5.3 Alarm Verification, Surveillance Systems & Suspicious Package Protocols

Key Takeaways

  • Electronic surveillance (CCTV) systems in Ontario must comply with PIPEDA and IPC guidelines, requiring visible public signage, restricted footage access, and defined retention schedules.
  • Electronic alarm systems comprise intrusion, life-safety (fire), duress/panic, and environmental/supervisory categories, with life-safety and active duress signals requiring immediate priority response.
  • Alarm verification protocols require guards to conduct external perimeter checks for forced entry; if a physical breach is confirmed, guards must not enter alone, must take cover, and must request police dispatch.
  • Suspicious packages must never be touched, moved, opened, or shaken; guards must isolate the room, initiate evacuation, and establish a minimum 100-metre (300-foot) standoff perimeter.
  • All two-way radios and cellular phones must be turned off within the 100-metre standoff zone of a suspected explosive device to prevent radio frequency energy from triggering electric blasting caps.
Last updated: September 2026
Loading diagram...
Suspicious Package and Bomb Threat Incident Response Workflow

Alarm Verification, Surveillance Systems & Suspicious Package Protocols

Core Operational Mandate: Modern security guards operate complex electronic surveillance systems and manage critical life-safety alarms. In every emergency—from responding to verified intrusion alarms to isolating potential explosive packages—guards must follow strict tactical protocols, respect privacy legislation, maintain radio silence near suspected explosives, and protect human life above property.


Electronic Security & Surveillance Systems (CCTV)

Closed-Circuit Television (CCTV) and Video Management Systems (VMS) are indispensable tools for monitoring wide geographical perimeters, validating alarms, and capturing digital evidence. However, their use is strictly governed by operational tactics and Canadian privacy jurisprudence:

Camera Technologies and Deployments

  • Fixed Focal-Length Cameras: Mounted in a stationary position to provide continuous, uninterrupted surveillance over a designated high-priority asset or choke point (e.g., cash vaults, access control turnstiles, loading dock gates). Because their field of view never changes, they provide reliable forensic baselines.
  • Pan-Tilt-Zoom (PTZ) Cameras: Motorized cameras that allow a security console operator to pan horizontally (360 degrees), tilt vertically, and optically zoom in to track moving suspects or read vehicle license plates across expansive distances. PTZ cameras can also run automated, pre-programmed "guard tours."
  • Infrared (IR) & Thermal Imaging Cameras: IR cameras illuminate dark areas with invisible infrared LEDs for night-vision monitoring. Thermal cameras detect minute differences in heat signatures, enabling detection of human silhouettes through dense foliage, smoke, fog, and total darkness.

Ontario Privacy Standards: PIPEDA and IPC Guidelines

Video surveillance captures personal biometric and behavioural information. In Ontario, private security video monitoring must comply with the Personal Information Protection and Electronic Documents Act (PIPEDA) and guidelines established by the Information and Privacy Commissioner of Ontario (IPC):

  1. Public Notification Signage: Conspicuous, legible signage must be posted at all perimeter property boundaries and building entry points informing members of the public that the premises are subject to video surveillance, stating the specific purpose of the surveillance (e.g., public safety, crime prevention), and providing security management contact information.
  2. Prohibited Surveillance Locations: Cameras must never be installed in areas where individuals possess a reasonable, constitutionally protected expectation of personal privacy, including employee washrooms, change rooms, shower areas, and lactation rooms. Installing surveillance in these areas constitutes an offense under privacy legislation and may result in criminal charges under Section 162 (Voyeurism) of the Criminal Code of Canada.
  3. Data Retention and Video Evidence: Standard digital video recordings must be maintained on secure Network Video Recorders (NVR) for a defined retention schedule (typically 30 to 90 days) before being automatically overwritten. When an incident occurs (such as an assault, break-in, or slip-and-fall), the relevant footage must be exported, secured with cryptographic hash verification, logged in the evidence register, and preserved with an unbroken chain of custody for police investigators and court proceedings.

