PAS 97-2021 邮件筛选和安全规范

PAS97:2021

Mailscreeningandsecurity

-Specification

个Sciing

Unit

bsi.

省

省■

Publishingandcopyrightinformation

TheBSIcopyrightnoticedisplayedinthisdocumentindicateswhenthedocumentwaslastissued.

◎TheBritishStandardsInstitution2021.

PublishedbyBSIStandardsLimited2021.

ISBN9780539041743

ICS13.310

NocopyingwithoutBSIpermissionexceptaspermittedbycopyrightlaw.

Publicationhistory

FirstpublishedMarch2009

SecondeditionJanuary2012

ThirdeditionOctober2015

Fourth(present)editionMarch2021

PAS97:2021

Contents

Foreword ii

Introduction iii

1Scope 1

2Termsanddefinitions 1

3Outlineofprocess 3

4Assessingtherisk 5

5Screeninglevels 8

6Physicalprotectivemeasures 10

7Summarizingtheorganization'srequirements 15

8Implementation 16

Annexes

AnnexA(informative)Possibleindicatorsthatadelivereditemmay

beofconcern(fromwww.cpni.gov.uk) 23

AnnexB(informative)Actionupondiscoveryofanysuspicious

delivereditem(fromwww..uk) 24

AnnexC(normative)Mailfacilitylayoutandconstructionto

minimizetheeffectsofanexplosivedeviceor"whitepowder" 25

AnnexD(informative)AdditionalinformationonX-raymachines

formailscreening 30

AnnexE(informative)MailScreeningProcessSchematic 32

Bibliography 34

Listoffigures

Figure1-SummaryofPAS97process 4

FigureC.1-ConveyorizedXrayscreening 27

FigureC.2-CabinetX-rayscreening 28

FigureC.3-"Whitepowder"screening 29

FigureE.1-Mailscreeningprocess 33

Listoftables

Table1-Screeninglevels 9

Table2-Physicalprotectionclasses 10

Table3-Recommendedminimumphysicalprotectionclassesfor

eachscreeninglevel 14

◎TheBritishStandardsInstitution2021i

PAS97:2021

Foreword

ThisPubliclyAvailableSpecification(PAS)wassponsoredbytheCentrefortheProtectionofNationalInfrastructure(CPNI).ItsdevelopmentwasfacilitatedbyBSIStandardsLimitedanditwaspublishedunderlicencefromTheBritishStandardsInstitution(BSI).Itcameintoeffecton31March2021.

Acknowledgementisgiventothefollowing

organizationsthatwereinvolvedinthedevelopmentofthisPASasmembersofthesteeringgroup:

·BankofAmerica

·BBC

·BritishTransportPolice

·CanaryWharfManagement

·CounterTerrorismPolicingSouthEast

·CentrefortheProtectionofNationalInfrastructure

·CreditSuisseUK

·DeutscheBank

·EasternRegionSpecialOperationsUnit-CounterTerrorismPolicing

·PosteRouteLtd

·RoyalMailGroup

·SwissPostSolutions

·ScottishParliament

·VodafoneLtd

·WestMidlandsPolice

AcknowledgementisalsogiventothemembersofawiderreviewpanelwhowereconsultedinthedevelopmentofthisPAS.

TheBritishStandardsInstitutionretainsownership

andcopyrightofthisPAS.BSIStandardsLimitedasthepublisherofthePASreservestherighttowithdraworamendthisPASonreceiptofauthoritativeadvicethatitisappropriatetodoso.ThisPASwillbereviewedatintervalsnotexceedingtwoyears,andanyamendmentsarisingfromthereviewwillbepublishedasanamendedPASandpublicizedinUpdateStandards.

CopyrightisclaimedontwoimagesinthisPAS,

appearingonpages14and19.CopyrightholdersareSwissPostSolutionsParkshotHouse,5KewRoad,

Richmond,TW92PR.

