"The threat you dismiss is the threat that finds you unprepared."
Incident Response to Terrorist Acts
Professor Sele: When a terrorist attack occurs at or near a client site, the security team's response in the first minutes determines how many people survive. This module covers the immediate actions, the command structure, and the post-incident obligations for SafeHaven personnel responding to a terrorist incident.
Section 1 — Immediate Response Priorities
In the first 60 seconds of a confirmed or suspected terrorist incident: Protect yourself — an injured or dead security operator helps no one. Alert — activate the emergency response: radio to Operations, call 911, initiate evacuation or shelter-in-place. Protect the principal (if on an EP deployment) — Cover → Communicate → Move. Clear the area — direct all persons away from the incident location. Do not approach the device or the attacker — secondary devices and secondary attackers are common CT tactics.
Section 2 — The METHANE Report
When contacting emergency services at a terrorist incident, use the METHANE format to provide a structured, complete situation report.
- MM — Major incident declared — confirm this is a major incident
- EE — Exact location — precise address, GPS co-ordinates, landmark
- TT — Type of incident — bomb, shooting, vehicle attack, etc.
- HH — Hazards present — fire, structural damage, secondary devices, armed attacker still active
- AA — Access routes — how emergency services should approach safely
- NN — Number of casualties — approximate count: dead, injured, walking wounded
- EE — Emergency services required — police, fire, ambulance, EOD
Section 3 — Secondary Attacks
Terrorists frequently use secondary devices or secondary attackers to target first responders and those evacuating from the primary attack. SafeHaven protocols: do not rush evacuation personnel toward a single exit — identify multiple safe routes; establish the assembly point at a safe distance from the incident and from likely secondary device positions; when directing evacuees, route them away from parked vehicles, waste bins, and other IED concealment points; maintain a defensive perimeter around the assembly point.
Section 4 — Post-Incident Obligations
After a terrorist incident involving a SafeHaven-protected asset: preserve the scene — this is a crime scene and evidence must be protected for law enforcement; account for all personnel and report any missing persons immediately; provide full co-operation with law enforcement investigations; submit a detailed incident intelligence report through SafeHaven's CT reporting channel; participate in the formal post-incident debrief; provide welfare support to all personnel involved.
- •First 60 seconds: protect yourself, alert, protect the principal, clear the area, do not approach the device
- •Use METHANE to report to emergency services: Major Incident, Exact Location, Type, Hazards, Access, Number, Emergency Services
- •Secondary attacks target first responders and evacuees — route evacuees away from IED concealment points
- •Post-incident: preserve the scene, account for personnel, co-operate with law enforcement, submit CT intelligence report
- •Welfare support for all involved personnel is mandatory after a terrorist incident
"The METHANE format exists because when you call 911 after a major incident, you are likely in shock, the scene is chaotic, and the dispatcher needs specific information in a specific order to deploy the right resources. I have practised METHANE until I can recite it in sequence while running. That is not an exaggeration. In a real incident the brain under adrenaline goes to what is most practised. Practise METHANE until it is the default."
The correct response by a private security operator who identifies a credible terrorist threat is to: