Postal bombs, contaminated mailings, and even postal devices designed to activate firearms ammunition have all been used to target VIPs, employees, and even ordinary citizens. To mitigate these risks, all organizations should have a protocol for intercepting and safely responding to hazardous mail deliveries.
Interception
The first step in developing a hazardous mail countermeasures plan is determining what mail should be screened. In most organizations, it may not be feasible to screen every piece of mail entering a facility and, in most cases, is not necessary. When a bomber or other perpetrator decides to strike at an organization through mail bombs or contaminated mailings, certain individuals are more likely to be targeted than others. In this case, priorities are established on the basis of employees’ positions, public exposure, and the value of the individual to the organization. This analysis determines whose mail should be screened. Limiting screening to high-risk personnel usually provides an effective balance between risk and resources.
Once it is determined whose mail should be screened, steps should be taken to ensure that all mail for the individuals concerned is sent to one central reception point. This is usually the company mailroom.
Additionally, the issue of personal mail should be addressed. It is very common for perpetrators to send hazardous mailings to the victim’s residence. As a result, all high-risk individuals should have both business and personal mail delivered through the same reception point.
Executive protection details should use similar procedures, ensuring that the protectee’s mail is received at a central location. Ideally, one person in the protective detail should be assigned to receiving and screening the mail. This is usually a command post operator or an advance agent. However, this arrangement often isn’t possible. In cases where the protectee is receiving mail at multiple locations, provisions should be made to ensure that mail is never delivered to the protectee without first being screened by qualified personnel.
When protectees are traveling, hotels will sometimes send a concierge or other messenger to deliver important letters and parcels to people checked into VIP suites. This risk should be eliminated by coordinating with the hotel staff in advance to ensure that all inquiries or deliveries for the protectee are handled through the command post or a specific agent on the protective detail.
Identification
Studies of previous hazardous mail attacks have revealed certain characteristics common to threat mailings. These peculiarities, in both construction and markings, can serve as a guide for physically inspecting mail to identify potential threats.
All mail handlers, secretaries, and security personnel should be trained to recognize these characteristics. Additionally, those required to screen mail should be provided with a personal list of recognition clues as a reference. Mailroom supervisors should post a copy of these clues in a common area where anyone can refer to them when necessary.
When inspecting a package or envelope, the handler should first look at the construction of the mailing itself. Without handling the mailing too much, they should observe any of the following threat indicators.
o Rigidity (applies to envelopes)
o Irregular Shape
o Unbalanced Weight
o Oily Stains
o Sloshing Sounds or Shifting Weight
o Feel of Wires or Foil
o Feel of Cylindrical Tube
o Soft Spots
o Excessive Tape
o Signs of Reassembly
o Strange Odors
After observing the construction of the mailing, one should look at the markings themselves and observe the following threat indicators.
o Incorrect Addressing
o Foreign Handwriting
o Poorly Typed or Handwritten
o Deliberate "Block" Handwriting
o No Return Address
o False or Fictitious Sender
o Restrictive Markings
o Place of Origin
o Excessive Postage
Many legitimate mailings bear some of the characteristics here described. A person might easily misunderstand a title or misspell a name. In other cases, an envelope might be stained on a greasy counter top, or a person with a busy schedule might place extra stamps on a letter to save a trip to the post office. All of these are innocent reasons for the presence of different recognition clues. One clue alone may not positively indicate a threat. However, the characteristics described in this essay are common in hazardous mailings and, if observed, can warn of potential danger.
If there is ever any doubt, the mailing should be treated as a hazardous mailing.
DO NOT OPEN OR FORWARD THE PACKAGE!
IMPORTANT NOTE: Caution should be exercised even after a package has been "cleared." Many hazardous mailings (mail bombs and contaminated mailings) have been discovered while the recipient was opening the letter or package. The appearance of wires, resistance or tension against the flaps of a box, and the presence of metal foil have all served as late warnings. In other cases, bombs have been concealed in second objects, such as books or videocassette boxes, meant to be opened after the external package has been discarded. If anything seems suspicious while opening a letter or parcel, one should stop immediately and treat the package as a possible mail bomb.
Response Procedures
In addition to establishing a screening program, all organizations at risk should ensure that mail handlers, secretaries, and security personnel are trained in safe procedures for responding to hazardous mail situations. The response procedures should be designed to minimize exposure of hazards to employees and bystanders and address the key issues of evidence preservation and minimizing the spread of possible contamination.
There are two primary scenarios to consider in developing response plans:
1. A suspect mailing discovered during the screening process. In this scenario, mail handlers or others identify a mailing as suspicious before it is opened by the intended recipient.