ThePASprocessenablesaspecificationtoberapidly

developedinordertofulfilanimmediateneed

inindustry.APAScanbeconsideredforfurther

developmentasaBritishStandard,orconstitutepartoftheUKinputintothedevelopmentofaEuropeanorInternationalStandard.

Supersession

ThisPASsupersedesPAS97:2015,whichiswithdrawn.

Useofthisdocument

IthasbeenassumedinthepreparationofthisPAS

thattheexecutionofitsprovisionswillbeentrustedtoappropriatelyqualifiedandexperiencedpeople,forwhoseuseithasbeenproduced.

Presentationalconventions

InthisPAS,theword"shall"indicatesrequirements.

Theword"should"isusedtoexpressrecommendationsofthisstandard.Theword"may"isusedinthetext

toexpresspermissibility,e.g.asanalternativetothe

primaryrecommendationoftheclause.Theword"can"isusedtoexpresspossibility,e.g.aconsequenceofanactionoranevent.Allwordingwithoutuseofthese

verbsisgeneralcommentarythatprovidesaframeworkforusefulunderstandingoftheprovisionsofthis

standard.Paragraphsmarked"NOTE"offerparticularguidanceinunderstandingorclarifyingtheassociatedrequirement.

Contractualandlegalconsiderations

Thispublicationdoesnotpurporttoincludeallthe

necessaryprovisionsofacontract.Usersareresponsibleforitscorrectapplication.

CompliancewithaPAScannotconferimmunityfromegalobligations.

ThisPASisnottoberegardedasaBritishStandard.Itwillbewithdrawnuponpublicationofitscontentin,oras,aBritishStandard.

ii◎TheBritishStandardsInstitution2021

PAS97:2021

Introduction

Eveninthiselectronicage,mostbusinessesand

otherorganizationsrelyontheabilitytoreceiveandsendphysicalitemsofmail.Asanessentialpartof

normaloperations,mailpresentsvariouspotentially

significantvulnerabilities.Mailstreamsintoandwithinanorganizationprovideavectorformaliciousattacksandscopeforothersecurityincidents,allofwhich

canendangerlifeandadverselyaffecttheday-to-daybusinessoftheorganization,aswellasitsreputation.

Attacksmightbeintendedtocausephysicaldamagetoproperty,harmtoindividuals,tocreatefearormerelytocausedisruption.Conversely,itisalsoquitepossibleforperfectlybenignobjectstoappearsuspicious,

causingdisruptionthroughemergencyresponsesthatproveunnecessary.Inaddition,incomingandoutgoingmailstreamsmightcontainvaluableitemsorsensitiveinformationthatwarrantprotectingfromlossortheft.

Mailscreeningandsecuritymeasurescanbeusedtoreducetheriskandimpactofsuchincidents.ThisPASaimstoassistorganizationsinidentifyingandimplementingappropriatepostalsecuritymeasuresthatmeettheirparticularneeds.

Toofeworinappropriatemeasuresincreasetheriskofsignificantsecurityincidentsthatharmtheorganizationanditsbusiness.Excessivemeasuresarelikelytobeanunnecessaryexpenseandmightotherwisereducetheefficiencyoftheorganization,forexamplebycausingdelaysorusingscarcestaffandspaceresources.

Inworkingtoidentifyandimplementtheappropriatemeasuresforanorganization,itisimportantto

considerfactorsbothwithinandexternaltothe

organizationaswellaspotentialfuturechangesto

these.Forexample,thenatureoftheorganization'sbusinesscouldchangeinawaythataffectsmail

throughputrequirements,ascouldthepublicprofileoftheorganizationinawaythatmakesitmorelikelytobetargetedbysingle-issuegroups,terroristsor

disaffectedindividuals.

Whilenotexhaustive,thefollowingcasestudieshighlightdifferentthreatsandhowtheywereaddressed.

