Your browser is not supported

Your browser is too old. To use this website, please use Chrome or Firefox.

Suspicious Incident Awareness & Physical Security

 With recent and unfortunate security incidents occurring in Canada, coupled with an ongoing Pandemic, proactive public & private sector security programs managers are educating their front line security staff, as well as business units across their organization.  Front Line Security is being briefed on situational awareness tactics in recognizing suspicious incidents, and immediately reporting them during times of heightened risk / threats.

Senior Managers in business units that work hand in hand with your organization are being similarly briefed

Business units like customer service staff and operations personnel have a significant role also….these are front line staff with eyes and ears close to the ground.

Security leaders responsible for protecting critical infrastructure to mass assembly facilities, security staff need to be open in their view of Suspicious incidents, and be vigilant;

Eliciting Information

Front line security recognizing person(s) seeking information about your facility security, specific company details or personal information about your facility / employees; this includes individuals probing employees in person on- or off-site, over the phone, or via the Internet, including social media about particular structures, building systems, and personnel procedures at the facility or its IT systems.

An example of this would be your shopping Centre Security Dispatch Office receives a telephone call, from an apparent student, and that he/she is doing a school project on Shopping Centre Security and requests information on how many security guards work at the Centre, with further questions posed about your security.  The conversation may be informal and appear innocent, and the call continues to discuss how many are on duty at any given time.  Trained and aware security staff would recognize this as suspicious and take actions to report it.


Taking still or moving (video) pictures of a facility / infrastructure / personnel or surrounding environment.  An example of this would be an unknown individual appears to be taking pictures of the beautiful décor and architecture found within your shopping centre.  Only after monitoring and paying closer attention –  person is photographing entrances, supporting columns, pillars, and security guard patrol routes.

 Observation / Surveillance

Showing unusual interest in a facility / infrastructure / personnel; for example, observing it through binoculars, taking notes, drawing maps, or drawing structures of a facility. Included monitoring the activity of people, facilities, processes or systems, and employee private residences.

While on routine patrol, at 8:45 PM  to 9:15 PM: for the last three days, on-site Security Guard has noticed that the same individual has been window shopping in the same area  – of a jewelry store.  Upon closer investigation, individual is monitoring the closing procedures of the jewelry store and noting security presence or lack thereof.


Unauthorized individual attempting to enter a restricted area or system or protected site; includes through impersonation of authorized personnel (ex: police/ security, janitor)

10:23 PM While on routine rear corridor patrol, TEC Security notes an individual who is well dressed, appears lost and states that they are looking for a public washroom.  Although probably innocent, remember, the TEC rear corridor system provides access to natural gas valves, electrical and mechanical rooms etc.

 Attempted Intrusion

Unauthorized individual attempting to enter a restricted area or system or protected site; includes through impersonation of authorized personnel (ex: police/ security, janitor)

Person dressed in construction clothes is observed walking on the retail centre roof by patrolling Security.  Although the person “looks” the part, Proactive Security Guard approaches and determines inaccuracies with the story of why the male is on the roof

Theft / Loss / Diversions / Questionable Possession

Stealing or diverting something associated with a your facility, or possessing actual or fraudulent facility-specific articles (ex: uniforms, keys, access badges, identification, vehicles, technology, documents which are proprietary to the facility.

Operations Manager advises that one of his / her employees is missing three of his uniforms from his locker.  Manager further advises that he believes that his locker was left open during the evening.


Presenting false or misusing insignia, documents, and/or identification, to misrepresent one’s affiliation to cover possible illicit activity.

An individual enters the building control centre and presents a business card stating they are from Ontario Hydro (Hydro Inspector) requesting access to the Main Electrical Room.  The male is wearing an Orange Visibility vest and hard hat.

Testing of Security

Interactions with, or challenges to installations, personnel, or systems that reveal physical, personnel or cyber security capabilities.

Retail Patron reports to Security Supervisor that their bag was stolen from an area within the retail centre.  The patron requests to have someone review the Security Camera System for coverage of the area.  Patron is distraught regarding the missing items but seems more interested in the camera coverage than the missing items.

Testing of Emergency Services / Response

Apparent testing or observation of emergency services / response.

Security finds a suspicious package that is “overly” suspicious (almost with purpose) so it will be investigated.  The response and evacuation process is then monitored to identify response capabilities, Emergency Equipment locations and possibly Emergency Services response locations and occupant evacuation assembly areas.

 Express or Implied Threat

Making or communication a spoken or written threat to damage or compromise a facility / infrastructure (including employees/public)

A recently terminated employee – in apparent gest – makes a threat that they should “blow-up” the building.

 Sabotage / Tampering / Vandalism

Damaging, manipulating, or defacing part of a facility/ infrastructure or protected site with malicious intent.

Minor damage reports may be a significant sign of a larger picture.  Example – Damage to perimeter lighting may occur to reduce visibility of CCTV coverage due to reduced light.  Damage of unknown origin may also be reviewed as suspicious.

Suspicious Substance

Discovery of an actual or possible unknown substance (such as a powder, liquid, solid, or gas) at or near a facility

While on routine patrol, Security Guard notices a box with obvious oil stains with numerous words on the box that are not common to the environment and contains an unknown liquid in a plastic bag.

 Suspicious Item / Package

Discovery of a suspicious unattended item/package at or near a facility

The discovery of a suspicious item / package is often disregarded as simply that – suspicious with no threat.  A dirty gym bag is noticed along the exterior perimeter of the shopping centre.  The bag is old and dirty contains a length of dirty rope and two used gloves.

Leave a Reply

Your email address will not be published. Required fields are marked *