Suspicious Package Scenario for Guards (California)

During the morning rush, a visitor tells you a dark backpack has been sitting by a lobby pillar for about 20 minutes. No one is standing near it.

1. Go and look at it carefully, without touching it. Ask people nearby if it is theirs, and check whether it is hidden, obviously suspicious or not typical for the lobby.
   Why?

   Best practice. Good. CISA asks you to tell an unattended item from a suspicious one by asking if it is Hidden, Obviously suspicious or not Typical (H.O.T.). For an unattended item, try to find the owner and report it, and treat it with caution the whole time.

2. Watch it on the lobby camera from your desk and wait to see if the owner comes back.
   Why?

   Acceptable. Weaker. Watching is careful, but CISA says to try to find the owner and report the item. Waiting quietly does not tell you whether it is suspicious, and people keep walking past it.

3. Pick it up and open it to look for a name or ID.
   Why?

   Unsafe or not allowed. Unsafe. CISA guidance says not to touch or move a suspicious item. You do not yet know if this bag is suspicious, so handling it puts you and everyone nearby at risk.

No one claims the bag. Up close, without touching it, you see it is pushed behind a planter. A wire comes out of a side pocket and is taped to something you cannot identify.

1. Treat it as suspicious. Move away right away, tell people near you to move away too, and keep them back from that part of the lobby.
   Why?

   Best practice. Correct. The bag is hidden and has unexplained wires, which are H.O.T. warning signs. CISA says do not touch it, move away immediately, direct others to do the same, and set up a perimeter to keep people away.

2. Stay next to the bag and call your supervisor on your two-way radio.
   Why?

   Acceptable. Weaker and risky. Telling your supervisor is right, but the CISA bomb threat checklist says do not use two-way radios or cell phones close to a suspicious item. Move well away first, then make the call.

3. Carry it outside to the curb so it is away from the people in the lobby.
   Why?

   Unsafe or not allowed. Unsafe. CISA guidance is clear: do not touch or move a suspicious item. Moving it puts you at the greatest risk and can put people on the street in danger too.

You and the people nearby are now well away from the bag. A small crowd is watching from the far side of the lobby.

1. Call 911, as your site plan says, and describe what you found: the item, what you have done, where it is, and when it was placed and found.
   Why?

   Best practice. Right. The CISA bomb threat checklist says if a suspicious item is found, call 911. The CISA postcard suggests the SALTY method: Suspicious items and people, their Actions, Location, Time of placement and discovery, and Your actions to reduce the risk.

2. Call your supervisor and wait for them to decide whether police are needed.
   Why?

   Acceptable. Weaker. Your supervisor needs to know, and some site plans set a call order. But CISA says to call 911 when a suspicious item is found. Waiting for someone else to decide costs time.

3. Tell the crowd it is probably nothing and let people walk back through the lobby.
   Why?

   Unsafe or not allowed. Unsafe. You have seen warning signs. CISA says to keep directing people away and to report the item to law enforcement. Guessing that it is nothing puts lives at risk.

The building manager arrives and asks whether everyone should leave the building, and which way they should go.

1. Point to the building's bomb threat and emergency plan. Help the manager follow it, keep people away from the bag, and send anyone leaving out by an exit that does not pass it.
   Why?

   Best practice. Best. The CISA checklist says to use your local bomb threat management plan for evacuation decisions. Your job is to support that plan, keep the area clear and make sure people do not walk past the item.

2. Tell the manager to do nothing until police arrive and decide.
   Why?

   Acceptable. Weaker. Police will take control when they arrive, but the building's plan already sets out who decides and how. Waiting without using the plan leaves people unsure of what to do.

3. Send everyone out through the main lobby doors, past the bag, because that is the closest exit.
   Why?

   Unsafe or not allowed. Unsafe. CISA says to move people away from the item and keep them away. Sending a crowd past a suspicious item puts them at the greatest risk.

Police arrive and take control of the scene. An officer asks you what happened.

1. Brief the officer with facts: who reported the bag, when, what you saw, and what you did. Offer the camera footage as your site allows, then write a full report with times.
   Why?

   Best practice. Correct. Police need clear facts to make their decisions. Times, descriptions and names of witnesses help their investigation, and your written report is the record of what you did.

2. Give a short verbal summary and leave the written report for the next shift.
   Why?

   Acceptable. Weaker. The verbal brief helps, but details fade fast. Write your report while your memory is fresh, with the times you noted.

3. Walk back to the bag to take close-up photos on your phone for your report.
   Why?

   Unsafe or not allowed. Unsafe. CISA says do not use cell phones close to a suspicious item and keep away from it. Police control the scene now, so stay where they put you.