Alarm Classification and System Architecture

Security guards monitor integrated alarm panels connected to central monitoring stations (certified under Underwriters Laboratories of Canada / ULC standards). Electronic alarms are divided into four functional categories:

  1. Intrusion Alarms: Designed to detect unauthorized physical entry into a secure building or perimeter. Sensors include:
    • Passive Infrared (PIR) Sensors: Detect sudden shifts in infrared thermal radiation caused by a warm human body moving across cold background zones.
    • Dual-Technology Sensors: Combine PIR and microwave Doppler sensors. Both technologies must trigger simultaneously to activate an alarm, drastically cutting false alarms from drafts or temperature fluctuations.
    • Magnetic Reed Contacts: Installed on doors and windows. When the door opens, the magnet separates from the reed switch, breaking the electrical circuit.
    • Acoustic and Seismic Glass-Break Detectors: Acoustic sensors listen for the precise dual frequencies of glass breaking (low-frequency thump of impact followed by high-frequency shatter). Seismic sensors detect mechanical shockwaves travelling through physical window glass or structural vault walls.
  2. Life-Safety (Fire) Alarms: Integrated with building life-safety systems. Initiated by manual pull stations, photoelectric smoke detectors, rate-of-rise heat detectors, duct detectors, or water-flow switches in fire sprinkler risers. Fire alarms operate in two standard configurations:
    • Single-Stage Alarm: Immediate sounding of a continuous evacuation tone throughout the entire building requiring immediate total evacuation.
    • Two-Stage Alarm: Initial sounding of an intermittent alert tone (e.g., 20 strokes per minute) allowing security and fire wardens a 5-minute investigation window to verify if the fire is genuine before an evacuation signal sounds automatically.
  3. Duress / Panic Alarms: Silent hold-up alarms installed in high-risk areas (e.g., cash handling windows, pharmacy counters, jewelry display desks). Devices include foot rails, under-counter push buttons, bill traps inside cash drawers, and wireless mobile duress pendants carried by lone workers. They transmit a silent, high-priority emergency signal directly to the monitoring station without generating local sirens that could trigger hostage-taking.
  4. Environmental & Supervisory Alarms: Monitor critical physical infrastructure to prevent property devastation: low-temperature freeze switches (preventing pipe bursts), high-water sump sensors (detecting basement flooding), HVAC air pressure sensors, carbon monoxide detectors, emergency generator run/fault signals, and sprinkler valve tamper switches.
Alarm ClassificationTypical Sensor MechanismsOperational TriggersSecurity Monitoring PriorityPrimary Response Actions
Life-Safety (Fire)Smoke detectors, manual pull stations, sprinkler water-flow switchesFire combustion gases, thermal heat rise, open sprinkler head flowCritical Priority 1Investigate annunciator panel, assist building evacuation, meet arriving Fire Services with master keys and riser maps
Duress / PanicUnder-counter push buttons, foot rails, bill traps, wireless pendantsRobbery, physical assault, hostage threat to personnelCritical Priority 1Silent monitoring, initiate CCTV tracking of suspect, notify 911 immediately; do not transmit audible radio sirens
Intrusion / BurglarPIR motion sensors, magnetic door contacts, glass-break sensorsUnauthorized door opening, window breach, interior movementHigh Priority 2Conduct exterior perimeter inspection, verify forced entry; if breached, take cover and call police; if false, reset panel
EnvironmentalTemperature freeze switches, water leak sensors, generator monitorsPipe freeze conditions, water leaks, boiler/HVAC failureStandard Priority 3Inspect mechanical room, notify facility engineering / on-call property managers, secure affected physical assets

Alarm Response and Verification Protocols

Due to the enormous volume of false alarms—caused by user error, drafts, fluttering banners, and wildlife—municipal police services across Ontario enforce strict Verified Alarm Response Policies. Police will not dispatch officers to unverified intrusion alarms unless physical or electronic verification confirms that a crime is actively occurring.

