16 December 2004. Thanks to M.


[6 pages.]

UNCLASSIFIED//FOR OFFICIAL USE ONLY

November 2, 2004

[Image]

This is an FBI – DHS – HHS/CDC Coordinated Document

Guidance on Initial Responses to a Suspicious Letter / Container
With a Potential Biological Threat

A large number of potentially suspicious letters and packages continue to be reported to federal, state, and local law enforcement and emergency response agencies nationwide. In some instances these letters or packages may include powders, liquids, or other materials. Federal, state, and local response agencies should be mindful of the potential for small-scale exposure, which could result from material contained in threatening or suspicious packages. While this guidance is generally focused on the initial response to potential biological threats, all personnel responding to such incidents must be aware of the potential for exposure to hazardous chemical and/or radiological materials in addition to biological hazards. Additionally, there may be a threat posed from secondary releases or devices. Consistent with established protocols, response agencies should follow standard law enforcement procedures and hazard risk assessments in response to calls, and should pre-identify the relevant local public health points of contact to be notified in the event of a potential bioterrorism event.

The following guidelines are recommendations for local responders, based on existing procedures (including recommendations from the International Association of Fire Chiefs). This document provides guidance on the initial response to a suspicious letter/container, while other follow-on response plans, such as portions of the National Response Plan (NRP), may be utilized if a threat is deemed credible. In general, these potential threats or incidents fall into one of five general scenarios. They are as follows:

1. Letter/container with unknown powder-like substance and threatening communication (with or without illness):

Since there is an articulated threat, it is likely that the substance was intentionally introduced into the package in an effort to validate that threat. An articulated threat itself (with or without the presence of a suspicious substance) is a federal crime and may also constitute a violation under state and local statutes. The local Federal Bureau of Investigation (FBI) Weapons of Mass Destruction (WMD) Coordinator and/or FBI Joint Terrorism Task Force (JTTF), a certified HAZMAT unit, local law enforcement, and the local public health department should be notified. The role of Incident Commander (IC) will be assumed by the appropriate authority, as designated by state or local law. In many cases, the IC will be the most senior public safety officer (most likely the fire department chief or deputy chief, however, in many circumstances it may be a local sheriff or senior local or state police official). As such, it is the responsibility of the IC to establish the Incident Command System (ICS) and to ensure that notifications of the abovementioned responders have been made or are in the process of being made. As the referenced agencies arrive, the IC will evolve into a Unified Command, as necessary.

At this stage, and later again as necessary, the FBI will conduct a timely WMD threat assessment with local law enforcement/fire/HAZMAT personnel. Depending on the nature of the threat, this assessment may include relevant interagency partners. This process utilizes coordination from FBI Headquarters elements to conduct an initial assessment of the credibility of the threat and provide technical support to responders who are on-scene. In coordination with recommendations from the threat assessment process and the unified command on-scene, an appropriately trained HAZMAT unit should screen evidence for the presence of chemicals and radiological material and double-bag in clear sealed bags (where possible), consistent with chain-of-custody requirements. Before packaging and when possible, photographs of the letter/container should be taken and relevant information should be documented, in coordination with the FBI WMD Coordinator. Under NO CIRCUMSTANCES should an unprotected responder, such as a law enforcement officer, attempt to package an unknown substance.

If this incident involves an unopened container such as a box, it must be evaluated by a certified bomb technician/explosives ordinance disposal personnel prior to being handled by HAZMAT. Any such letters/packages must also be evaluated by the HAZMAT unit for only a broad class of radiological and chemical threats prior to being released to law enforcement personnel for transport. This is required by the laboratory in an effort to protect the staff members who will ultimately be opening the container and performing definitive biological testing and/or forensic examinations.

The FBI, or the responding law enforcement agency, will ensure that a certified HAZMAT team has performed necessary field safety screening before transporting to an appropriate laboratory. This field safety screening should be clearly documented and limited to screening for pH (for liquids), radioactivity, volatile organic compounds, flammable materials, and oxidizing agents. Definitive analysis will only be performed by the appropriate laboratory.

