Maintaining and closing a threat case

A threat or security incident can alarm a group of defenders, but it is usually difficult to maintain this feeling of alarm until the threat has passed. Because of the constant outside pressure on defenders in their work, ringing organisational alarm bells too often could lead the group to lose interest and come off their guard.

Raising a group alarm should only happen based on reliable evidence and should be focused on a specific anticipated event. It must be designed to motivate group members to act, and call for a specific set of actions to be taken. To be most effective, an alarm should only stimulate a moderate level of motivation: Too low doesn’t get people to act, but too high creates emotional overload. If the threat is likely to persist over time, it is essential to debrief people and do follow-up after the initial alarm was raised to correct misinformation, change misguided recommendations, and reinforce the group’s trust in their joint efforts.

Finally, if the threat does not materialise, some explanation of why must be provided, and the group should be informed that the threat is lower or has disappeared altogether.

You can consider closing a threat case when the potential attacker is deemed to no longer pose a threat. Ideally, to be sure that you are right to close a case, you should be able to explain why first. Questions should also be asked about changed circumstances which could trigger the person behind the threats to move towards violent action.