal Shahzad as the
buyer.
 Verizon Wireless phone records also established that Mr.
Shahzad was the buyer of the Pathfinder.
 On Monday, May 3, FBI agents spoke to Shahzad’s landlord in
Bridgeport, CT and began surveillance of Shahzad. It was
confirmed that one of the keys left in the Pathfinder unlocked
Shahzad’s apartment.18

18
Criminal Complaint: United States of America V. Faisal Shahzad, (2010). United States District Court for the
Southern District of New York.

January 2017 Version 01.2017 Page 6-86


Emergency Operations Sensitive
Incident Response to Terrorist Bombings
Training Support Package Participant Guide

Slide 6-46 Times Square Case Study: Apprehension

This slide contains a photo of the Emirates Airlines plane from


which Faisal Shahzad was apprehended.

 Two days after the event, federal agents arrested Faisal


Shahzad, a 30-year-old Pakistan-born resident of Bridgeport,
Connecticut, who had become a U.S. citizen in April 2009. He
was arrested at John F. Kennedy Airport after he boarded an
Emirates Airlines flight headed to Dubai. Shahzad admitted to
attempting the car bombing and said he had trained at a
Pakistani terrorist training camp.
 Faisal Shahzad almost made it out of the country. Two hours
after his passport number had been added to the No-Fly List,
Mr. Shahzad called Emirates Airlines and booked his ticket. An
hour later, he arrived at the airport, paid for the ticket with cash,
and boarded the aircraft.
 On May 3rd, FBI agents discovered Shahzad's Isuzu Trooper
parked in a short-term parking lot at JFK airport. Upon making
this discovery, they began searching for his name on airline
passenger manifests.
 Shahzad was placed on the expedited No-Fly List at 12:30 p.m.
Monday (May 3), but was able to buy a one-way ticket to
Pakistan shortly after 7:30 p.m., a little more than four hours
before the flight was scheduled to leave.

January 2017 Version 01.2017 Page 6-87


Emergency Operations Sensitive
Incident Response to Terrorist Bombings
Training Support Package Participant Guide

 Although Shahzad was added to the No-Fly List earlier that


day, Emirates ground staff failed to double-check the updated
list and ignored an electronic message that stated an important
new name had been added. Thus, he bought his ticket that day
in cash and boarded the plane without incident until the airline
sent its final passenger list to Customs and Border Protection,
which flagged his name and acted quickly to re-board the plane
and arrest him.
 In the Shahzad case, the airline seemingly didn't check the
name, and the suspect was allowed to purchase a ticket and
obtain a boarding pass. Under the new measure, the airline
would be required to re-check the list within two hours of being
notified of a special circumstance expedited no-fly name.
 Emirates Airline stated that they did check the list hours before
the flight, but, because Shahzad had not yet bought his ticket,
his name was not on the manifest. The government has
challenged parts of the airline's account.
 The flight had begun to taxi for takeoff when FBI agents ordered
it to return to the gate where Shahzad was taken into custody.
 It was 53 hours and 20 minutes from the time of the incident to
the time of his arrest.19

Additional Information: No Fly List


The No Fly List is a list, created and maintained by the U.S.
government's Terrorist Screening Center (TSC), of people who are
not permitted to board a commercial aircraft for travel in or out of
the U.S. The number of people on the list rises and falls according
to threat and intelligence reporting.

The No Fly List is different from the Terrorist / Traveler Watch


List, a much longer list of people suspected of some involvement
with terrorism. Within the federal community, there is general
agreement that the watch list has helped to combat terrorism by
providing screening and law enforcement agencies with information
to help them respond appropriately during encounters. It has also
helped law enforcement and the intelligence community track
individuals on the watch list and collect information about them for
use in conducting investigations and in assessing threats. When an
individual makes an airline reservation, arrives at a U.S. port of
entry, applies for a U.S. visa, or is stopped by state or local police
within the United States, the frontline screening agency or airline

19
Criminal Complaint: United States of America V. Faisal Shahzad, (2010). United States District Court for the
Southern District of New York.