2. A contaminated mailing discovered after an envelope or package is opened. In this situation, the mailing has passed through screening and has been forwarded to the recipient. The recipient, having opened the mailing, recognizes something as suspicious. Some possible indications of contamination may include:
o Unusual powders, liquids, stains, or discolored papers
o Unusual scents or odors
o Needles, razor blades, or other sharp objects concealed in popcorn or taped to papers
o Sponges or other absorbent materials that may be soaked with a liquid contaminant
o Repackaged or unusual consumer product samples (health food supplements, medicine, topical creams, eye drops, etc.)
o Letter communicating a threat or stating that the mailing is contaminated (very common in contaminated mail situations)
There is a third scenario that should also be considered—detonation of a mail bomb if opened by a recipient. However, response to this type of situation is the same as any internal bomb detonation and should already be addressed in the organization’s post-blast response plan.
Following are model response plans for suspicious mail situations. These response models assume that the organization employs professional security personnel on-site. If security personnel are not available, the same principles of response apply. However, responsibilities for notification, directing evacuation, and securing the danger area should be delegated to other capable employees.
Suspect Mailing (Identified during screening)
1. Once a letter or package has been identified as suspicious, the mail handler should stop and contact on-site security personnel immediately. The mail handler should then isolate the mailing and calmly alert others in the room. While waiting for security to arrive, the mail handler should ensure that no one touches or moves the suspect mailing.
2. Once the security officer has arrived, the inspection process should be repeated—again looking for any threat indicators.
DO NOT OPEN THE SUSPECT MAILING TO VERIFY THE THREAT!
3. After properly isolating the suspect mailing, the security officer should contact the addressee for identification and verification of the postal item. The addressee should be asked several questions:
1. Is the addressee familiar with the name and address of the sender?
2. Is the addressee expecting mail from the sender?
3. If correspondence is expected, what would the contents be and their approximate size?
4. Is the addressee familiar with anyone (friends, relatives, colleagues, etc.) traveling in the state or country of origin?
If there is a return address, the sender should then be contacted to verify that the package or letter was sent. If the sender denies mailing anything, the item should be treated with extreme caution. This is a strong indicator that the package is dangerous.
5. Next, the security officer should call the police and report the situation. Order the immediate evacuation of anyone present in the room and adjacent rooms on each side, above and below.
6. The letter or parcel should be placed in a conspicuous location on a clear table or floor. Something should be placed next to the mailing as a reference, such as a sheet of paper with a large arrow drawn with a marker. If the mailroom is equipped with a blast containment vessel, the mailing should be gently placed in the container.
The area around the suspect mailing should be clear and capable of being approached with at least four feet of space on each side.
All windows and doors in the room should be opened and all bystanders evacuated from the area.
7. Next, the security officer should evacuate the room and move to a location where the area can be secured from accidental intrusion by other employees. If possible, another security officer should be posted to secure the area while the first officer moves to the outside of the building to receive and brief arriving police and bomb disposal personnel.
8. After the responding police officer arrives and has assumed legal authority, the security officer should continue to secure the area from intrusion until the bomb disposal unit arrives.
9. Once the bomb disposal unit arrives, they will assume authority from the police officer on scene. Be prepared to brief bomb technicians on the appearance of the suspect mailing and direct them to its location.
Suspect Contaminated Mailing (Identified after opening)
1. The individual who opened the mailing should place the mailing down cautiously to avoid disturbing its contents. The individual should avoid touching anything with his/her hands to minimize the potential spread of contamination.
2. The individual should then order everyone present to calmly evacuate the immediate area. The individual should instruct someone to call the security department and report the contaminated mailing to 911.
3. Once Security has reported the situation to 911, a security officer should be dispatched to ensure that the area is evacuated and secure the room from accidental intrusion. The heating and air conditioning system should be turned off to minimize the spread of airborne contaminants.
4. Without touching anything, the individual who opened the mailing should go to the nearest washroom and thoroughly wash their hands with hot soapy water. This washing should continue for at least 3-5 minutes.
If there is reason to believe that the individual’s clothes have been contaminated, the clothes should be carefully removed and placed in a garbage bag or in a single pile for collection by authorities. The individual should then thoroughly rewash his/her hands.
5. Another security officer should be dispatched to secure the washroom from accidental intrusion. Any area where the mailing was opened and where the recipient passed while traveling to the washroom should be regarded as contaminated and secured from accidental intrusion.
6. In most jurisdictions, police and HAZMAT personnel will be dispatched simultaneously. Police will secure the area under the direction of the HAZMAT team. During this time period, the FBI will be notified. Once FBI agents have arrived on-scene, they will assume authority over the investigation in cooperation with local police, postal inspectors, and public health authorities.
7. In most contaminated mail situations, the HAZMAT team will establish a decontamination station for showering people who may have been exposed to the agent. If not, the individual who opened the mailing and anyone who was in proximity should take a shower at first opportunity. Clothes that were possibly contaminated should be bagged and turned over to authorities.
If the material in the mailing tests positive for an agent, the individual who opened the mailing and anyone who was in proximity will be required to complete a medical evaluation
While waiting for results from medical authorities, individuals who may have been exposed should carefully monitor themselves for symptoms of infection or intoxication. Any unusual symptoms should be promptly reported to medical authorities.