Unattended or Suspicious Items: The HOT Protocol, the 4Cs and Safe Distances

If you find a bag, box or package that seems out of place, the police advice is simple: do not touch it, move at least 100 metres away, and call 999. That is the short version, and it applies even to something as small as a briefcase¹. The chances of being caught in a terrorist incident in the UK are very low, but the police ask everyone to know what to look for and how to respond, because a member of the public is often the first person to notice something wrong².

Two frameworks sit behind the official advice. The HOT protocol helps you judge whether an unattended item is suspicious: is it Hidden, is it Obviously suspicious, is it Typical of where it is³. The 4Cs protocol tells you what to do next: Confirm, Clear, Communicate, Control⁴. Both come from ProtectUK, the national counter-terrorism security advice service, and both are used by staff at stations, venues and shops across the country, so the response you start will be understood by everyone who follows.

This page sets out both protocols step by step, the distances and phone rules that matter, and what to do if a bomb threat reaches you by call, text, email or social media. It sits alongside our guides to Run, Hide, Tell for a terror attack, reporting suspicious activity, and suspicious letters and parcels at home.

What to do if you find an unattended or suspicious item

Work through the 4Cs in order: Confirm, Clear, Communicate, Control. ProtectUK's guidance for the public and for staff sets these out as the standard response to any suspicious item¹.

1. Confirm. Look at the item from a distance and judge it against the HOT protocol. Do not pick it up, open it or examine it closely⁴.
2. Clear. Move people away from the item, starting from the centre and moving out, to a distance of at least 100 metres⁵.
3. Communicate. Call 999, or tell a member of staff, security or a police officer. Reports can also be made online, and can be made anonymously⁸.
4. Control. Keep the area clear and keep people back until the police arrive and take over⁴.

The police are explicit about what counts as suspicious in the first place. Unattended bags should always be considered suspicious and reported immediately. Other warning signs include items deliberately hidden, items with visible wiring or batteries, items that have been taped up, and items that are not typical of the location, such as a holdall left in a church porch or a toolbox on a station platform⁸.

If you are in a station, shop, stadium or any staffed venue, the fastest route is usually a member of staff. ProtectUK requires venues to ensure those responsible for assessing unattended items are briefed and trained in what is normal, what is unusual, what is potentially suspicious and what to do about it⁶, so staff will know the same protocols you do and can trigger their own procedures, which may include evacuating the whole site. If there is no one to tell, or the situation is urgent, call 999 yourself.

One thing not to do: do not approach a person you think left the item or is acting suspiciously. Counter-terrorism teaching material for young people is blunt that in almost all cases it is not safe, advisable or necessary to approach the person, and that you should instead find someone in a position of responsibility and report it to them⁸. Your job is to notice and report, not to investigate.

The HOT protocol: hidden, obviously suspicious, typical

HOT is the judgement tool that sits inside the Confirm step. ProtectUK's guidance says the HOT protocol may assist with deciding whether or not an item has suspicious characteristics⁹, and public-facing guidance from Coventry City Council tells people to remember the HOT protocol when assessing suspicious activity or items³. It works because most unattended items are innocent, and HOT gives you a structured way to tell the ordinary from the worrying without going near the item.

An item that is hidden, or obviously suspicious, or not typical of its surroundings should be reported. You do not need all three. A bag that is simply unattended but otherwise ordinary should still be reported, because unattended bags are always to be considered suspicious and reported immediately⁸. HOT is a way of sorting how worried to be, not a way of talking yourself out of reporting.

Two things make HOT work well. The first is local knowledge: what is typical depends entirely on where you are, and staff at a venue are trained in what is normal for their own site⁶. As a visitor, you may not know whether a delivery crate belongs in a shop corridor, which is one reason telling staff is often better than judging alone. The second is honesty about your own uncertainty: if you cannot tell whether something is typical, that uncertainty is itself a reason to report. The police's standing message is that if you see anything suspicious, report it, because it could save lives¹⁰.