January 2017 Version 01.2017 Page 6-88


Emergency Operations Sensitive
Incident Response to Terrorist Bombings
Training Support Package Participant Guide

conducts a name-based search of the individual against applicable


terrorist watch list records. In general, when the computerized
name-matching system of an airline or screening agency generates
a “hit” (a potential name match) against a watch list record, the
airline or agency is to review each potential match. Any obvious
mismatches (negative matches) are to be resolved by the airline or
agency if possible. However, clearly positive or exact matches and
matches that are inconclusive (difficult to verify) generally are to be
referred to TSC to confirm whether the individual is a match to the
watch list record. TSC is to refer positive and inconclusive matches
to the FBI to provide an opportunity for a counterterrorism
response.

The government is now requiring airlines to check no-fly lists within


two hours of being notified of list updates — a move aimed at
preventing known terror suspects from boarding airplanes — as the
man accused in the Times Square bombing attempt did. When
updates are made to the no-fly list, notifications are sent to airlines
instructing them to check the updated list. Previously, airlines were
required to check for updated lists every 24 hours. Currently,
airlines have to check the updated list within two hours of being
notified of changes.

January 2017 Version 01.2017 Page 6-89


Emergency Operations Sensitive
Incident Response to Terrorist Bombings
Training Support Package Participant Guide

Slide 6-47 Key Learning Point 1: Pre-attack Indicators

Key Learning Point 1: IRTB TLO Module 2


Identification of potential terrorist bombing targets and pre-attack
indicators, tactics, and techniques used by terrorists.

Pre-attack Indicators:
 Faisal Shahzad appeared on a Department of Homeland
Security travel lookout list/watch list between 1999 and 2008
because he brought approximately $80,000 cash or cash
instruments into the United States.
 Alienation from family.
 Money problems.
 Multiple trips to Middle East.
 Attended terrorist training in Pakistan.
 Purchasing of material used in the construction of IEDs.
 Purchased vehicles and paid cash.
 Purchased airline ticket to Dubai and paid cash.

Motive: In a video Shahzad made while training in Pakistan prior to


the attack, he stated: “The attack on the United States will be a
revenge for all the mujahedeen and oppressed Muslims.”20

20
(2010). Taliban Video of Faisal Shahzad. Times Video. Retrieved from
http://www.nytimes.com/video/nyregion/1248069111343/taliban-video-of-faisal-shahzad.html

January 2017 Version 01.2017 Page 6-90


Emergency Operations Sensitive
Incident Response to Terrorist Bombings
Training Support Package Participant Guide

Gathered materials: Shahzad was believed to have bought the


1993 Nissan Pathfinder, which was used in the car bomb attempt,
three weeks prior to the incident. The vehicle was purchased
through an ad on Craigslist for $1,300, which Shahzad reportedly
paid a Connecticut woman for in $100 bills. The money was paid
and the car exchanged at a Connecticut shopping center, without
any formal paperwork being exchanged.

By early March, Faisal Shahzad was already buying components


for his car bomb and was caught on store surveillance video picking
up big firecrackers in Pennsylvania; more than 150 of them were
part of the bomb, the FBI says. The store owner commented that
Shahzad must have mistakenly thought that if a few of them were
lit, they would set the rest off.

Constructed devices: The IED reportedly used by Shahzad was


described as amateurish and constructed of two travel alarm clocks
with batteries that apparently were fashioned as triggering devices,
connected by electrical wires to two- red, full, 5-gallon cans of
gasoline, sandwiching 40+ consumer-grade M-88 firecrackers
inside a 20-ounce metal container (wrapped in duct tape, with its
end removed), gunpowder, three full 20-gallon propane tanks, and
a 55-inch (1,400 mm) x 32-inch (810 mm) green metal gun locker
that contained: a metal pressure pot containing a thicket of wires,
that also connected to the alarm clocks; 250 pounds (110 kg) of
urea-based fertilizer in 8 plastic bags, and 120 M-88s.

Investigators believed the car bomb was actually made up of four


separate, individual explosive components — in effect, four bombs
comprising one large bomb. The firecrackers would have started
the process by setting off triggering devices attached to the
gasoline. That would have created an explosion that would have
then, in turn, set off the propane and the fertilizer. A cell phone and
wristwatch recovered from the vehicle may have been intended as
separate timing/triggering devices. The maker of the "bomb"
incorrectly surmised that the urea/sugar mixture fertilizer would
work like the ammonium nitrate-based fertilizer. The IEDs ignition
source malfunctioned, however, and failed to set it off as intended.