◎TheBritishStandardsInstitution2021

CaseStudyA-USanthraxletters,Autumn2001

InSeptemberandOctober2001,letterscontainingBacillusanthracissporesweremailedtoseveralnewsmediaofficesandtwoUSDemocratSenators.Fivepeoplediedofinhalationalanthraxandmorethanadozenothersbecameseriouslyill.Thousandsof

employeesoftheUSPostalServiceandgovernmentofficesthatcouldhavebeenexposedweregiven

antibioticsasaprecaution.Dozensofbuildingswerecontaminatedasaresultofthemailings.Theattackhadasevereimpactonmailservicesacrossthe

UnitedStatesasmanypostalfacilitieshadtoclosefordecontamination.Onebuildingtookthreeyearstoreopenafterdecontaminationatacostofmanytensofmillionsofdollars.

USFederalprosecutorseventuallydeclareda

scientistemployedinthegovernment'sbio-defencelaboratoriesasthesoleperpetrator,thoughhis

motivesfortheattackswereunclear.

CaseStudyB-UKletterbombcampaign,2007

InJanuaryandFebruary2007,therewasatargetedmailcampaignintheUKagainstsevencompaniesandgovernmentagencieswhichtheperpetrator

believedwereconnectedtoariseina"surveillancesociety".Relativelyunsophisticatedexplosive

deviceswereused,mostofwhichfunctionedon

openingcausingminorinjuriestothehandsand

upperbodiesofthepersonshandlingtheitemsandotherpersonsnearby.Duetothedifferentwaysinwhichorganizationshandleincomingmail,those

whoopenedthelettersandwereinjuredwerenotnecessarilytheintendedtargetsforthedevices.Intwocasestheitemswereinterceptedbytrainedandvigilantmailroomoperatorsanddealtwithsafely

usingpractisedescalationprocedures,resultinginminimumdisruptiontotheorganizationsconcerned.

InSeptember2007,MilesCooper,aschoolcaretakerfromCambridge,wasfoundguiltyofavarietyof

chargesinrelationtotheletterbombcampaign,andreceivedanindeterminateprisonsentence.

iii

PAS97:2021

CaseStudyE-UKparcelbombs,2014

InFebruary2014aseriesofparcelbombswere

senttoseveralBritishArmedForcesCareersOfficesacrossEngland.Allthedeviceswerecontained

withinenvelopeswhichwereaddressedbyhand.AgrouplinkedtoNorthernIrishterrorismclaimedresponsibilityforthepackagesinastatementmadetotheIrishNews.Iftheyhadnotbeendiscovered,thecrudebutpotentiallyviabledeviceswerelikelytohavecausedharmtotheirvictims.

CaseStudyC-UKhoaxcampaign,2012

Aseriesofhoax"anthrax"lettersweresenttohighprofilegovernmentofficials,includingtheDeputyPrimeMinister,inthesummerandautumnof2012.Theletterswereinterceptedatamailscreening

centre,andthesubstancefoundtobenon-

hazardous.Ifthelettershadnotbeeninterceptedthecampaignwouldundoubtedlyhavecaused

concernanddisruption.

RuthAugustuswasfoundguiltyofsixcountsofhoaxesinvolvingnoxioussubstancesandwas

sentencedtoatwo-yearcommunityorderinadditiontoreceivingmentalhealthtreatment.

CaseStudyF-UKseriesofwhitepowderincidents,2016

OvertheperiodofonedayinJuly2016,five

incidentswerereportedofwhitepowderbeing

deliveredtoMuslimcentres,mosques,agovernmentbuildingandamailscreeningserviceinLondon.

Oneenvelopewassaidtofeelsuspiciousandlumpy,withpowderandoffensivemessagessubsequentlyfoundinside.Theorganizationcalledthepoliceandspecialistofficersattended,andthepowderwas

discoverednottobehazardous.Onebuildingwasevacuatedformorethantwohoursondiscovery

ofthepackagewhichwasopenedtorevealwhite

powder.Thishighlightstheimportanceofearly

recognitionofpotentialsuspiciousindicatorsinmail,before(andintheeventof)beingdeliveredtotherecipient,aswellastheneedforarobustresponseprocedurethatmustbeinplacetominimizefurtherimpact.

