The short answer
Treat every unattended object as an operational lead first, not a finished verdict. Run three questions before escalating: is it hidden, is it obviously suspicious, and is it typical of this location? Only when the item is deliberately concealed or shows hazardous cues such as wiring or batteries do you move from a routine lost-property task to a live incident and apply the 4 Cs: confirm, clear, communicate, control.
Key takeaways
- On a large site the default reading of an unattended item is operational: ask staff, check CCTV and try to find the owner before treating anything as an incident.
- The HOT test — is it Hidden, Obviously suspicious, Typical of this place — separates a routine loss from a threat before anyone evacuates.
- Escalate only on observable signals: deliberate concealment, visible wiring or unusual substances, or discovery right after suspicious behaviour.
- When escalation is justified, work in the 4 Cs order — Confirm, Clear, Communicate, Control — and do not touch the item or radio near it.
- A control room that logs and verifies every sighting turns vague observations into accountable staff tasks and auditable decisions.
- Distances and phone numbers in guidance are jurisdiction-specific; your site plan must set and periodically re-verify its own figures.
A sighting is a decision, not a verdict
On large territories most unattended objects are boring: a delivery left near the gate, a worker's tool bag, a passenger's forgotten rucksack, a maintenance crate on a platform. If every sighting triggered a full evacuation, the site would spend its budget on false alarms and still miss the genuine threats among the noise. The professional habit is to read a sighting as an open question that must be closed with evidence, not as an automatic incident.
Two failures are symmetrical. The first is escalation bias: declaring every object an emergency and evacuating often, which is costly, trains staff to stop discriminating, and in some jurisdictions carries legal consequences for knowingly false reports. The second is normalcy bias: assuming that anything left by staff or a regular is harmless — exactly the assumption that deliberate concealment exploits. Sound triage sits between the two and rests on checkable cues rather than feeling.
Decisions should be reproducible: given the same observations, two officers should reach close to the same conclusion. That requires written criteria and short, repeated training in what is normal, what is unusual and what is potentially suspicious in the places they guard.
- Escalation bias and normalcy bias are the two classic failure modes.
- Written criteria and drill training make triage reproducible across a shift.
The HOT test: three questions before you escalate
Before raising an alarm, ask three questions in a fixed order. First, is the item Hidden — deliberately tucked away, pushed under something, or otherwise concealed from view? Second, is it Obviously suspicious — are wires, circuit boards, batteries, tape, liquids or putty-like substances visible, or was it found right after someone acted oddly and left quickly? Third, is it Typical of what you would expect in this location, since most lost property appears where people wait and congregate?
If an item lies openly in an ordinary spot and nobody claims it, that is a find, not a threat. Ask the people nearby whether anyone saw who left it, check whether maintenance staff have been working at that point, and review CCTV to establish who placed the object and how long it has stood there. Only when these checks fail and suspicious cues remain does the object graduate to the next level.
This is the essence of the HOT principle used in UK police and protective-security guidance, and it translates directly to any territory: the same three questions, asked about the same object, in the same order. The discipline is to ask before acting, not after.
- Hidden: has the object been deliberately concealed or covered?
- Obviously suspicious: visible wiring, components, tape, liquids, odd substances, or a link to strange behaviour.
- Typical: does it belong where it is, given what people normally carry and leave there?
- CCTV review and witness checks are part of the first step, not an afterthought.
When suspicion is real: the 4 Cs protocol
If the object is judged suspicious, improvisation stops. The 4 Cs order is Confirm, Clear, Communicate, Control. Confirm means you have looked at the cues and determined a possible risk to life. Clear means moving people away from the hazard and out of line of sight, keeping them behind substantial cover such as concrete or brick and away from glazing. Communicate means telling your control room or supervisor why the item is suspicious and, where required, calling the emergency number without using a radio or phone close to the item. Control means keeping people out of the cordoned area until the police or a bomb technician declares it safe.