January 2017 Version 01.2017 Page 6-91


Emergency Operations Sensitive
Incident Response to Terrorist Bombings
Training Support Package Participant Guide

Slide 6-48 Key Learning Point 2: VBIED Recognition by LE

The two photos show the inside of the Nissan Pathfinder used by
Faisal Shahzad at Times Square. The top photo shows a 20-ounce
container wrapped in duct tape filled with (40+) M-88s with a wire
connecting to it, sitting next to two five-gallon containers filled with
gasoline. The bottom photo shows a clock with wires extending out
of it.

The photos on this slide depict the actual scene and provide some
realism concerning what might have been visible to the first
responding officer at the scene.

January 2017 Version 01.2017 Page 6-92


Emergency Operations Sensitive
Incident Response to Terrorist Bombings
Training Support Package Participant Guide

Slide 6-49 Key Learning Point 2 (cont.): Suspicious Vehicle


Reported

This slide contains a video that shows a clip of an interview with


Duane Jackson, who reported the vehicle to police. Jackson was a
witness to both the 1993 World Trade Center bombing and the
events of 9/11, as well as the Times Square bombing attempt.

Duane Jackson, a 58-year-old handbag vendor, said he noticed the


Nissan Pathfinder at around 6:30pm. According to Jackson, his first
thought was “Who sat this car here?” He said he looked in the car
and saw keys in the ignition with 19 or 20 keys on the ring. His next
step was to alert a passing mounted police officer. "That's when the
smoke started coming out and then we heard the little pop, pop,
pop, like firecrackers going off and that's when everybody scattered
and ran back," Jackson said.

This incident shows the value of having public awareness


programs. First responders cannot be everywhere; this is why we
must rely on citizens to be our eyes and ears when we are not
around.

Examples of Successful Awareness Programs:


 In July 2010, the Department of Homeland Security (DHS), at
Secretary Janet Napolitano's direction, launched a national "If

January 2017 Version 01.2017 Page 6-93


Emergency Operations Sensitive
Incident Response to Terrorist Bombings
Training Support Package Participant Guide

You See Something, Say Something"21 public awareness


campaign –a simple and effective program to raise public
awareness of indicators of terrorism and violent crime, and to
emphasize the importance of reporting suspicious activity to the
proper state and local law enforcement authorities. The
campaign was originally used by New York's Metropolitan
Transportation Authority (MTA), and included posters with
contact information such as: Call 1-888-NYC SAFE.
 The slogan was inspired by the Metropolitan Transportation
Authority's admonition to traditionally mind-your-own-business
New Yorkers. Since 2002, posters encouraging, "If you see
something, say something” became a daily sight for New
York subway riders.
 Another program that has been successful is “Operation
Safeguard.” The New York State Intelligence Center (NYSIC)
instituted Operation Safeguard throughout the state of New
York. Operation safeguard is a public outreach program
generating public awareness to private industry and sectors by
providing descriptions of potential terrorist indicators and
suspicious activities and access to a special hotline for public
reporting.

21
If You See Something, Say Something. U. S. Department of Homeland Security. Retrieved from:
http://www.dhs.gov/see-something-say-something/about-campaign

January 2017 Version 01.2017 Page 6-94


Emergency Operations Sensitive
Incident Response to Terrorist Bombings
Training Support Package Participant Guide

Slide 6-50 Video: EMRTC Simulation of Times Square VBIED

This slide contains a video of a simulation created by EMRTC to


demonstrate the potential blast effects had Faisal Shahzad been
able to build a functional explosive using the same explosive
ingredients.

January 2017 Version 01.2017 Page 6-95


Emergency Operations Sensitive
Incident Response to Terrorist Bombings
Training Support Package Participant Guide

SUMMARY

Slide 6-51 Summary

This slide is an opportunity for instructors to summarize the key


points in the module and for the participants to ask questions.