A chain-of-custody form must be initiated along with an incident report. The FBI will then coordinate delivery of the evidence to the designated Laboratory Response Network (LRN) laboratory for further testing and analysis.

If individuals immediately present with illness in this scenario, the public health departments will have an increased role in the initial response. These issues are further addressed in the ‘Critical Response Issues for Scenario #1’ included below.

If the FBI Headquarters-led threat credibility assessment process deems the threat to be credible, the FBI will immediately notify the Centers for Disease Control and Prevention (CDC), the Department of Homeland Security Operations Center (HSOC), and other appropriate federal agencies. Appropriate response guidelines to a credible threat will be utilized from the NRP, including the Biological Annex and Terrorism Incident Law Enforcement and Investigation Annex. Depending on the nature and scale of the incident, the Department of Homeland Security (DHS) may choose to help coordinate response activities based on NRP procedures which, at a minimum, may include coordinating a joint public affairs statement.

2. Letter/container with a threat but no visible powder or substances present:

Merely threatening the use of a chemical or biological agent is a violation of federal law and merits investigation. As in scenario #1, all of the responders should be notified. Although no powder may be visible to the eye, there could be trace amounts of material present that could represent a health risk and also provide critical forensic evidence required for further investigation and prosecution. Therefore, the guidance in Scenario #1 also applies to responses to a letter/container containing a threat with no visible powder or substance.

3. Letter/container with unknown powder, no articulated threat, and no illness:

As there is no threat and no one is ill, it must be determined if there is a logical explanation for the presence of this substance. For example, HAZMAT teams  have responded to a number of letters that contained crushed samples from vitamin and pain-relief companies. If a reasonable and defendable explanation can be given as to the source of the substance, that there is no articulated threat, and that no one is ill, then no further actions are necessary.

If, however, a reasonable source cannot be determined or there is any uncertainty, the steps outlined in scenario #1 must be conducted.

4. Letter/container with no visible powder, no threat, but recipients are ill:

This scenario has the most potential for ambiguity and confusion. Those who come in contact with Bacillus anthracis (anthrax), or other biological pathogens/toxins, may not immediately appear symptomatic. Although no powder or substance may be available to be collected for environmental testing, public health officials may decide to utilize clinical samples from potentially exposed individuals. Additionally, in this scenario it may be difficult to determine if a letter/container is actually associated with the illness. As there is no specific threat to investigate, this is primarily a public health and medical issue; but this scenario also represents a potential criminal act that should be jointly investigated by public health and law enforcement. The initial notifications will largely be the same as scenario #1, with public health taking a primary role in the response. While the primary concern is the treatment and well-being of the recipient, public health and law enforcement should maintain close contact, while public health determines the nature of the illness and law enforcement examines any relevant intelligence. Depending on the scale and nature of the incident, if HHS/CDC is notified they will maintain close contact and coordinate with DHS. If a potential criminal nexus is identified, the FBI will conduct an initial threat assessment and initiate appropriate actions and notifications listed under scenario #1.

5. Letter/container arrives with no powder, no threat, the recipient is not ill, but the recipient is concerned about the package:

With strict regard to federal criminal statutes, no investigative actions are necessary in this matter. However, if other threat indicators are present such as excess postage, misspelled names, unusual odors/colors, etc., law enforcement and the United States Postal Inspection Service should be notified to evaluate it for potential hazards. If the assessment determines that the letter/container is “suspicious,” then appropriate steps outlined in scenario #1 would be initiated.

Critical Response Issues for Scenario #1:

1. Request the assistance of the nearest certified hazardous materials response team to conduct risk assessments, field safety screening, sample (evidence) collection, decontamination, and other mitigation activities. Any sample (evidence) collection must be coordinated with law enforcement (FBI).

2. Notify appropriate law enforcement (local, state and local FBI WMD coordinator/JTTF, postal inspectors) when a potential threat is identified.

3. Do not touch, move, or open any suspicious package until an initial hazard risk assessment of the package can be performed in coordination with HAZMAT personnel and law enforcement.

