Before an attack, a hostile has to learn how a site works: where the entrances and exits are, where the cameras point, when the patrols pass, how visitors are checked and who might challenge them. ProtectUK, the Counter Terrorism Policing guidance service, calls this hostile reconnaissance and describes it as a vital component of attack planning. The hostile wants to know how good the security is, how likely they are to be detected, and where the vulnerabilities lie. That research happens online, on site and, where possible, through someone on the inside. The useful fact for a site supervisor is that a hostile on site is anxious about being noticed, and that anxiety is exactly what a trained, engaged officer can detect.
1. You cannot spot a hostile, you can spot the behaviour
ProtectUK is direct about this: you cannot spot a hostile from their appearance, age, ethnicity, gender or clothing. What you can do is learn what normal looks like in your environment and notice the difference. The guidance asks staff to know their working environment, their daily routine and the people and activities they see most often, so that the unusual stands out. The behaviours it lists are specific:
- Not really taking a photograph, or photographing something other than what is claimed.
- Loitering in restricted or non-public areas.
- Showing significant interest in entrances, exits, CCTV, security features or staff.
- Asking unusual questions.
- Concealing the face or wearing a disguise.
- Vehicles parked out of place, abandoned, or retracing the same route.
None of these is proof of anything. Together with context, they are a reason to check. ProtectUK's advice, after a dynamic risk assessment, is to approach the person politely and ask them to account for what they are doing. A polite challenge is itself a deterrent: it makes the site feel risky to someone who wants to stay unnoticed.
2. What to log and who to tell
The quality of a report decides whether the police can act on it. ProtectUK lists the details they will want: the date and time, the venue, address and specific location, a description of the person, their clothing or the vehicle and its direction of travel, why the behaviour seemed suspicious, what action was taken, and, if the person was stopped, their name, date of birth, address and phone numbers. The guidance is clear on timing: it is always better that police are called while the person or vehicle is still at the scene. If an immediate response is needed, dial 999. If the person has gone and the route is unknown, or time has passed, use the Anti-Terrorist Hotline on 0800 789321, report online, or call 101.
Inside the organisation, ProtectUK's Tactic IB3 says the most critical aspect of detecting suspicious activity is the immediate reporting. Reports should go straight to a supervisor and the control room, because a CCTV operator may still be able to record the individual, and then to the police where appropriate. An incident report should be completed and kept by the manager responsible for suspicious activity, covered in the next shift briefing, and fed back to the person who raised it. Feedback matters: staff stop reporting when nothing seems to happen.
- Put observing, detecting and responding to suspicious activity into every shift briefing, as ProtectUK's Tactic IB2 recommends, and record the briefing in personal training records.
- Give every officer the reporting list above on a card or in the assignment instructions: date, time, location, description, direction of travel, why it was suspicious, what you did.
- Confirm the escalation route: supervisor and control room first, then police, with 999, 101 and 0800 789321 written where officers can see them.
- Name the manager who owns the suspicious activity record and check the last month's reports were followed up and fed back.
- Vary patrol timing, type and route so patterns cannot be learned from a few days of watching.
- Review what your public website and social media reveal about security arrangements, shift patterns and layouts, and remove what a hostile would find useful.
- Put every officer through hostile reconnaissance and ACT awareness training, and record it on the training matrix.
3. The limits of a security officer's powers
Most reconnaissance incidents involve someone taking photographs, and this is where officers most often overstep. ProtectUK sets out the position plainly. There is no law preventing photography of anything or anyone in a public place. Security staff have no legal power to require images to be deleted, cannot ask to view the images, cannot seize a camera or phone used to take them, and cannot detain a person while waiting for the police. Search and seizure powers belong to police officers. An officer who demands a phone or blocks someone's exit has turned a reportable observation into a complaint and possibly an assault. The right action is to observe, record, report and, where safe, engage politely.
4. Deny, detect, deter
ProtectUK frames the organisational response as Deny plus Detect plus Deter equals Disrupt.
- Deny the hostile the information they want: remove or modify details on public websites, educate staff about what hostiles can find on social media, and use unpredictable patrol timing, type and location so no pattern can be exploited.
- Detect them while they are on site: vigilant, engaged security officers, well sited CCTV and proactive control room operators. The guidance notes that hostiles are anxious about being on site, which makes them easier to detect.
