ACT Awareness e-Learning: Free Counter-Terrorism Training for the Public

The ACT Awareness e-Learning course is a free counter-terrorism awareness course from Counter Terrorism Policing, open to anyone in the UK. It is designed for all UK based companies and organisations and also for the general public, including people who work in venues and public spaces¹. You do not need any security background, and there is nothing to pay.

The course takes just 45 minutes in total to complete, and it can be divided into short sections, so you can do a little at a time and come back to it later¹. Counter Terrorism Policing describes those 45 minutes as time that could save lives¹. In exchange, you get nationally recognised counter-terrorism guidance that increases your understanding of current terrorist methodology and helps mitigate against the risk².

The course sits alongside the wider ACT (Action Counters Terrorism) campaign, which asks one thing of the public: if you have seen or heard something that could potentially be related to terrorism, trust your instincts and report it³. This page explains what the course covers, what to look out for, how to report, what happens afterwards, and where the course and further guidance sit on ProtectUK.

What the course is and who can take it

The ACT Awareness e-Learning course is a counter-terrorism awareness product designed for all UK based companies and organisations, and also for the general public¹. That breadth is deliberate. Counter-terrorism policing in the UK depends heavily on information from ordinary people, and the course exists to raise the baseline of what the public knows and notices.

It is free to use, and it is available to members of the general public as well as those who work in venues and public spaces¹. If you work in a shop, a pub, a stadium, a school or an office, the course is aimed at you; if you are simply a household member who wants to be better prepared, it is aimed at you too. Councils that promote preparedness for malicious attacks describe the course in exactly those terms: North Tyneside encourages residents to become a CT Citizen by completing free ACT e-learning².

The "CT Citizen" idea is worth pausing on. It means an ordinary member of the public who has done the training and so knows how to spot suspicious activity, report it through the right channels, and follow the RUN HIDE TELL advice if the worst happens. You do not join anything, take on any obligation, or put yourself on a list. You complete the course, and you carry the knowledge.

For households, the course fits naturally alongside the other preparedness steps on this site. It takes less time than an evening, costs nothing, and covers a subject most people hope never to need but would rather understand in advance. If you are building up your household's readiness, start with our getting started guide and treat this course as one of the quick wins.

How long it takes: 45 minutes, in short sections

The headline figure is 45 minutes in total¹. Counter Terrorism Policing states the course "can be divided into short sections and is free to use. It takes just 45 minutes in total to complete"¹. That matters for two kinds of reader.

For individuals, it means the course is not a commitment. You can complete a section on a commute or in a lunch break, stop, and pick it up later. Nothing in the guidance requires you to sit the whole thing in one go.

For employers and venue managers, the short-section format means staff can be trained around shifts without closing a room for an afternoon. This is the same logic behind other national awareness products: the RUN HIDE TELL lesson plans for schools are based on a 60-minute lesson with options for reducing this to 45 minutes⁷, showing how counter-terrorism training is deliberately packaged to fit into existing schedules rather than demand extra time.

For comparison, if you are weighing this against other free awareness training, it is one of the shortest offerings around. Other public-safety courses run longer, but the ACT course was built to be finished, not abandoned.

What the course covers

The course provides nationally recognised counter-terrorism guidance. ACT e-learning increases the public's understanding of current terrorist methodology and helps mitigate against this risk². In practical terms, that means the material covers the things an ordinary person can actually do something about:

• Recognising suspicious behaviour, including hostile reconnaissance such as someone observing CCTV, security arrangements, or taking photos of entrances and exits of specific buildings¹
• Gathering of materials or equipment, such as someone buying large amounts of chemicals, fertilisers or gas cylinders for no reason¹
• Online extremist content, and how to report it¹
• Concerns about radicalisation, and the support available through the Prevent programme¹
• What to do in an attack, built around the RUN HIDE TELL public response advice⁸

The course is not about assessing threat levels yourself or judging whether a person is dangerous. It is about recognising the categories of behaviour that counter-terrorism police ask the public to report, and knowing the reporting routes cold. If you want the wider picture of the threat in the UK, read our guide to the terrorism threat and attack types and to threat levels and what they mean.

