Bomb Threat Assessment: What’s in a threat?

bomb threat assessment

Should we respond in the same manner to all bomb threats? With so many of them causing disruption to airport and airline operations, and distress for the travelling public, it is worth remembering that one crucial element of an effective bomb threat management plan is the bomb threat assessment process. Alejandra Gentil discusses this process and highlights issues to be considered during its implementation.

What is an organisation supposed to do upon receiving a bomb threat? Receiving a bomb threat may cause fear, panic, confusion, scepticism, chaos and disruption, among other psychological and organisational effects. It may trigger an excessive response, such as evacuating an airport terminal building or diverting an aircraft to land in the first available airport. These actions may not be commensurate with the actual threat and entail huge financial costs, scheduling nightmares for airlines and airports, and disruption to hundreds or thousands of travellers.

Furthermore, it may be an attacker’s intention to provoke an evacuation in order to have large numbers of people gathered at one unprotected point, making them more vulnerable, or to gather intelligence on the organisation’s contingency plans. Hence having an evacuation-and-search only policy, circumscribing a methodological bomb threat assessment process, entails financial, organisational and human risks. On the other hand, failing to respond adequately to a genuine threat may have very serious consequences, including loss of life and damage to property, with minor ones including legal actions and the public’s loss of confidence in the organisation(s) involved. This article examines the importance of the bomb threat assessment process that forms a vital part of any bomb threat management plan.

Bomb Threat Management Plans

Every organisation needs to establish and implement an effective bomb threat management plan. ICAO’s Security Manual (Doc 8973) provides clear guidelines on what should be implemented and how. The first step involves implementing clear contingency plans in which all roles and responsibilities are assigned. From the person receiving a bomb threat (the micro sphere) to the organisational response (macro sphere), all persons involved should clearly know what to do in the case of a bomb threat. Furthermore, airport and local airline bomb threat management plans should be aligned so that all of the organisations involved, including state security agencies and others that may provide ancillary services, understand what their roles are and how to implement the plan. Needless to say, coordination amongst the various agencies involved and training of all staff according to their allocated responsibilities are crucial for any contingency plan to work. An organised, systematic response to bomb threats by well-trained employees is essential to an effective response. Every employee needs to know what to do, and the procedures to be followed should be incorporated into appropriate staff instructions and checklists to facilitate staff response.

Doc 8973 states that ‘airport contingency plans should clearly define the title and/or position of the person and the entity responsible for the evaluation of all potential bomb or other violent threats against civil aviation, whether they affect aircraft on the ground or in flight, or buildings at an airport’. It further specifies that bomb threat assessors must be appointed and duly trained ‘in order to assess the threat and provide guidance’.

“…it may be an attacker’s intention to provoke an evacuation in order to have large numbers of people gathered at one unprotected point, making them more vulnerable…”

An effective bomb threat management plan should clearly define the terminology and procedures, identify key personnel, allocate roles and responsibilities, identify the command centres, isolated aircraft parking position(s) and assembly points, include safety concerns (such as evacuation distances and communications protocols and/or restrictions), clearly define the steps to be taken when receiving a threat and the threat assessment process, the actions to be taken in accordance to the classification of the threat and provide for initial and recurrent training. Should evacuation and search be required, whether partial or total, or the diversion of an aircraft in flight, the procedures should be clearly established in order to allow for an effective and orderly management of the incident. Contingency plans, according to Doc 8973, should include: provisions for a controlled response by persons receiving bomb threats; an assessment of the threat and risk involved by designated and accredited bomb threat assessment personnel employing Positive Target Identification; coordination of any action taken, which should be appropriate to the risk as assessed; detection of persons responsible for bomb threats, and; follow-up action.

What’s in a Threat?

