1. Guidance for the public

No unattended item should be ignored, but should always be assessed proportionately, considering what can be seen and anything you know about its discovery. For example, in the case of unattended hand luggage, it may be possible to ask if its owner is nearby.

However, when an item has been hidden from view deliberately, or has visual clues suggesting it may be hazardous – wires, circuit boards, batteries, adhesive tape, liquids, putty-like or unusual substances etc. – or has been found after a suspicious event, an immediate and focused response is required. This will involve telling someone what you have seen and why you think it is suspicious.

If you believe any unattended item represents a potential risk to life, you must report it as soon as possible and alert those nearby.


unattended bag


When dealing with suspicious items, the following steps should be taken:

  • do not touch it

  • if you are in an owned public space, or a managed building, report it to a member of staff or security, if available. If they are not available, dial 999 but do not use your mobile phone within 15 metres of the suspicious item and place yourself out of sight of the item

  • if you believe there may be a risk to life, move away at least 100 metres from the item. Even for a small item, such as a rucksack, 100 metres is the recommended minimum evacuation distance, but always follow any directions given by the police or security staff. See Guidance for Staff for a full breakdown of evacuation distances.

  • once at a safe distance, stay behind hard cover and away from secondary hazards, such as glazed areas or parked vehicles, and do not re-enter the evacuated area until the police direct it is safe to do so

Remember: If you think it’s suspicious, say something.


2. Guidance for staff

Unattended and suspicious items can be encountered in any crowded or public place, such as a football stadium, shopping centre, transport hub or large public event. It is vital that a documented local plan and relevant procedures are in place to deal with the risk. To make sure the plan is effective, proportionate and takes into account new information, those responsible for assessing unattended items must be briefed accordingly and have received training in what is normal, what is unusual, what is potentially suspicious and what to do about it.

When dealing with suspicious items apply the 4 Cs protocol:


Confirm Communicate Clear Control


Confirm – whether or not the item has suspicious characteristics.

  • The HOT Protocol may assist with the ‘confirm’ process. In particular, consider whether the item is:



  • has the item been deliberately hidden, or has a deliberate attempt been made to conceal it from view?


Obviously suspicious?

  • are there wires, circuit boards, batteries, tape, liquids or putty-like substances visible? Could it be an Improvised Explosive Device (IED)?

  • has the item been found after seeing suspicious behaviour? Check with others in the area and use CCTV, if available

  • based upon what you can see, do you think the item poses an immediate threat to life? 


Typical of what you would expect to find in this location?

  • most lost property is found in locations where people congregate or wait, so ask if anyone nearby has left the item or saw who did. Check and see if maintenance staff have been working at the location

  • if the item is assessed to be unattended rather than suspicious, then examine further, paying particular attention to the contents, before applying lost property procedures. 


However, if you believe the item represents a possible risk to life, then follow the protocol as follows:


Clear – the immediate area

  • do not touch it further

  • take charge and move people away from the hazard. Move at least 100 meters away from a small item, such as a rucksack; at least 200 metres away from a small vehicle or large item, such as a car or a wheelie bin; and at least 400 metres away from a large vehicle, such as a van or lorry

  • keep yourself and other people out of line of sight of the item. It is a broad rule, but generally, you are better protected from fragmentation if you are behind hard cover and cannot see the item

  • think about what you can shelter behind. Pick something substantial, such as concrete or brick, and keep away from glass such as windows and skylights

  • cordon off the area as best you can in advance of police attendance

Communicate – call 999

  • inform your control room and/or supervisor and be prepared to explain why you consider the item suspicious

  • do not use radios or phones within 15 metres of the item and place yourself out of line of sight

Control – access to the cordoned area

  • members of the public should not be able to approach the area until it is deemed safe

  • try and keep eyewitnesses on hand so they can tell police what they saw, or try and get contact details before witnesses move away.


See our guidance in printable, poster format to easily advise others with actionable information:

Unattended and Suspicious Items Action Card

NPSA (formerly CPNI) have produced a film which introduces steps security staff within organisations should take once an unattended bag has been identified on their establishments.  NPSA film - Unattended and suspicious items.


Risk Management
HOT principle
PALs Guidance
publicly accessible locations
publicly accessible places
Suspicious Behaviour
Suspicious Item
ProtectUK publication date