Guidance on evacuation distances is jurisdiction-specific and must be adopted into your own site plan. As a widely used reference, UK police guidance suggests about 100 metres for a small item such as a rucksack, around 200 metres for a car or wheelie bin, and about 400 metres for a van or lorry, with no radio use within roughly 15 metres and never in line of sight. Your organization should publish its own confirmed figures and re-verify them when plans change.
Keep eyewitnesses available so they can tell responding officers what they saw, or capture their contact details before they drift away. Even a small, ordinary-looking object can warrant the full protocol if it was deliberately hidden or appeared immediately after threatening behaviour.
- Confirm the cues, then Clear the area, Communicate the finding, Control access.
- Stay out of line of sight and behind hard cover; keep clear of glass.
- No radios or phones near the item; move a safe distance first.
- Reference distances (100/200/400 m in UK guidance) are illustrative — adopt your own in the site plan.
- Retain eyewitnesses or their contact details for the police.
Closing a benign case without shortcuts
The most undervalued step is closing a harmless find correctly. If the owner is found, the item is returned and the record — date, time, location, responsible person — is closed. If no owner appears, the item is logged and routed through lost-property handling. Either way the observation is carried to completion rather than left to drift.
It matters to keep two statuses apart: 'not suspicious' does not mean 'may be ignored'. It means the item follows the routine path with registration and verification. A skipped step — an object noticed but never logged or checked — quietly converts an operations task into an unaccounted risk that nobody owns and nobody can explain later.
Where cameras cover the site, use the footage to understand who left the item and for how long it has sat there. That recording is both evidence of a conscientious check and material for review if the assessment later proves wrong. Routine handling is itself a controllable, measurable activity rather than a clerical afterthought.
- 'Not suspicious' routes the item into lost-property handling; it never means 'no action'.
- Every sighting is logged with time, place, owner and outcome.
- Returning to an owner or routing to storage must be recorded, not assumed.
- CCTV confirms diligence and supports the review if the assessment changes.
Running triage at scale: cameras, roles and standard operating procedures
Scale changes the task. A single post can walk up to an item, but the duty supervisor on a large territory handles a flow of signals from cameras and patrols. What is needed is a documented plan, a shared log and clear accountability. A camera that spots an unattended object should produce a specific check task with an owner and a deadline — a verifiable staff task — rather than remain an unprocessed observation.
Splitting roles reduces error: the camera operator records and passes on the fact, the patrol officer performs the three-question check, and the shift supervisor decides on escalation. Nobody silently plays every role, and each step is visible in the log. This distinction between a passive sighting and a managed operations task is what keeps a large site consistent at three in the morning and at peak hours alike.
Run the scenario in exercises: a deliberately forgotten item, a find near a service entrance, an object appearing after odd behaviour. The point is not to memorise figures but to make the habit of asking 'hidden, obviously suspicious, typical?' automatic before anyone decides. Schedules and venue plans change, so always verify the current version of your site plan and the applicable emergency numbers rather than relying on a remembered copy.
- A camera sighting becomes a check task with an owner and a deadline.
- Roles are separated: record, verify, decide — all in one shared log.
- Exercises build the triage habit instead of reflexive alarm.
- Re-verify the current site plan and emergency numbers whenever schedules change.
Put it into practice
Unattended Item Triage Card (decision matrix)
A pocket matrix for the officer on patrol and the duty supervisor: read the observed cue, then take the listed action. Keep it at the post and in the shift vehicle, and enter every case in the incident log with time and owner.
- Open item in a waiting or congregation point, owner unknown → ask nearby people and staff, check CCTV; if explained, return it and close the task as a routine find.
- Item resembles a work tool or material, but no work is scheduled at that spot → confirm with maintenance and the works log before treating it as lost property.
- Item is deliberately hidden, pushed under cover or masked → treat as suspicious: do not touch, begin clearing people.