Confirm: check the item for suspicious characteristics

Confirm means deciding, from a distance and without touching anything, whether the item has suspicious characteristics. The HOT protocol may assist with this⁹. Stay where you are, look, and ask yourself the three HOT questions.

The characteristics that should ring alarm bells are set out in counter-terrorism guidance⁸:

• The item is unattended with no obvious owner nearby
• It has been deliberately hidden or concealed
• It shows wiring, batteries or visible components
• It has been taped up or wrapped unusually
• It is not typical of the location

Guidance on hazardous substances adds a related indicator: the presence of hazardous or unusual material or equipment can be a first sign of a chemical, biological or radiological concern¹¹. If an item is leaking, giving off fumes, or surrounded by unusual powder or liquid, treat it as suspicious on that basis alone and move away. Our page on chemical, biological and radiological attacks covers those signs in more detail.

For letters and parcels at home, the Police Service of Northern Ireland's Protect Yourself booklet gives specific triggers: treat a letter as suspect if it is unexpectedly rigid, for example if it seems to contain cardboard or metal, as it may explode on opening, and never try to open a letter or package you have doubts about. If in doubt, call 999 and ask for the police and clear the area of all people immediately¹². We cover suspect post in full on our suspicious letters and parcels page.

Confirm does not mean investigating. You are not expected to lift the item, feel its weight, listen to it or look inside. Every one of those actions is exactly what the guidance forbids, because a device, if there is one, is most likely to be triggered by handling. Confirm is a look and a judgement, and it takes seconds.

Clear: move people away, at least 100 metres

Clear is the step most people get wrong, because the instinct is to stand a polite distance away and wait. What matters is that people are moved well away from the item and kept clear of the area until the police arrive, and that the item is reported: all such communications are a crime and should be reported to the police by dialling 999⁵. Do not approach the item or let others gather around it, and do not use a mobile phone right next to it.

One hundred metres is roughly the length of a football pitch. If you are indoors, that may mean leaving the building entirely rather than moving to the far end of a room, since few rooms are 100 metres long. Move away from the item, not past it, and encourage others to do the same without arguing with anyone who refuses: your own safety comes first, and the police will clear the rest when they arrive.

Two rules protect you while you clear the area:

• Do not use your mobile phone within 15 metres of the suspicious item, and place yourself out of sight of the item¹. ProtectUK's detailed guidance extends this to radios as well as phones, and to being out of line of sight⁶. Walk well beyond 15 metres first, then make the call.
• Do not touch the item at any point, and never try to open a suspect letter or package¹².

The phone rule surprises people, but it is consistent official advice and it is not optional. Make your 999 call only once you are beyond 15 metres and out of sight of the item¹.

If the item turns out to involve a hazardous substance, for example if it is leaking or you notice unusual material around it, the parallel advice is to move away from the hazard as safely as you can and without delay¹³. ProtectUK's guidance for suspected exposure to hazardous substances is to remove yourself from the immediate area, because fresh air is important¹⁴, and its REMOVE, REMOVE, REMOVE protocol applies if you suspect someone has been exposed¹⁵. Our Remove, Remove, Remove page covers that in full.

Communicate: report it on 999

Once you are clear of the item and beyond the 15-metre phone rule, report it. In an emergency, report suspicious activity to the police by calling 999¹⁶, and the government's terrorism preparedness guidance says the same: in an emergency you can report any activity you deem to be suspicious to your local police force using 999¹⁷. Call 999 when a crime is in progress or someone is in immediate danger¹⁸, and an unattended item you believe is suspicious meets that test.

When you call, be ready to give:

• Exactly where the item is, as precisely as you can
• What it looks like: size, shape, colour, bag or box, any visible wiring or tape
• When you first noticed it and whether you saw who left it
• A description of anyone behaving suspiciously nearby
• How many people are still in the area

If you are in a staffed location, telling a member of staff or security is equally valid and often faster, because they can start their venue's own procedures. Counter-terrorism guidance notes that while it is advisable to ring 999, reports can also be made to anyone in authority, such as a police officer, station employee, security guard or store manager, and that reports can be made anonymously⁸. Anonymity is offered so that nobody stays silent out of shyness or fear of being drawn into something.