- Deter by promoting your protective security to a hostile audience, since the hostile's own research can carry the message, while taking care not to publish detail that would help attack planning.
The guidance's six point checklist for reducing vulnerability is a useful self assessment for a site manager: a secure online presence, a robust entry process, an understanding of the hostile reconnaissance threat, strong staff security awareness, vigilant and professional security, and a deterrence strategy.
5. The insider route
If a hostile cannot gather what they need online or on site, ProtectUK warns they may try to recruit an insider. It describes four types: the deliberate insider who takes a job intending to abuse access, the self initiated insider who decides to later, the exploited or recruited insider, and the accidental insider who leaks information because they were never trained to recognise an improper request. The defences it lists are a personnel security risk assessment, pre-employment screening, ongoing personnel security and a strong security culture. For a guarding or facilities contractor that means BS 7858 screening done properly and a workforce that knows what an unusual question from a stranger or a colleague looks like.
6. Where this sits under Martyn's Law
The Terrorism (Protection of Premises) Act 2025 received Royal Assent on 3 April 2025 and the Home Office has said the implementation period will be at least 24 months, with the requirements not in force until commenced by regulations. The standard tier covers premises where 200 to 799 people, including staff, may reasonably be expected to be present at the same time; the enhanced tier applies from 800. The Security Industry Authority is the regulator. The standard tier factsheet asks for public protection procedures on evacuation, invacuation, lockdown and communication, says the Act does not require physical alterations or the purchase of specific equipment, and states there is no statutory requirement for specific training, while people with designated roles must be made aware of the procedures and their part in them. The enforcement factsheet gives maximum penalties of £10,000 for standard duty premises and £18 million or 5 percent of worldwide revenue for enhanced duty premises, with the SIA expected to support, advise and guide first and to reserve enforcement for serious or persistent non-compliance. Staff who can recognise and report reconnaissance are the practical foundation of all four procedures.
Where the training fits
Each course below is a structured online course with an assessment and a QR-verifiable certificate recorded on your training matrix, so the awareness ProtectUK asks for exists as evidence rather than as a memory of a toolbox talk.
| Topic | Course |
|---|---|
| Spotting the rehearsal before the attack, logging and reporting it | Hostile Reconnaissance Detection, aligned to the ProtectUK guidance, 60 minutes. |
| Recognising suspicious activity and responding to threats in crowded places | ACT Counter-Terrorism Awareness, the 30 minute companion to the free ACT e-learning on ProtectUK. |
| Writing the report the police and a court can use | Incident Reporting & Statement Writing: chronology, facts, language and signatures, 60 minutes. |
| Patrols that deter, detect and deny without a learnable pattern | Patrol & Site Inspection Techniques, 35 minutes. |
Pair these with the free ProtectUK products: ACT e-learning for all staff and SCaN for All, which ProtectUK describes as designed to increase awareness of hostile reconnaissance and suspicious behaviour and how to counter it, built around See, Check and Notify.
References
- ProtectUK, Counter Terrorism Policing, Hostile reconnaissance. protectuk.police.uk/hostile-reconnaissance
- ProtectUK, SCaN for all staff. protectuk.police.uk/advice-and-guidance/security/scan-all-staff
- ProtectUK, Tactic IB2: Ensure that staff are briefed in observing, detecting and responding to suspicious activity. protectuk.police.uk/tactic-ib2
- ProtectUK, Tactic IB3: Ensure that any suspicious activity is reported in a timely manner. protectuk.police.uk/tactic-ib3
- ProtectUK, Free training and awareness resources. protectuk.police.uk/free-training-and-awareness-resources
- Home Office, Terrorism (Protection of Premises) Act 2025: overarching factsheet. gov.uk, overarching factsheet
- Home Office, Terrorism (Protection of Premises) Act 2025: standard duty requirements factsheet. gov.uk, standard duty factsheet
- Home Office, Terrorism (Protection of Premises) Act 2025: the regulator, sanctions and enforcement factsheet. gov.uk, regulator and enforcement factsheet
Sources checked on 11 October 2026. Martyn's Law commencement dates and the detail of the standard and enhanced tier requirements are set by regulations and guidance from the Home Office; check GOV.UK for the current position before relying on any date.