Thousands of companies receive mail-borne threats every year. The Hollywood version of the people who send these–usually foreign-born terrorists–is wildly inaccurate.
In fact, most threats are sent by people intimately involved with the organizations and the people targeted.
Each of the events below represents an emotion that drove a person to make a specific mail threat incident and how the situation played out.
They are examples of how stressors and the real world interact. Human beings are all different and some act out when an individual’s sensitivities are touched uncomfortably.
Often, these seem out of place from how someone who knows the perpetrator thinks they would act and why actions seem baffling.
It’s for these reasons that we recommend that every corporate security and executive protection program include mail security.
Statements like “Nobody saw this coming.” or “He/she isn’t this kind of person” are common and unfortunately leave us with no insight into why the perpetrator acted that way.
But there are reasons — 7 of them, in fact. RaySecur CSO Will Plummer breaks down each of the 7 emotions in this detailed piece.
Revenge
“Subway Restaurants’ Milford, Conn., headquarters received a package with a powdery substance on Thursday that’s being investigated by the local police and the Federal Bureau of Investigation, The Post has learned.
The police and Subway executives believe the package could have been sent by a recently laid-off Subway employee.”
— New York Post – May 29, 2020 – Milford, CT
Organizations that layoff or fire employees, or change out a workforce for a new internal or external one, are a huge potential target. Revenge-fueled threats usually are grandiose with an attempt to get the organization in the news.
The intent is to harm the target’s social capital and brand and cause monetary loss to the perceived offender.
“Revenge is the motivation that most often triggers a letter or package bomb, or a bomb threat.”
— US Postal Inspection Service, 2019
“USPIS Guide to Mail Center Security,” pg. 14
The threat comes from a personal injustice felt by the perpetrator. This will most likely show up when there is groupthink and the possibility of “getting away with it” increases.
The likelihood of immediate involvement with federal authorities and a significant chance of a quick apprehension is ignored. These threats will be extreme in their presentation and most likely easy to detect with a deliberate screening effort.
Corporations and governments must remember to implement mail security program into their standard security practices.
Anger
“A Chicago news station in a six-story building received a suspicious package, a 9-by-12-inch envelope. The envelope was delivered to the Daily Herald office by the United States Postal Service.
An angry political message was written on the envelope. When the envelope was opened, white powder fell out, and the material was placed in a garbage bag and tied up. Someone at the Daily Herald then called 9-1-1.”
— Journal and Topics – Jan 16, 2020 – Arlington, IL
High-visibility organizations like the Daily Herald, Fox News, Twitter, and The Washington Post are more likely to provoke strong emotions and be the target of an attack.
A white powder event is the most common mail-borne threat if someone wants to shut down a facility. Whether a real threat or hoax, it is most likely to be delivered by the United States Postal Criminal Service.
The USPS will deliver packages less than 10 ounces in weight and half an inch thick dropped into anonymous, curbside collection boxes and paid for with stamps.
The angry political messages on the outside of the package would not be accepted at a counter with an employee screening each package and entering the sender’s information into their respective systems.
Unless the newspaper or TV station is highly political or the anchors are speaking out in a manner to insight unexpected reactions, threats like this are a way to get a message on the news.
In this case, though, this organization and the others that reported on it did exactly the opposite: they kept the message private, minimizing the chance of a repeat occurrence.
While local news agencies reported on the threat, they did not sensationalize whatever aggressive message the sender intended.
Criminal
“The scene has been cleared after Hazmat responded to a situation at the Franklin County Common Pleas Court on Thursday evening.
According to Columbus Fire Battalion Chief Steve Martin, crews were called to the building located on South High Street shortly before 6 p.m. Martin says an undetermined powder was sent to the judge through the mail, which led to the Hazmat response. He says that the powder was found to be not dangerous.”
— WBNS-10TV News – Feb 21, 2020 – Columbus, OH
Threats will most often present themselves in a form that provides the least amount of evidence linking it to the sender: very likely a small USPS stamped package sent from a false address and with a fake name.
A package would most likely appear benign to get through all scrutiny, only to expose the threat once in the hands of the target.
Maintaining and continually updating a list of high-risk targets, such as judges, is a good start on detecting and preventing such attacks.
Friendship
“Tuesday, March 17th, an officer working in the packaging room was processing a package shipped to an inmate. The officer reportedly noticed a can of collard greens that looked suspicious.
After opening the can, the officer reportedly detected a ‘chemical smell’ and a green leafy substance inside the can. After being tested, it was confirmed the substance tested positive for synthetic marijuana. The total amount seized weighed 3.9 pounds.”