For concerns that are not an emergency, ACT, the police's Action Counters Terrorism campaign, lets you report suspicious activity in confidence on 0800 789 321, or online via the police reporting form⁷. Use that route for things you have seen or heard that could be related to terrorism but do not need an immediate response: a person whose behaviour has worried you over days, for example, rather than a bag sitting in front of you now. Our how to report suspicious activity page walks through both routes in detail.

Control: keep people back until help arrives

Control is the holding action between your call and the police's arrival. The 4Cs guidance is to control the scene: keep people away from the item and out of the danger area until the emergency services take over⁴. In practice, for a member of the public, that means staying where you are at a safe distance, discouraging others from wandering back towards the item, and being available to the police when they arrive, because you are the person who knows what was seen and where.

You do not need to physically block anyone or put yourself between curious onlookers and the item. Say plainly that the police have been called and that people should stay clear, and let the distance you have already created do the work. Once the emergency services arrive, be prepared to follow their instructions⁶.

If the situation involves a suspected hazardous substance, ProtectUK's guidance adds one further instruction for those affected: stay in a safe location and await medical assistance, because medical assistance will come to you, so avoid seeking hospital care¹⁵. That applies to people who may have been exposed, and it exists so that contamination is not spread and so that casualties are treated where they can be assessed properly.

Control ends when the police arrive. Tell them what you saw, where the item is, and anything about the people nearby, then follow their instructions. If armed officers respond to a wider incident, our page on what to do when armed police arrive explains how to behave so they can work safely.

Trust your instincts and report anything that could be related to terrorism

The core message of UK counter-terrorism awareness guidance is simple: "If you see or hear something that could potentially be related to terrorism, trust your instincts and report it."⁷ The same words appear in ProtectUK's awareness guidance¹⁹, and West Yorkshire Prepared's community guidance adds that your information may be vital²⁰.

The reason the police repeat this so insistently is that public reports genuinely feed the system. Reports of suspicious behaviour and items are triaged and assessed, and pieces of information that mean little on their own can matter when combined with what is already known. You will not know whether your report is the first or the fiftieth about the same thing, and you do not need to.

ACT lists examples of the worrying behaviour it wants reported¹⁹:

• Someone who travels but is vague about where they are going
• Someone with multiple passports in different names
• Someone who looks at extremist material, or shares or creates content that glorifies terrorism
• Somebody promoting hateful ideas or extremist views

The national See It. Say It. Sorted campaign, used across the transport network, asks the public to keep an eye out for anything that seems out of place, including someone trying to get into somewhere they should not be, an unattended bag, someone looking around at the security arrangements, someone making an effort to avoid police and rail staff, or someone who might be trying to conceal something under their clothing². None of these requires you to be certain, or even probably right. The police's own framing is that the chances of being caught in a terrorist incident are very low, but that you and your family should be as prepared as possible², and reporting is part of that preparedness.

If you come across terrorist material online, information, pictures or videos that promote terrorism can be reported to the Home Office¹⁰, and our reporting terrorist content online page explains how. If you are worried about someone you know being drawn towards extremism, our radicalisation page sets out the signs and where to get help.

Bomb threats by phone, text, email or social media

A bomb threat is any communication, however delivered, that claims a device exists or an attack is coming. ProtectUK's guidance sets out the forms these take: a live caller; a recorded message, possibly using a text-to-speech synthesiser or a soundboard; a threat in written form; a threat delivered face to face; or one sent by email or social media²¹. An increasing number are now sent electronically using email or social media²².

Whatever the channel, the response is the same at its core: treat it seriously, preserve the message, and call 999. All such communications are a crime and should be reported to the police by dialling 999²¹.

If the threat comes by phone, stay calm and do not hang up first if you can avoid it. Bomb threats can arrive in many forms: a recorded message, possibly using a text-to-speech synthesiser or a soundboard, a written message, face-to-face, or by email or social media²². If the threat is received via text message, do not reply to, forward or delete the message; note the number of the sender and follow police advice²². All such communications are a crime and should be reported to the police by dialling 999²². Our bomb threat call checklist page reproduces what to record, question by question.