CaseStudyG-UKwhitepowderincident,2018

InFebruary2018,asecurityincidentwastriggered

whenasmallpackagecontainingwhitepowder

wasdeliveredtoaUKgovernmentdepartment's

office.Specialistofficersexaminedthepackageat

thescene,whichwaslaterfoundtobenon-harmful.Theofficeaffectedwasisolatedwhiletherestof

thebuildingremainedopenasusual.Securityalertswerealsominimizedtoavoidfurtheralarm.The

proportionateresponseproceduresthatwereput

intoactionensuredbusinesscontinuityensuedwhiletheincidentwasbeingaddressed.

CaseStudyD-USricinletters,2013

On16April2013,anenvelopeaddressedtoaUS

SenatorwasinterceptedattheUSCapitol'soffsite

mailfacilityinWashingtonDCandtestedpositive

forricin.Thefollowingdayasecondenvelope,thistimeaddressedtothePresidentoftheUnitedStates,wasinterceptedandagaintestedpositiveforricin.Afurtherlettercontainingricinreacheditsintendedrecipient,howevertheindividualwasnotharmed.

EverettDutschkewaschargedinJune2013

fordevelopingandpossessingricintoxinand

subsequentlymailingricin-laced,threateningletters,includingonethatthreatenedbodilyharmtothe

PresidentoftheUnitedStates.Hewassentencedto25yearsinprison.

Theeventssparkednumerouscopycatincidentswithindividualsmailingricintoaseniorjudgeandthe

MayorofNewYork.

◎TheBritishStandardsInstitution2021

iv

◎TheBritishStandardsInstitution2021

PAS97:2021

CaseStudyI-Internalmailscreeningfornon-maliciousthreats

Whilstsecurityisanimportantissuefortheoilandgasindustry,safetyisparamount;hencealcohol

anddrugsareprohibitedonalloffshoreoiland

gasinstallations.Employeesandcontractorsare

requiredtodeclareallmedicalconditionsandanydrugsprescribedtothemtotreattheseconditions.Mailtooffshoreinstallationsisroutedinternally

withintherespectiveorganization-itisreceivedatacompanyofficeonlandwhereitisscreenedfor

alcoholanddrugs(bothprescribedandllegal),aswellashazardousmaterialsanditems,beforebeingtransferredoffshore.

CaseStudyH-UKpostaldevices,2019

InMarch2019,anumberofimproviseddevices

weresenttotransporthubsandotherlocationsinEnglandandScotland.Thedeviceswerecontainedwithinpaddedenvelopesinsideplasticpostalbags.Oneofthedeviceswasopenedandcaughtfire,

thoughthankfullynoonewasinjured.

Atanumberoftheothersites,staffhandlingthemaildeemedtheitemssuspiciousandimplementedresponseprocedures,evacuatingthesurroundingareaandcallingthepolice.Specialistofficersthenattendedandmadethedevicessafe.

Thequickandeffectiveresponseofmailhandlingstaff,andtimelyinformationsharingbetweentheorganizationsinvolved,meantthatalthoughtherewasdisruptiontosomeareasofthesites,their

mainbusinesswasunaffected.Iftheyhadnotbeendiscovered,thesedevicescouldhavecausedharmtotheirrecipients.

V

PAS97:2021

Thispageisdeliberatelyleftblank.

◎TheBritishStandardsInstitution2021

vi

PAS97:2021

1Scope2Termsanddefinitions

ThisPASspecifiesrequirementsandgives

recommendationsformailscreening,setinthebroadercontextofpostalsecurity.Itisintendedforusebythoseresponsibleforplanning,deliveringorprocuringmailhandlingandscreeningserviceswithinorganizations,aswellascommercialprovidersofsuchservices.

tspecifiesmeasurestoassistbusinessesandother

organizationsinidentifyingandminimizingtheimpactofitemsofmailthatrepresentathreat,orcould

otherwisecauseconcernordisruption.Italsoaddressesbroaderpostalsecuritymeasuresaimedatensuring

allincoming,outgoingandinternalmailstreamsaremanagedsoastominimizetheriskoflossortheftofvaluableorsensitiveitemsorinformation.