4. An initial threat credibility assessment will be coordinated via the local FBI WMD Coordinator and the FBI Counterterrorism Division’s Weapons of Mass Destruction Operations Unit (WMDOU). This will include the FBI Laboratory Division, Hazardous Materials Response Unit (HMRU) and other select interagency subject matter experts, tailored for the specific threat. This assessment includes an analysis of technical feasibility, operational practicability, behavioral resolve, and examination of any intelligence that might relate to the threat. If the threat is determined to be credible, other appropriate federal agencies will be notified, to include DHS and HHS/CDC. Additional information on this process is available from the NRP, including the Biological Annex and Terrorism Incident Law Enforcement and Investigation Annex.

5. Contact your local public health department (who should in turn notify state authorities and the CDC) if there is a threat of public health exposure or environmental contamination exists. HHS/CDC will then notify the HSOC, where appropriate.

6. In coordination with law enforcement, always notify the U.S. Postal Inspection Service, whenever it appears that the threat was delivered through the U.S. Postal Service. Assist with ensuring that origin and tracking information is obtained from the package (ideally, photographs of the front and back).

7. Treat the scene as a crime scene. Preserve evidence in coordination with law enforcement and ensure that materials are safely packaged. Take steps to retain enough suspicious material for:

a. Laboratory analysis;

b. Forensic examination of criminal evidence, regardless of whether the threat is ultimately determined to be accompanied by a hazardous material.

8. Transfer custody of evidence to a law enforcement officer as soon as possible. Maintain chain of custody by obtaining a record of names and signatures every time custody of a suspicious material or sample for laboratory analysis changes hands.

9. Perform basic field safety screening of the substance to rule out explosives, radiation, flammability, corrosives, and volatile organic compounds prior to transporting the materials to the appropriate LRN, as coordinated with the FBI WMD Coordinator. All field safety screening that is performed by responders should be clearly documented and shared with law enforcement and the LRN.

10. In coordination with the local FBI WMD Coordinator (and/or a responding law enforcement entity), transport samples to the designated CDC-qualified LRN facility. If field safety screening detects the presence of chemical or radiological hazards, the FBI WMD Coordinator will contact FBI Headquarters for guidance regarding which laboratory is appropriate to perform the analysis. This will be done as part of the threat credibility assessment process noted above (see #4).

11. In coordination with public health and law enforcement, identify and list the names and contact information for anyone who may have been exposed to the suspicious substance so that they may be contacted when the LRN test results are available or if there is other additional information. If positive results are obtained, state and local public health departments will need to contact those potentially exposed as soon as possible to provide appropriate assistance (e.g., antibiotics, education, additional testing, vaccination, surveillance/symptom reporting).

12. In coordination with the FBI, identify a single point-of-contact for incident follow-up.

13. If LRN tests identify positive results for threat agents or a threat is determined to be credible, the FBI will immediately notify the DHS and other appropriate federal agencies to initiate relevant NRP actions, as necessary. The DHS will work closely with the FBI, HHS/CDC and other agencies to ensure a coordinated response.

Note on field screening

Once activities are complete to address immediate public safety concerns, every effort must be made to preserve evidence necessary for public health and law enforcement investigations.

In situations where biological threat agents are suspected, the item(s) should be field safety screened and immediately transported in law enforcement custody to an LRN laboratory. This should be done in coordination with the local FBI WMD Coordinator.

Field safety screening should be limited to ruling out explosive devices, radiological materials, corrosive materials and volatile organic compounds. Currently, there are no definitive field tests for identifying biological agents. Additional field testing can mislead response efforts by providing incorrect or incomplete results, and destroy limited materials critical for  definitive laboratory testing required to facilitate any appropriate public health and law enforcement response.

This information is provided for guidance. Questions related to the content of this document can be addressed to: Scott Steele, Ph.D., Counterterrorism Division, WMD Countermeasures Unit, Federal Bureau of Investigation, E-mail: ssteele2@leo.gov.