Bomb Threat Assessment: When Is A Threat Specific?

For decades, the aviation industry has been dealing with rising numbers of bomb threats, which are communicated in a range of ways and for a variety of reasons. While a threat is rarely connected with the presence of an actual explosive device, each must undergo the same process of evaluation. Ed Kittel explains how the credibility of a threat is assessed and offers practical advice on implementing bomb threat incident plans.

One of the more frustrating aspects of civil aviation security management is the handling of bomb threats, which have become increasingly prevalent in airport and airline environments. In nearly all instances, these threats are issued in order to disrupt operations. They may be an expression of anger at the entity receiving the threat by, for example, a disgruntled employee, and there is frequently an upsurge in bomb threats during labour unrest and strikes. In the vast majority of instances, no actual or hoax devices are found. Notable exceptions were the ‘coded warnings’ issued by the Provisional Irish Republican Army (PIRA) prior to a bomb being detonated in order to prevent civilian casualties. However, even the PIRA made spurious coded warnings to elicit security responses when they had not placed a bomb in order to disrupt urban life in Northern Ireland. Occasionally, terrorists may issue threats but today’s radical Islamic terrorist groups do not provide warnings prior to activating their improvised explosive devices (IED), as they want to inflict maximum casualties, including on innocent civilians. Nevertheless, each threat should be evaluated on its credibility using the information provided to determine appropriate courses of action. It is too late to begin bomb incident planning once a threat has been received.

When a bomb threat is received by telephone, it is important to gather as much information as possible from the caller in order to evaluate the veracity of the threat. The more specific and detailed the threat, the greater the probability that an IED may be found (see example Bomb Threat Checklist from the US Department of Homeland Security on next page.) Telephone receptionists and customer service staff who receive outside telephone calls must be trained in advance to calmly and professionally question callers, observe background noises, evaluate language and accents, and promptly report detailed information to security staff and law enforcement authorities.

“…exceptions were the ‘coded warnings’ issued by the Provisional Irish Republican Army prior to a bomb being detonated in order to prevent civilian casualties…”

Written threats must be evaluated as well, and care should be exercised to preserve those documents for subsequent analysis of fingerprints, handwriting, postmarks, and other forensic evidence. Written threats should be placed in transparent document protectors with minimal handling to facilitate their review without losing possible evidence. Written threats in aircraft cargo holds or on other structures should be photographed. Any recorded threats must also be preserved for audio examination by law enforcement investigators.

Threats received via social media do not offer this opportunity and must be evaluated on face value; Facebook and Twitter have added a new complexity to bomb threat planning and response. However, threats received via social media sites can potentially be traced to reveal the user’s location using geo tagging and other techniques. Private data may also be obtained from the service provider with a warrant or subpoena in criminal cases. There are a number of resources for law enforcement officials to assist in the investigative use of social media. Many larger law enforcement agencies now have cybercrime units to assist in these investigations.

Threats against specific targets can result in focused searches by occupants and security personnel as well as by explosives detection canine teams. Lacking any specificity, it is virtually impossible for security services to effectively search an entire airport or office building. It is therefore a valuable practice to train your employees to voluntarily search their workspaces for signs of suspicious articles, to report them to security, and to avoid touching or moving those items as they evacuate. Maintenance staff are extremely valuable in searching workshops and other facilities as they know which items belong there and what might be suspicious or out of place. Remember to brief new employees and part-time and summer interns in the local bomb threat plans and procedures. This process is the most effective way to have minimum disruption when a bomb threat is deemed credible. Do not expect a responding bomb squad to search your entire facility as there are typically only two responding bomb technicians who do not know your operation nor what items belong there versus what may be obviously out of place or suspicious to your employees and tenants.

Airports and air carriers are notorious entities for the receipt of bomb threats; hence every airport and airline must have a bomb threat section in their emergency plans. All employees should be trained in their roles in those plans and exercises should be conducted to make their roles and responsibilities second nature. It is important that all personnel remain calm and focused on an orderly process, which oftentimes will be unknown to the travelling public. Coded announcements, for example, can notify customer service agents to be alert to suspicious items in public areas or to observe passenger behaviours and to search the areas immediately adjacent to their workstations. Remind employees to lock unattended drawers and cabinets at check-in kiosks and departure gates when not in use. Military Explosive Ordnance Disposal (EOD) units and police and fire service public safety bomb technicians can provide improvised explosive device (IED) recognition training for employees and may also provide training on terrorist tactics, techniques and procedures to aid in emergency planning. Airports should also provide this training to their tenants to broaden the preparedness of the entire aviation community. “See Something, Say Something” awareness programmes are important adjuncts to all antiterrorism training programmes.

There must be a designated person and alternates to evaluate threats and make the decision to evacuate. This is should be done in consultation with law enforcement authorities, corporate security directors, and others depending on the specifics of the threat. It is also advisable to have one designated spokesperson to release any information to the media. Most importantly, bomb threat incident plans should be developed and regularly exercised prior to receiving a threat.