ThisPASconcentratesonlettersandsmallparcels

enteringtheorganizationfromanyexternalsource,includingpublic/commercialpostalservices,byhandorbycourierdelivery.

WhilstmanyoftheprinciplesdetailedinthisPAScanalsobeappliedtoimprovingthesecurityofother,

larger-scaledeliveries,thesearenotexplicitlycovered.

ThesecurityofelectronicmailandassociatedITsystemsisoutsidethescopeofthisPAS.

ThisPASdoesnotproposeasinglestandardofpostalsecurityandscreening.Instead,itsetsouttoassist

organizationsinassessingtheirparticularlevel(s)ofriskandselectingandimplementingcommensuratesecuritymeasureswhetheronsiteoroffsite,deliveredin-houseoroutsourced.Aseriesofscreeninglevels

(1to5)isdefinedintermsofprogressivelymore

complexscreeningmeasures;thisiscomplementedbyaseriesofphysicalprotectionclasses(AtoD)thatdescribeincrementalphysicalprotectivemeasuresformailroomsandpersonnel.

NOTEAnotherfactorcontributingtotheoveralllevelofprotectionanorganizationderivesfromitspostalsecuritymeasuresisthelocationofitsmailfacilities.

ForthepurposesofthisPAS,thefollowingtermsanddefinitionsapply.

2.1deliveries

goodsreceivedbyanorganization

NOTEThisincludesmailandabroadrangeofother,

often/arger,items(forexamplecleaning,cateringandofficesuppliesandequipment)whichpresentdifferentchallenges.

2.2mail

lettersandsmallpackageswhichcouldbedeliveredbyacommercialpostaloperatororcouriercompanybehanddeliveredororiginatewithintheorganization

NOTEWhilst"post"and"mail"arecommonlyusedinterchangeably,theterm"mail"isusedthroughoutthisPAS(with"postal"usedasthecorresponding

adjective).

2.3mailhandling

allaspectsofmovingmail(2.2)aroundwithinan

organization,includingcollection,sorting,distributionanddelivery

2.4mailroom

roomormulti-roomfacilitywheremail(2.2)issortedand/orscreened

2.5mailscreening

useofmanualorautomatedmethodstoidentify

hazardsandothercausesofdisruptionassociatedwithtemsofmail(2.2)

◎TheBritishStandardsInstitution2021

1

PAS97:2021

2.6mailstreams

routesbywhichmail(2.2)travelsfromsendertorecipient

NOTE1MostrelevantinthecontextofthisPASarestreamswithintheorganizationinquestion,i.e.

howmail(2.2)enters,travelswithinandexitstheorganization.

NOTE2Mailstreamswithintheorganizationcanspanmultiplesitesorincludeoffsitemailhandling(2.3)/

screening(2.5)byspecialistcontractors.

2.7personnelsecurity

systemofpoliciesandprocedureswhichseekto

managetheriskofstaff(permanent,temporaryor

contractstaff)exploiting,orintendingtoexploit,theirlegitimateaccesstoanorganization'sassetsorpremisesforunauthorizedpurposes

2.8postalsecurity

encompassesbothmailscreening(2.5)andmore

generalmeasuresaimedatmakingsureallincoming,outgoingandinternalmailstreams(2.6)aremanagedsoastominimizerisk(2.9)

2.11specialistsecurityengineers

engineerswhoaremembersoftheRegisterof

SecurityEngineersandSpecialists(RSES)orareabletodemonstratecompetenciessimilartothoserequiredforRSESmembership

NOTESeeBibliographyforinformationontheRegisterofSecurityEngineersandSpecialists.