January 2017 Version 01.2017 Page 6-96


Emergency Operations Sensitive
Incident Response to Terrorist Bombings
Training Support Package Participant Guide

School Bomb Threat Scenario


1. Bomb Threat Received

2. Responder Notification

3. Incident Validation
(Bomb Threat Report Form, interviews, audio/video recordings)

__________________________________________________________________________

__________________________________________________________________________

__________________________________________________________________________

__________________________________________________________________________

4. Evacuation Decision
(Shelter-in-place, safe routes/locations, time, distance, shielding)

__________________________________________________________________________

__________________________________________________________________________

__________________________________________________________________________

__________________________________________________________________________

January 2017 Version 01.2017 Page 6-97


Emergency Operations Sensitive
Incident Response to Terrorist Bombings
Training Support Package Participant Guide

5. Search Decision
(Search team composition, prioritize search areas)

__________________________________________________________________________

__________________________________________________________________________

__________________________________________________________________________

__________________________________________________________________________

6. Bomb Tech. Response Decision

7. Collect Evidence

__________________________________________________________________________

__________________________________________________________________________

__________________________________________________________________________

__________________________________________________________________________

8. Resume Steady State


(Incident validation, multiple devices, liability)

__________________________________________________________________________

__________________________________________________________________________

__________________________________________________________________________

__________________________________________________________________________

January 2017 Version 01.2017 Page 6-98


Emergency Operations Sensitive
Incident Response to Terrorist Bombings
Training Support Package Participant Guide

Slide 6-52 Performance Exercise

ELO 6-6
Determine an appropriate operational/tactical response for a
pre-detonation incident based on situational variables.

This Performance Exercise (PE) was created for participants to


apply the knowledge they have learned throughout this module to a
realistic scenario in this performance exercise, the participants will
respond to an unfolding bomb threat at a hypothetical elementary
school. The participants will need to make decisions based on what
they have learned and past experience.

January 2017 Version 01.2017 Page 6-99


Emergency Operations Sensitive
Incident Response to Terrorist Bombings
Training Support Package Participant Guide

Slide 6-53 Bomb Threat

This slide outlines key information about the bomb threat called in
to dispatch.

The principal of Middle Valley Elementary School called to dispatch


and reported that a man called the school office and said there was
a bomb in the school. During the call, the man made a reference to
the school dress code. At 10:55 AM (five minutes ago), he said that
the bomb would blow up in one hour, which puts the potential time
of detonation at 11:55 AM.

January 2017 Version 01.2017 Page 6-100


Emergency Operations Sensitive
Incident Response to Terrorist Bombings
Training Support Package Participant Guide

Slide 6-54 Middle Valley Elementary School

This slide contains an aerial photo of Middle Valley Elementary


School, the location of the bomb threat.

January 2017 Version 01.2017 Page 6-101


Emergency Operations Sensitive
Incident Response to Terrorist Bombings
Training Support Package Participant Guide

Slide 6-55 Evacuation Map

This slide contains a map of the school with the evacuation


locations highlighted.

January 2017 Version 01.2017 Page 6-102


Emergency Operations Sensitive
Incident Response to Terrorist Bombings
Training Support Package Participant Guide

Slide 6-56 Bomb Threat Recording

This slide contains the cycle of pre-detonation actions with the


three actions that the participants need to assess highlighted.

January 2017 Version 01.2017 Page 6-103


Emergency Operations Sensitive
Incident Response to Terrorist Bombings
Training Support Package Participant Guide

Slide 6-57 Suspicious Object Found

This slide shows a photo of a suspicious object found by police


while searching the school as well as an audio clip of the officer
describing the object.

Officer: While doing a quick walkthrough in the elementary


school, and officer found this item sitting on a shelf in the teachers’
lounge. Both the custodian and the principal indicate they have
never seen the object before. The teachers’ lounge is located on
the very northeast end of Building C.

January 2017 Version 01.2017 Page 6-104


Emergency Operations Sensitive
Incident Response to Terrorist Bombings
Training Support Package Participant Guide

Slide 6-58 School Map: Location of Suspicious Item

This slide contains a map of the school with the evacuation


locations circled and the location of the suspicious item
marked with a yellow question mark.

January 2017 Version 01.2017 Page 6-105


Emergency Operations Sensitive
Incident Response to Terrorist Bombings
Training Support Package Participant Guide

Slide 6-59 What’s Next?

This slide shows a list of decisions that must be considered after


locating a suspicious item at the school.

January 2017 Version 01.2017 Page 6-106


Emergency Operations Sensitive
Incident Response to Terrorist Bombings
Training Support Package Participant Guide

Slide 6-60 Conclusion

This slide contains topics for a concluding review/summary.

January 2017 Version 01.2017 Page 6-107


Emergency Operations Sensitive

S-ar putea să vă placă și