- Wiring, circuit boards, batteries, tape, liquids or putty-like substances are visible → suspicious: do not inspect contents, notify the duty supervisor.
- Item appears right after someone acted oddly or dumped it and walked away → suspicious regardless of appearance: cross-check witnesses and camera footage.
- Owner is found and the item is ordinary → return it and close the log entry; 'not suspicious' still requires registration.
- A radio or phone call is needed near the item → move to a safe distance behind cover first, then transmit.
- Escalation decision (evacuation and emergency call) belongs to the shift supervisor after cues are confirmed → record decision time and name.
- Evacuation → use exits opposite the find, assemble at the set distance, and verify everyone has left the building.
- After the incident → hand responding officers the time, location and witness details; complete a written review and close the log.
Questions people ask
What is the difference between an operations task and a security incident for an unattended item?
An operations task is a verifiable routine path: the item is checked against a few cues, witnesses and staff are asked, CCTV is reviewed, the owner is found or the object is routed to lost property, and the case closes with a log entry. An incident begins only when the same cues mark the item as suspicious — then a fixed protocol takes over: do not touch, clear people away, communicate to control, and restrict access until specialists arrive. The difference is the verified status of the object, not the observer's anxiety.
Which cues make an unattended item suspicious rather than just lost?
Practice groups them in three ways. First, the item is deliberately hidden or concealed from view. Second, it shows components unusual for the location — visible wiring, circuit boards, batteries, tape, liquids or putty-like substances. Third, it appears immediately after someone behaved suspiciously or dumped it and left. If none of these cues applies and the object is typical of the place, handle it as ordinary lost property rather than an emergency.
The owner is not found, but the item looks normal. What should I do?
Treat it as a routine case, not an incident. Ask people nearby and the staff who work at that point, and check whether maintenance has been active there. If there is still no explanation, record the time and place, register the item and route it through lost-property handling or storage. The key is not to leave the sighting unresolved: every case should close with a log entry naming the responsible person.
Should I use my phone or radio near an unattended item that seems suspicious?
No. Guidance from protective-security authorities recommends staying well away from the item before transmitting, because signals from a phone or radio are a consideration near a possible device. Move at least to the distance your site plan sets — commonly tens of metres and out of line of sight — and only then call your control room or the emergency number, clearly explaining why you consider the item suspicious.
Who authorizes evacuation and calling the emergency services?
Typically the shift supervisor or the manager named in the site plan, acting with the duty post after the suspicious cues are confirmed rather than on the first sighting. Responding officers and bomb technicians then decide whether the area is safe. Your plan should name the authorized decision-maker and the escalation path in advance, because hesitation in a confirmed case and reflex alarm in a routine one are equally costly.
Are the evacuation distances in guidance mandatory?
Published figures are recommendations from specific jurisdictions, not universal legal requirements. For example, UK police guidance commonly cites roughly 100 metres for a small item, 200 metres for a car and 400 metres for a large vehicle. You should adopt these as the starting point but publish your own confirmed distances in the site plan, based on the building layout, cover and local practice, and re-verify them whenever the plan or the venue changes.
Sources and further reading
Sources were checked when this page was generated. Confirm changing dates, rules and prices with the original publisher.
- Venues and Public Spaces guidance: Unattended and suspicious itemsProtectUK / National Counter Terrorism Security Office
- Unattended or Suspicious Items – Steps to Take (video guidance)National Protective Security Authority (NPSA)
- APTA SS-SRM-RP-007-12: Recognizing and Responding to Unattended Packages, Objects and BaggageAmerican Public Transportation Association
- Если обнаружен подозрительный предметГлавное управление МЧС России по Амурской области
- Памятка по действиям персонала организации при обнаружении предметов, в которых могут находиться взрывные устройстваАдминистрация Шолоховского городского поселения (антитеррористическая комиссия)
- Порядок действий граждан при обнаружении подозрительных и оставленных без присмотра предметовАдминистрация Ровеньского района Белгородской области