2.12threat

waysinwhich,andreasonswhy,anorganizationmightbetargeted

2.13"whitepowders"

materialswhichcaneitherbebenignorhazardous

chemicals(includingexplosiveornarcotic),biologicalorradiological

NOTESuchmaterialsmightnotbe"white"andmightnotbe"powders";materialscanbecrystalline(e.g.sugar),oilyorwaxyresidues,orliquids

2.9risk

impactandlikelihoodofanincidentarisingasaresultofthethreat(2.12)

2.10sensitiveinformation

informationthatwarrantsprotecting[includingwhileintransitinmail(2.2)]

NOTEThiscouldincludeintellectualproperty,tradesecretsorconfidentialpersonal,financialormedicalinformation.

OTheBritishStandardsInstitution2021

2

PAS97:2021

3Outlineofprocess

Theorganization(includingitsappointedcontractorswhereappropriate)shallassesstherisksassociatedwithpostalincidents(seeClause4).Thisassessmentshall

requireconsiderationofthethreatstheorganizationfaces(see4.1)ofthevulnerabilityofitsmailstreamsandassociatedprocesses,andofthepotentialimpactofmail-relatedincidents(see4.2).

Theorganizationshallaimtoreduce,toanacceptablelevel,theriskofpostalincidentscausingdisruptionorharm.

NOTE1Anacceptablelevelofriskisthelevelof

residualrisktheorganizationispreparedtoaccept.

Theorganizationshallidentifyanappropriatelevel

(orlevels)ofscreening(seeClause5)combinedwith

suitablephysicalprotectivemeasures(seeClause6).Theorganizationshallrecordthefindingsofthisanalysis,formallystatingitsrequirements(seeClause7),and

thenshallimplementthesemeasuresaccordingly,withregularreview(seeClause8).

NOTE2TheoverallPAS97processissummarizedinFigure1.

TheorganizationshallfollowallofthestepsdescribedinthisPAS,andshallconsiderpostalsecurityasan

integralpartofitswidersecuritymeasures.

WARNINGAdhocadoptionofindividual

measuresdescribedinthisPAScouldleadto

theimplementationofaninadequatescreening

capability,ortounsafepractices.Forexample,

selectingaparticularlevelofscreeningwithoutalsousinganappropriateclassofphysicalprotection

measurescouldresultinstaffbeingunnecessarilyexposedtohazards.

NOTE3Moregeneralinformationonbusiness

riskmanagementcanbefoundinBS31100and

BSENISO22301,aswellasfromthesourcesintheBibliography.MoregeneralinformationonsecuritymanagementcanbefoundinBS16000.

OrganizationsdemonstratingorrequestingcompliancewithmeasuressetoutinthisPASshalldosousingtheformat"PAS97:2021atScreeningLevelnwithPhysicalProtectionClassx".

NOTE4Whendemonstratingorrequestingcompliance,supplementaryinformation(forexampleexceptions,

additionalmeasuresordetailsoflocation)shouldbesuppliedasrequired.

◎TheBritishStandardsInstitution2021

3

PAS97:2021

Figure1-SummaryofPAS97process

Decisiontoconsiderdevelopingandimplementingmailscreeningandsecuritymeasures

Assesstherisktotheorganizationfrompostalthreats

(seeClause4)

●Understandthepostalthreat(4.1)

·Understandthewaysinwhichitemsofmailmaycauseconcern,disruption,orharm(4.1.1)

organizationisatarget(4.1.2)

●Assesstheextenttowhichthe

●Understandtheorganization'smailstreams(4.2)

SelectScreeningLevelscommensuratewiththerisk

(seeClause5)

ldentifysuitablelocationforscreeningfacilityandappropriatePhysicalProtectiveMeasures

(seeClause6)

Formallyrecordtheorganization'srequirementsformailscreeningandsecurity

(seeClause7)

Implementmailscreeningandsecuritymeasures

(seeClause8)

·Generalpostalsecuritymeasures(8.2)

·Managementandresponsibility(8.3)

