Crowded Places Security Course (Australia): Lessons 2026

Lesson 1: Crowded places and the national strategy

Australia's Strategy for Protecting Crowded Places from Terrorism comes from the Australia-New Zealand Counter-Terrorism Committee (ANZCTC). It defines crowded places as locations easily accessible by large numbers of people on a predictable basis. Examples include shopping centres, stadiums, transport hubs, pubs and clubs, places of worship, tourist attractions, parks and pedestrian malls. Some are temporary, such as festivals.

Owners and operators have primary responsibility for protecting their sites. This includes a duty of care to people who work at, use or visit the site. State and territory governments lead the prevention of and response to attacks, and their police share threat information and advice with businesses.

Tools and guidelines

• Crowded Places Self-Assessment Tool: helps owners judge how attractive their site may be to an attacker. It is not a full risk assessment.
• Crowded Places Security Audit: a checklist used after the self-assessment to find gaps.
• Guidelines on hostile vehicles, improvised explosive devices, active armed offenders, chemical weapons and disrupting hostile reconnaissance.

States add their own programs. For example, Victoria encourages owners to join the Victoria Police SHIELD network, and South Australia encourages an SA Police self-assessment and security audit.

The national threat level

The National Terrorism Threat Advisory System has five levels: not expected, possible, probable, expected and certain. Probable means a greater than 50% chance of an onshore attack or attack planning in the next 12 months. The level can change, so check the official national security website for the current level.

Lesson 2: Spotting hostile reconnaissance

Attackers usually plan. Hostile reconnaissance is the purposeful observation of people, vehicles, buildings, places and spaces to gather information for an attack. Attackers fear failure, so they look for weak points and the best time to strike. Alert staff can disrupt this.

Possible signs

• Unusual or persistent questions about security measures and routines
• Covert photos of security features, staff or entrances
• Loitering or repeat visits with no clear purpose
• Avoiding staff or uniformed security, or leaving when noticed
• Tailgating into staff-only areas
• Bags left unattended
• Wearing fake or stolen uniforms

There may be an innocent reason for any of these. Your job is to notice, engage politely and report, not to accuse.

Deny, Detect, Deter

• Deny: limit what attackers can learn, for example by checking what photos, floor plans and security details of the site are online.
• Detect: make sure people know what to report and how, and that reports are taken seriously.
• Deter: honestly promote the site's security without giving away details.

Where there is no immediate threat, use a customer-service approach. Walk up and ask an open question such as "Can I help you?" Vague or evasive answers should be reported under your site's procedures.

Lesson 3: Who to call

Follow your site's reporting procedure and tell your supervisor or control room. Then use the right number:

Even if something seems "probably nothing", the smallest piece of information can help police. Write down what you saw, when and where, and a description of any people or vehicles.

Lesson 4: Suspicious items and vehicles

Most unattended items are simply lost or forgotten. To decide whether an item is suspicious, use the HOT questions:

• Hidden: has someone tried to conceal it, for example by pushing it out of sight?
• Obviously suspicious: does it have wires, batteries, leaks, strange smells or odd labels?
• Typical: is it out of place for this location, and does anyone nearby know whose it is?

If the item seems harmless, try to find the owner by asking people nearby and checking CCTV, then follow lost property procedures.

If an item is suspicious

1. Do not touch, tilt or tamper with it.
2. Do not use mobile phones or radios within 25 metres.
3. Move away, call 000 and tell security.
4. Cordon off the area and move people at least 100 metres away, or at least 500 metres for a suspicious vehicle, out of line of sight.
5. Record what it looks like and exactly where it is.
6. Follow the directions of emergency services.

Vehicles as weapons

The Hostile Vehicle Guidelines describe barriers, bollards and controlled vehicle entry points. They warn that attackers may use duress, forcing a guard or employee to open a barrier. Keep barrier controls away from the public and follow access procedures every time.

Lesson 5: Bomb threats

Treat every threat as real until proven otherwise. Making a threat is a criminal offence.

Threat by phone

1. Stay calm and keep the caller talking.
2. Note the caller's number if it shows.
3. Write down the exact words of the threat.
4. Ask where the bomb is, when it will go off and what it looks like.
5. Note the time the call ended, then tell security or your manager and call 000.
6. Complete the bomb threat checklist: voice, accent, background sounds.

Threat by email or social media

Do not reply to, forward or delete the message. Note the sender's address or username, call 000, save it and print a copy for police.

Evacuation

The incident or security manager decides on evacuation together with police. Assembly areas should be checked for secondary devices and kept clear. Outside, move away from windows and glass doors.

Lesson 6: Escape. Hide. Tell.

An active armed offender is an armed person actively trying to harm people. Australia's public advice is Escape. Hide. Tell.

Visitors may not recognise an attack or know the site layout, so trained staff and security should guide them using Escape. Hide. Tell.

When police arrive

• Follow their instructions. They may not know at first who the attacker is.
• Keep your hands visible and avoid quick movements or shouting.
• Stay hidden until police tell you it is safe to leave.
• Police may pass injured people while they search for the attacker.