In the 1980s, the Federal Aviation Administration (FAA) developed a concept called Positive Target Information (PTI). The theory behind PTI is to evaluate the information provided by the caller to determine how the air carrier or airport will respond. Threats which include non-public information or specific details which might only be known by an insider who has access to the facility or aircraft are given the most credibility. For example, threats with information involving the exact location of IED placement or aircraft tail numbers are handled as being more credible than calls saying, “There is a bomb in your airport” or, “There’s a bomb on an airplane departing the airport”. In general, the more precise the information, the higher the probability that the threat is serious and a device might be found. While PTI is a useful tool in evaluating industry and public safety responses, there remains a possibility that an IED may be placed without any threat warnings. Furthermore, the number of actual devices encountered in the aviation community is relatively small making statistical analysis problematic. Nevertheless, PTI is a useful tool to demonstrate an analytical decision making process for evaluating threats.

Bomb threats against aircraft in-flight offer a unique set of challenges. The pilot-in-command must evaluate the flight profile and, in discussion with corporate security and dispatch, decide whether to divert, return to the departure airport, or continue to the scheduled destination. This is where PTI may offer the best utility in that decision process. Detailed threats will likely drive the levels of response. With closed flight decks since 9/11, flight attendants must take charge and conduct any cabin searches directed by the captain. The crew can search lavatories and galleys without alarming the passengers. If a complete cabin search is warranted, passengers should be instructed to retrieve all carry-on items and to report any suspicious articles discovered during that process without disturbing them. Should a suspect item be located, the crew should handle it in accordance with Least Risk Bomb Location (LRBL) procedures, which are now an ICAO requirement. Aircraft landing with suspicious items must be directed to the designated ‘Hot Spot’ for resolution of the threat, as one would not want to bring a possible explosive device to the airport terminal.

“…threats with information involving the exact location of IED placement or aircraft tail numbers are handled as being more credible than calls saying, “There is a bomb in your airport” or, “There’s a bomb on an airplane departing the airport…”

Perhaps one of the most significant threats against a commercial aircraft in-flight occurred in 1972 when a specific threat against a Trans World Airlines flight over the United States resulted in its return to New York’s JFK Airport, where a search by NYPD Bomb Squad’s bomb sniffing dog named Brandy discovered a live improvised explosive device hidden in the cockpit’s emergency medical kit, which was rendered safe only twelve minutes before it was set to explode. This resulted in the FAA establishing its Explosives Detection Canine Team Programme at major airports across the United States. Similar programmes have subsequently been established worldwide to assist in the detection of explosives.

Aviation continues to be a focus of international terrorist IED attacks with commercial aviation remaining an attractive target due to the large number of casualties and the worldwide news coverage resulting from these attacks. However, the effectiveness of passenger and baggage screening technologies have made these attacks significantly more difficult since the introduction of advanced screening technologies at airports following the bombing of Pan Am Flight 103 in December 1988. For airport and larger facility bomb threat searches, explosives detection canine teams remain one of the best search tools as they are highly mobile and can ‘go to source’, alerting on a wide range of explosives threats. In addition, passenger screening canines can be used in checkpoint queues to passively screen passengers by ‘sniffing’ the vapour wakes trailing passengers as they progress though screening. Each of these tools should be employed in an integrated systems approach to apply the best combinations for the tasks at hand.

As our confidence grows in aviation security systems, terrorists evolve and adapt as well. This drives terrorist bombers to either use insiders with access to secured areas to introduce IEDs into airports by evading screening checkpoints and checked baggage security systems or switching their targets to the public side of airports in lobbies, at ticket counters or baggage claim areas, and even on the public side of screening checkpoints. In addition, there has been a notable surge in ‘active shooter’ attacks at airports. Future airport security designs will also need to address the full range of threats and consider innovative methods to mitigate threats.

“…a specific threat against a Trans World Airlines flight over the United States resulted in its return to New York’s JFK Airport, where a search by NYPD Bomb Squad’s bomb sniffing dog named Brandy discovered a live improvised explosive device hidden in the cockpit’s emergency medical kit…”

The most important element of bomb threat management and analysis is proper prior planning. As terrorist tactics are constantly evolving, our response and training plans must evolve as well. Regular training and exercising of those plans ensure that aviation workers are prepared when a threat is received resulting in a smooth, well-coordinated response. As noted in the US 9/11 Commission Report, “Private-sector preparedness is not a luxury; it is a cost of doing business in the post-9/11 world. It is ignored at a tremendous potential cost in lives, money and national security.”

Ed Kittel

Ed Kittel currently serves as Chief of TSA’s Assistant Federal Security Director for Inspection in Anchorage, Alaska with responsibility for all airports in the State of Alaska. He joined the FAA in 1992 following a career in the US Navy, where he served as an Explosive Ordnance Disposal (EOD) officer for 20 years and commanded EOD units in Hawaii, the Western Pacific, and California. He managed the FAA and TSA’s Explosives security programmes for over 20 years. He may be contacted at