●Internalprovisionvsoutsourcing(8.4)

·Operatingproceduresandemergencyprocedures(8.5)

●Mailroomlocation,design,layoutandconstruction(8.6)

·Screeningmethodsandequipment(8.7).Humanfactors(8.8)

●Healthandsafety(8.9)

Reviewregularly,andinresponsetopostalsecurityincidentsandsignificantinternalorexternalchanges

◎TheBritishStandardsInstitution2021

4

PAS97:2021

4Assessingtherisk

COMMENTARYONCLAUSE4

Thefirststepinidentifyingandimplementing

appropriatemailscreeningandsecuritymeasures

involvesunderstandingtherisksassociatedwith

eachofthevariousmailstreamsintoandwithinthe

organization.Thisrequiresconsiderationofcurrent

andpossiblefuturethreatstotheorganizationandthelikelihoodandimpactofanincidentoccurring.

FurthermeasuresforbusinesscontinuitycanbefoundinBSEN/SO22301.

4.1Understandingthethreat

4.1.1Mailcausingconcern,disruptionorharm

General

Thoseresponsibleforpostalsecuritywithinanorganizationshallhaveaclearunderstandingofthewaysinwhich

itemsofmailcouldcauseconcern,disruptionorharm,eitherunintentionallyorasaresultofmaliciousintent.

NOTE1Anindividualmightpursueanattackonan

organizationthroughthemailbecauseitisatargeted,"anonymous"approach,whichoffersadirectroute

intotheorganizationandhasthepotentialtocausesignificantimpact.

NOTE2Anunopenedpostalitemmightraiseconcerns

onaccountofitsexternalappearance.Itmightbebenignbutofunusualappearanceoritmightbeintendedto

causeconcern,disruptionorharm,eitherasahoaxor

anobvioushazard.Alternatively,anitemofmailmightbeintendedtocauseharmordisruptionbutwithoutitsexternalappearanceraisingparticularconcerns.Amoreinvolvedprocess,i.e.atoneofthehigherscreeninglevelssetoutinClause5,isnecessarytodetectthiskindof

threat.AlistofpossibleindicatorsthatadelivereditemmightbeofconcernispresentedinAnnexA.Thislistisquitegeneral,andwhatcouldbedeemedsuspiciousinonecontextmightbequitenormalinanother.

Fromascreeningperspective,itishelpfultoconsiderhazardousitemsandmaterialsasfallingintotwo

categories:

a)discretethreatobjectsandbulkmaterials;and

b)"whitepowders"(see2.13).

NOTE3Disruptionorconcernmightbecausedby

hoaxesintendedtolooklikesuchthreatobjectsandmaterials.Thesendingofhoaxesisacriminaloffence;suspectedhoaxincidentsshouldbereportedtothe

police.

NOTE4Disruptionorconcerncanalsobecausedby

offensivewrittenorgraphicalmaterial,eitherwithin

orontheoutsideoftheitemofmail;whilstinitself

physicallyharmless,itmightbedistressingtothe

recipient,andimportantlyitmightalsobeindicativeofthepresenceofotherhazards.Thesendingofoffensivewrittenorgraphicalmaterialisacriminaloffence;

incidentsshouldbereportedtothepolice.

Discretethreatobjectsandbulkmaterials

NOTE1Thiscoversitemsandbulkquantitiesof

hazardousmaterialswhosepresenceshouldbeclearlydiscerniblewhenmailisX-rayed,evenifalargevolumeofmailisX-rayedatonce.

Thiscategoryincludes:

·explosiveandincendiarydevices(improvisedorofcommercialormilitaryorigin);

·firearmsandammunition;

·knives;

·bladesandothersharpitems(e.g.syringeneedles,brokenglass);

·offensivematerial(e.g.faeces,urine);

·bulkchemicals-toxic,corrosiveorotherwiseharmful,includingnarcotics;

·bulkbiologicalmaterials;and

·bulkradiological(radioactive)materials.

NOTE2Relativelystraightfo