A bomb threat may be defined as a communicated threat, anonymous or otherwise, which suggests, or infers, whether true or false, that the safety of an aircraft in flight or on the ground, or any airport or civil aviation facility or any person may be in danger from an explosive device. Upon receiving a threat, the question is not whether it is real – after all, it is a threat and, thus, real. Rather the question is, ‘Can the perpetrator have done that which they claim?’. Using positive target identification (PTI), the bomb threat assessment process aims at establishing, to the extent possible, whether the threat is a hoax and therefore does not warrant a response, thus minimising disruption to airline and airport operations; or whether there are reasons to believe an explosive device may in fact have been placed or will be placed in the manner suggested by the threat. It uses the specificity of the information provided in the threat to determine its credibility. Using a series of ‘yes’ or ‘no’ questions to determine the seriousness of the threat, PTI’s methodology guides the bomb threat assessors and leads them towards one of these conclusions: the threat is specific, non-specific or a hoax. Usually this is expressed in terms of colour: RED for specific, AMBER (or yellow) for non-specific, and GREEN for hoax.

The response will depend on the nature and classification of the threat. If classified as GREEN, a response will not be necessary and operations continue as normal. Responses to AMBER and RED imply the implementation of contingency plans, with the measures taken in accordance with the nature of the threat. Normally this would entail an evacuation, partial or total, of the specified target, and the deployment of explosive ordnance disposal (EOD) teams. Contingency plans should define the procedures for evacuation and the assembly points. It is worth having pre-planned alternatives in case the primary assembly area is not suitable on the day. Fire evacuation routes and assembly points may likewise not be feasible during a bomb threat as both scenarios are of a very different nature. If evacuating landside during a bomb threat, it is important to be mindful of the fact that creating a crowd in non-restricted areas may be the actual intention of potential perpetrators who seek to maximise their attacks by increasing the number of casualties. In essence, people assembled at one point and unprotected in the landside are sitting ducks for terrorists.

In order to develop a bomb threat assessment capability, it is necessary to understand the elements required for a perpetrator to conduct a bombing. These are: motivation, material, knowledge and opportunity. The motivation relates to whether the person or group that issues the threat has a legitimate or self-perceived motivation to perpetrate an attack. Terrorist groups, former employees who have been discharged, or persons who may profit from the attack provide examples of actual motivations. These persons need to have procured the materials required to assemble an explosive device. While some materials may be easy to purchase in certain countries, other countries keep a keen eye on the quantities of materials sold, and, more importantly, on who purchases them. This may mean that the intelligence services may detect the plot before it is activated, and only they can assess whether the alleged use of a certain explosive material is credible. This, however, should not be taken as absolute proof of a hoax, as other elements need to be taken into account, particularly as information on how to ‘cook’ explosive materials and to assemble an explosive device is now readily available on the internet.

“…a caller who offers detailed information on the placement of an explosive device, including vocabulary which may suggest an insider knowledge of the target, would immediately be classified as either RED or AMBER…”

The third element needed for a perpetrator is, therefore, knowledge. This not only relates to the know-how of making a bomb, but also to aviation operations, our vulnerabilities and capabilities. Although these may seem like common knowledge to us aviators, the average person knows very little about them. Hence a caller who offers, as an example, detailed information on the placement of an explosive device, including vocabulary that may suggest an insider knowledge of the target, would immediately be classified as either RED or AMBER.

“…American Airlines flights AA24 and AA846, and Finnair’s AY05 were directed to the remote parking position and searched upon landing at JFK airport because a caller stated that hijackers wearing gas masks were hiding in the wheel well of an arriving flight…”

The fourth element of the equation is opportunity. A potential attacker needs to have the opportunity to place the device. In one of the most bewildering cases of the last few years, for instance, in 2012 American Airlines flights AA24 and AA846, and Finnair’s AY05 were directed to the remote parking position and searched upon landing at JFK airport because a caller stated that hijackers wearing gas masks were hiding in the wheel well of an arriving flight. Needless to say, it was a hoax but the somewhat exaggerated law enforcement response and the frustration and fury of AA24’s captain, who was not being kept informed about what was happening, ensured this case was well publicised, probably to the embarrassment of JFK officials. This scenario would have required the opportunity of the attackers to climb undetected into the wheel wells at the originating airports, bypass the flight crew and maintenance pre-departure inspections, make it in one piece and alive to JFK, and be ready to perpetrate an attack. While admittedly some airports have recurrent problems with persons breaching their perimeters and stowing away, the scenario described is fit for a script of a hyperbolic Hollywood action movie. In real life PTI trumps elaborated fantasy.