Spotting suspicious behaviour: what to look out for

The behaviour the police ask you to notice falls into a few clear groups. The ACT guidance lists them directly, and the course walks through them¹.

Suspicious or worrying behaviour around a person. Examples the guidance gives include someone who travels but is vague about where they are going, and someone with multiple passports in different names³. The lesson materials add behavioural cues: someone trying to hide their face or identity, or avoiding security staff or police⁷.

Hostile reconnaissance. This is observation of a target before an attack. The guidance asks: have you noticed anyone observing CCTV, security arrangements, or taking photos of entrances and exits of specific buildings?¹. The school lesson materials describe the same behaviour in plainer terms: taking photos of things you would not normally photograph, such as exits, crowds and security cameras⁷.

Gathering materials or equipment. Someone receiving deliveries for unusual items, unusual commercial vehicle hire or sales, or buying large amounts of chemicals, fertilisers or gas cylinders for no reason¹.

Extremist views and material. Someone who looks at extremist material, or shares or creates content that glorifies terrorism, and somebody promoting hateful ideas or extremist views³.

Online terrorist content. Speeches or essays calling for racial or religious violence, videos of violence praising terrorists, postings inciting terrorism, messages stirring up hatred against religious or ethnic groups, and bomb-making instructions¹.

None of this asks you to be certain. The police are explicit that the test is whether something is suspicious or causes a threat, not whether you can prove intent¹. Our page on how to report suspicious activity goes through the reporting routes in more detail.

Unattended and suspicious items

Unattended bags should always be considered suspicious and reported immediately⁷. Other things that would be suspicious include items deliberately hidden, items with wiring or batteries visible, items taped up, or items that are simply not typical of the location⁷.

The guidance for the public and staff is to tell someone straightaway: the person with you, someone who works where you are, a police officer, or an adult nearby⁷. Do not pick the item up, move it, or open it. Suspicious items could be anything at all that looks strange, unattended or out of place, including a package somewhere unexpected or something hidden⁷.

Staff and employers are also pointed to the HOT protocol for assessing suspicious activity or items⁹. Coventry's protect and prepare guidance tells venues and the public to remember the HOT protocol when assessing suspicious items⁹. If you work somewhere that receives the public, the course covers this material, and our page on unattended or suspicious items sets out the HOT protocol and safe distances in full.

Trust your instincts and report it

The single message the ACT campaign returns to is this: if you have seen or heard something that could potentially be related to terrorism, trust your instincts and report it³. Counter Terrorism Policing puts the same instruction in plainer words: "If you see or hear something that doesn't feel right, report it online and in confidence at gov.uk/ACT"⁴.

The instinct part matters. People routinely talk themselves out of reporting because they fear wasting police time or getting someone into trouble. The guidance addresses both worries directly: do not be concerned about wasting police time, the information you provide will be kept secure, and your identity will be protected³. It only takes a moment to make a report online¹.

How to report: 999 in an emergency, 0800 789 321 in confidence

There are two main routes, and choosing between them is simple.

In an emergency, or if you need urgent police assistance, always dial 999³. Gov.uk gives the same instruction: call 999 or the police anti-terrorist hotline on 0800 789 321 to report an immediate terrorist threat¹⁰.

For anything that is not an immediate emergency, report in confidence. You can report suspicious activity by contacting the police in confidence on 0800 789 321³, or make a report online at gov.uk/ACT¹. Whether you are a business owner, work in security, or are a member of the public, these reporting routes are open to you¹¹.

For concerns about radicalisation, there is a separate route. The ACT Early Support Line on 0800 011 3764 is open daily from 9am to 5pm, for anyone worried that someone they know is being drawn towards terrorism⁵. Police forces across the country have specially trained officers who work alongside other organisations through the Home Office Prevent programme to help people vulnerable to radicalisation move away from violent extremism, and receiving that support is voluntary³. If this is your situation, our page on radicalisation concerns in a family member goes into the signs and sources of help in detail.

For online terrorist content, report it through the ACT reporting routes; a specialist police team will examine the content and will work with internet companies to remove it if appropriate¹. There is also iReportIt, a pilot app designed to give people another way to anonymously report online content promoting violent extremism¹. Our page on reporting terrorist content online covers this route.