If the threat comes by text message, ProtectUK's instruction is specific: do not reply to, forward or delete the message; note the number of the sender and follow police advice²¹. That means the message stays on your phone, untouched, as evidence. Call 999 and let the police direct what happens next.

If the threat comes by email or social media, do not delete it, do not reply, and call 999. Because an increasing number of threats arrive this way²², the same preservation rule applies: the original message, with its sender details and headers, is what the police will want to see.

A related point from cyber-security guidance: criminals use stolen information within scam emails and text messages so that they appear legitimate, and may pretend to be from an organisation that has suffered a recent data breach²³. A threatening message that quotes your real personal details is not more credible for it. If a message or call does not feel right, report it using the official routes²³. Suspicious emails can be forwarded to the National Cyber Security Centre's Suspicious Email Reporting Service at report@phishing.gov.uk²⁴, and suspicious text messages can be forwarded to 7726, a free service²⁵. Those routes are for scam and phishing messages; a bomb threat goes to the police on 999 first.

Most bomb threats are hoaxes, but every one is a crime to report

The vast majority of bomb threats are hoaxes designed to cause alarm and disruption, and instances of valid bomb threats are rare²¹. Community risk guidance from the West Midlands Local Resilience Forum says the same²⁶. This is worth knowing for two reasons, and neither of them is a reason to take a threat less seriously.

The first reason is that it is not your job to decide. You cannot tell a hoax from a genuine threat from the wording, and neither can anyone else without investigation. That is why all such communications are a crime and should be reported to the police by dialling 999²¹: the hoax itself is a criminal act, and reporting it is how the police can trace whoever sent it. A hoax that goes unreported may be repeated on someone else, and the disruption it causes is real even when the device is not.

The second reason is reassurance. If you receive a threat, the odds are heavily in favour of it being a hoax, and knowing that can help you stay calm enough to record what matters and make a clear report. A calm, complete report serves you far better than a rushed one, and it gives the police everything they need to act quickly.

When you report, the SALUTE mnemonic from the Police Service of Northern Ireland's Protect Yourself booklet is a useful way to structure what you record about suspicious activity: Situation, Activity, Location, Unit, Time, Equipment¹². For a threat message, that translates into what was said or written, what was happening around it, where you were, who sent or delivered it, when it arrived, and anything about the device or method mentioned.

Who decides to evacuate a building

When a suspicious item or bomb threat affects a building, the decision to evacuate is not made by the police in the first instance. ProtectUK's bomb threat guidance is explicit that responsibility for the initial decision making remains with the management of the location being threatened, and that this must form part of an inclusive process for managing risk²¹. In your workplace, that is your employer or the duty manager; in a shop, station or venue, it is the operator's management team.

This matters to you in two ways. First, if you receive a threat at work, report it immediately to whoever holds that responsibility as well as calling 999, because they are the ones who can order an evacuation²¹. Second, if you are a visitor and staff tell you to leave, follow their instruction: they are exercising a responsibility the guidance assigns to them, and they may hold information about the building, such as where a device is claimed to be, that makes the evacuation route itself a judgement call.

The police take over as the incident develops. In a wider emergency, the police lead evacuations with assistance from other agencies, and decisions are based on public safety and expected conditions²⁷. If a police evacuation is ordered, follow the route you are given and do not return until you are told it is safe.

Where to get help and more to read

Every point in this page comes back to two numbers and one habit. The numbers are 999 in an emergency¹⁶ and 0800 789 321 for confidential non-emergency reports⁷. The habit is noticing: See It, Say It, Sorted².

If you want to go further, the police's free ACT Awareness e-learning covers these protocols in more depth, and our pages on the terrorism threat in the UK, UK threat levels and Run, Hide, Tell complete the picture. If you or your family are affected by an incident, support for victims and families explains what help exists.