— WENY News – Mar 24, 2020 – Elmira, NY
In this case one person’s mail-borne threat (contraband) may be another person’s act of friendship. Prisons face the ingenuity of those both inside and outside of the walls.
People targeting jails and prisons have a power that most other bad actors do not have. They have time to think, plan, and patiently execute plans to get illicit items through a series of security measures.
The staff is stuck combatting cunning efforts. However, there is a positive side to both profiling and mitigating incoming threats. In profiling threats, the administration has two significant advantages.
First, the staff has time not only to look at the packages that come through but the entire background on the subjects within the facility. This can be used to focus on the most likely offenders and use more appropriate methods on the lower threat individuals.
The second advantage the officer has is the restriction on un-authorized items or contraband items within the detention facility. They simply have the means to control what can actually get into the facility.
Political Passions
“Police say no explosives were found Tuesday in a package mailed to a Roseville church that had garnered scorn online after it hosted in-person services last weekend as the state sheltered in place to slow the spread of coronavirus.
The church’s pastor, Doug Bird, said the box was sent by Priority Mail and had a return address name label. He would not disclose the name at the request of the police.”
— The Sacramento Bee – Apr 7, 2020 – Roseville, CA
Public opinion in times of stress increases sensitivity to the rules and encourages the need to enforce the group’s requirements. In this case a congregation, because of their internal values, chose to defy the standing order of the state.
As a result, it can expect a potential response.
Regardless of the reasoning, the threat means that the perpetrator most likely feels that they stand on a moral or ethical “high ground.”
When an organization acts or makes statements that come from a possibly polarized position, they can expect a strong 180-degree opposite response.
In this example, the church and police actually had the name of the individual that sent the threat on the package. Most likely it was not intended to maim but to send a message and let them know that there is opposition to the church’s action.
Profiling this threat, from an objective position, means there was little chance this threat was not meant to elicit at a minimum a “spectacle.”
Getting the news involved was most likely not the goal. Sending a message to the pastor and his flock was and should have been expected.
Prejudice
“A Japanese cookware store in Torrance received a racist letter containing a bomb threat, and the Torrance Police Department is investigating the hate crime, it was reported Tuesday.
The store’s owner, who asked that its name not be released, received a letter that said ‘go back to Japan…We are going to bomb your store if you don’t listen and we know where you live.’”
— My News LA – Jun 16, 2020 – Torrance, CA
When profiling, sometimes the immediate response can easily misrepresent itself. The immediate reaction to a “bomb threat” is scripted and in most scenarios mandated both by function and means.
What follows once the threat, and it most often is just a threat, is confirmed to be unfounded is the real reason why it was sent.
In events where there seems to be no correlation between the reported threat and the target, often the most basic instincts are behind the action.
An Asian store in the middle of a pandemic with racially charged emotions about the pandemic’s source creeps into the forefront of the profile. Some people won’t care which Asian country their target is from, they are simply “Asian” and “other.”
The bomb threat is the form of the message and, even if it’s an irrational emotion, if handled inappropriately it can cause an increase in copycat threats targeting similar sites.
Paying attention to the appropriate information in the assessment process and not grasping on the “How” will support figuring out the “Why”, and that provides insight into the “Who.”
This is critical to success and forces an open mind to the reality that a threat can “creep” into areas that are simply not there. Sometimes the answer is not something a rational person would come to at first glance and it is something as simple as racism.
Stupidity
“The FBI is examining a powdery substance whose delivery to the Riverside field office. The package had the office’s address on it, but the address did not name the FBI as the recipient, FBI spokeswoman Laura Eimiller said.
She said the FBI was not immediately sure whether the substance, which Eimiller described as ‘powdery,’ was toxic.”
— The Press-Enterprise, May 6, 2020 – Riverside, CA
Why draw the attention of the lead investigative force within the US by directing a threat at them? The bottom line is that it’s hard to plan against stupid. Things will fly in out of left field and flexibility in all plans is critical to success.
No plan survives the first contact with an opponent, so flexibility is key and sometimes smiling and enjoying that stupidity makes a difficult job a little easier. Embrace easy as it tends to be fleeting.
What now?
All the planning and profiling in the world cannot prevent threats from presenting themselves.
The reality is that the other side gets a vote and you cannot fully know what they are thinking and feeling and what form the threat will take until it arrives.
Planning efforts cannot solve, prevent, nor manage all of the options but working through your opponents’ thought processes and desired outcomes opens your mind to the problem.
What a bit of profiling can do is bring everyone into the same game.
Instead of baseball versus hockey, the security professional who profiles the threats properly is wearing pads and skates and not just standing on the ice with a baseball mitt.
It makes you that much more prepared.