What happens after you report

Specially trained officers and police staff take the details and pass them on for further checks³. You are not expected to investigate, follow up, or provide evidence. Your report joins the picture the police already hold, and the checks happen out of sight.

Two assurances are given repeatedly in the official guidance. First, the information you provide will be kept secure and your identity will be protected³. Second, do not be concerned about wasting police time³. Counter Terrorism Policing would rather receive ten reports that lead nowhere than miss the one that matters, and the guidance is written to remove the hesitation.

For online content reports, the process is slightly different: a specialist police team will examine the content and will work with internet companies to remove it if appropriate¹. Again, your part ends with the report.

If you or your family are affected by a terror incident, support exists independently of the police. Victim Support runs a free 24/7 line on 0800 168 9111⁵, and our page on support for victims and families after a terror attack sets out what is available.

RUN HIDE TELL: the response advice the course teaches

Alongside spotting and reporting, the course covers what to do if you are caught up in an attack. The national advice is RUN HIDE TELL, and Lancashire's preparedness guidance states it plainly: follow the RUN HIDE TELL advice for a marauding terrorist attack⁸. These steps can help save lives and prevent casualties in the event of an attack¹³.

• Run to safety if there is a safe route. Do not stay to film or gather belongings.
• Hide if you cannot run: lock or barricade yourself in, stay away from doors and windows, and silence your phone.
• Tell the police by calling 999 when it is safe to do so.

When you tell the police, the guidance lists what to give them: the nature of the incident, the location, where the suspects are, the direction you last saw them, descriptions including numbers, features and clothing, and further information such as casualties, type of injury, building information, entrances, exits and hostages⁸.

There are versions of this advice for particular groups. The ACT Awareness e-Learning course is open to business owners, people who work in security, and members of the public, and it takes 45 minutes in total to complete¹. ProtectUK's guidance on who can use these resources states: "Whether you are a business owner, work in security, or are a member of the public"¹¹. The core message of RUN HIDE TELL applies whichever version you use: run to safety if you can, hide if you cannot, and tell the police when it is safe to do so.

Our dedicated page on Run, Hide, Tell covers the full advice, with narrower guides on where to hide, what to do when armed police arrive, and what young people should do.

Using the course in workplaces and venues

Because the course is designed for all UK based companies and organisations as well as the general public¹, it doubles as workplace training. Venue and shop staff are among the people most likely to be first to notice suspicious behaviour or an unattended item, and the course is available to those who work in venues and public spaces¹.

The format helps. Since the course can be divided into short sections and is free to use³, staff can complete it around shifts, and an employer does not need to book a trainer or a room. Councils promoting protective security, such as Coventry, point businesses and residents to ACT reporting and the HOT protocol as part of their protect and prepare advice⁹.

ProtectUK also offers materials that work alongside the course. The Action Card resources contain actionable guidance that can be followed during an attack, and they are in a printable format, so they can be printed, downloaded and used in your organisation¹⁴. A printed action card at a reception desk or in a staff room keeps the response advice visible after the e-learning is finished.

If you run or work at a venue, you may also want to read about Martyn's Law and what it changes at venues.

ProtectUK: where the course and further guidance sit

The ACT Awareness e-Learning course sits on ProtectUK, the national platform for counter-terrorism security information. Whether you are a business owner, work in security, or are a member of the public, ProtectUK provides counter-terrorism security information including training materials, protective guidance, and campaign toolkits⁶.

Coventry's guidance encourages residents to make use of trusted preparedness resources, noting that free guidance, e-learning and awareness materials available through ProtectUK and NPSA can help residents understand potential risks, improve preparedness and contribute to safer communities⁹. In other words, the course is not a one-off: it is the entry point to a wider body of official guidance you can return to as needed.

For a household, the practical route is: take the 45-minute course first, then use ProtectUK as the reference for specific questions, such as the HOT protocol for suspicious items, RUN HIDE TELL for an attack, or first aid provisions at public locations. For the broader context of how the UK prepares for emergencies of all kinds, see our guide to how the UK prepares for emergencies, and for the full range of terror-related scenarios, our major incidents section.