Bomb Threat Assessment

Bomb threat assessment is not easy and carries immense responsibility. It involves making decisions with limited information within a limited time. Moreover, in the case of verbally issued threats, whether in person or by phone, the wording and tone of it, along with other details of the person who issued the threat, is largely based on the perceptions of the person who received the threat, therefore the assessors are already working on second-hand information. Hence the need for the assessors to be knowledgeable and well trained. Furthermore, there is power in numbers. While ICAO recommends that each aircraft operator and airport have at least one assessor on duty or on call at all times, it is generally recommended that a bomb threat assessment team be designated, and the details on how it is to be assembled be pre-established. The members of this team should work independently on the PTI but should interview the person(s) who received the threat, conjointly if possible, and should be provided with all of the information available. Upon doing this, the assessors should discuss their respective decisions and reach a conclusion on the classification of the threat. Should there be a disagreement, the most cautious approach should prevail.

The question, ‘Is it feasible for the person to have done that which they claim?’ is assessed by the bomb threat assessment team during a process of review of the facts to determine if the actions claimed in the threat are realistically possible. Threat assessment relies heavily not only on the exact wording of the threat, but also on the context in which it is made. They should take into account global, regional, local and industrial events, such as prior actions against the actual target or a similar one or recent history of warnings to and incidents at the airport or against an aircraft operator.

Current events affecting the country, the targeted airport or airline, such as terrorist attacks, political or financial crises, civil unrest, industrial disputes, staff layoffs and environmental protests at or around airports should be taken into account, as should any high-profile individual who may be travelling and may attract a threat to the airport or airline. The foreign and domestic policies of the country represented by the target likewise carry significant weight when assessing a threat. Other events, such as overbooking of flights, a passenger refused boarding, disputes between passengers and staff or crew at the airport or on board an aircraft, or whether the flight or route is considered high risk should be considered. And let’s not forget the ever-present misguided reasons for calling in a hoax bomb threat: passengers running late, attention seekers and pranksters, plus the terrorist gathering intelligence on the response procedures and capabilities.

Assessors should attempt to gather as much information as possible within a limited amount of time. The use of the available resources is therefore vital. Crucial information may be garnered from different stakeholders, such as passenger and cargo manifests, staff rosters, details of crew members, aircraft movements, location from which the phone call was made and CCTV recordings. The information requested should naturally be related to the nature of the threat. Hence the importance of the airport bomb threat assessment team being able to contact the various potential sources of information within their limited timeframes. At times the information will be delivered late, minutes or hours after the decision is made. Nonetheless, it will form part of the file provided to the law enforcement agency in charge of the investigation.

We should never forget that any bomb threat, regardless of its classification, must be communicated to the local authorities in order for them to initiate an investigation. All details, including the decision-making process and the conclusions reached, should be provided to them as well as to the appropriate authorities.

The process of bomb threat assessment is not for the faint-hearted. It requires making a well-grounded decision on a potentially life-threatening scenario within a very limited time frame and, more often than not, with little information. The decision likewise may affect the day-to-day operations of an airport and/or an airline, disrupting flight schedules across a network and the travelling plans of probably a few thousand people, exponentially increasing operational costs. Hence the importance of selecting and training suitable assessors, along with implementing periodic exercises to test the effectiveness of the bomb threat management plan. Organisations that seek to protect both their interests and the wellbeing of the travelling public should understand the vital importance that this role plays in separating the wheat from the chaff, or, in this case, a genuine threat from a hoax.

Alejandra Gentil
Alejandra Gentil

Alejandra Gentil has over twenty-two years of experience in AVSEC, working with different stakeholders within the industry, both at operational and management levels. She has established and managed aviation security operations at various locations and has assisted in the implementation of ICAO Annex 17 and Annex 9 standards and recommended practices at several locations around the world. In her role as key AVSEC expert in the ACP Group/EU Commission Project for the Improvement of Aviation Security in Africa, she provided AVSEC training and technical assistance to support the appropriate authorities of the beneficiary states in the implementation of Annex 17 SARPs and appropriate AVSEC oversight systems. She specialises in the development of AVSEC regulatory frameworks programmes.