Step-by-Step Tactical Response to Intrusion Alarms

  1. Acknowledge and Log: Record the exact time of alarm receipt, the specific alarm zone, sensor type, and building location in your field notebook.
  2. Tactical Approach: When arriving at the facility (by foot or vehicle), maintain heightened situational awareness. Turn off vehicle high-beams and avoid blaring radios. Scan the exterior perimeter for lookout persons, suspicious parked vehicles with running engines, or individuals walking away quickly.
  3. Conduct Exterior Perimeter Inspection: Systematically check all ground-floor doors, windows, fire exit corridors, basement window wells, and loading docks. Look for visual signs of forced entry: cracked or shattered glass, pried door frames, cut padlocks, open roof hatches, or discarded burglary tools.
  4. Assessing the Breach (Critical Safety Rule):
    • IF Signs of Forced Entry are Discovered: DO NOT ENTER THE BUILDING. A security guard is not equipped or mandated to search a dark structure containing potentially armed intruders. Immediately retreat to a secure position of cover that maintains visual surveillance over the exits, notify dispatch or 911, request urgent police dispatch for a "break-in in progress," and observe for fleeing suspects.
    • IF the Exterior Perimeter is Completely Intact: If the exterior shows no signs of tampering and post orders authorize an interior sweep, enter cautiously using authorized access credentials. Silence the local siren if authorized, verify the annunciator panel zone, conduct a room-by-room inspection with a flashlight, identify the cause of the alarm (e.g., loose window sash, spider on PIR lens), reset the alarm panel, and log a detailed occurrence report.

Suspicious Packages and Mail Screening Protocols

Security personnel handling incoming mail, parcel deliveries, or inspecting unattended bags left in public transit areas or office lobbies must be trained to identify indicators of improvised explosive devices (IEDs) or chemical/biological mail threats.

Physical and Visual Indicators of a Suspicious Package

  • Excessive Postage: Multiple high-denomination stamps affixed to the parcel instead of standard corporate metered postage or commercial courier barcodes.
  • Address Anomalies: Handwritten or poorly typed addresses; incorrect titles (e.g., "Vice President of Marketing" addressed to a retired executive); gross misspellings of common words, names, or corporate addresses.
  • Restrictive Markings: Prominent, urgent labels such as "PERSONAL & CONFIDENTIAL", "TO BE OPENED ONLY BY ADDRESSEE", or "DO NOT DELAY."
  • Sender Deficiencies: Complete lack of a return address, or a return address that cannot be verified or contradicts the city postmark.
  • Physical Packaging Anomalies: Asymmetrical, lumpy, or unevenly weighted packaging; springiness or rigid internal wiring; protruding wires, metal foil, or string; excessive sealing tape or rope.
  • Odor and Staining: Unusual chemical odors such as the smell of bitter almonds (cyanide/explosive compounds), marzipan, sulfur, shoe polish, or petroleum; oily, greasy stains or discolouration bleeding through paper wrapping; powdery residues on seams.
  • Acoustic and Mechanical Cues: Any faint ticking, buzzing, clockwork sounds, or sloshing liquid noises.

Mandatory Immediate Actions (The "DO NOT" Rules)

If an item is identified as suspicious, the security guard must adhere to uncompromising safety mandates:

  • NEVER touch, lift, move, shake, bend, open, or squeeze the item.
  • NEVER immerse the item in water or cover it with a bucket or cloth (water can complete electrical firing circuits, while covering conceals visual blast warnings).
  • NEVER attempt to sniff, taste, or closely smell the item or any escaping powders.

Standoff Perimeter and Radio Silence Protocols

  1. Isolate the Immediate Area: Gently step back from the item without creating mechanical shock. If the item was delivered to an office room, evacuate all occupants, close the doors to contain potential blast overpressure, and turn off local HVAC/air ventilation systems if a biological or chemical agent is suspected.
  2. Establish the Standoff Perimeter: Enforce an immediate minimum evacuation standoff distance of 100 metres (approximately 300 feet) in all directions—including rooms directly above and below the suspicious item in multi-story buildings. For large unattended vehicles or pallets, increase the standoff distance to 300–500 metres.
  3. THE RADIO FREQUENCY (RF) TRANSMISSION BAN:
    • Absolute Rule: All two-way security radios, cellular phones, pagers, and wireless handheld devices MUST BE TURNED COMPLETELY OFF within the 100-metre standoff perimeter.
    • Technical Rationale: Radio transmitters emit electromagnetic radio frequency (RF) energy. If a bomb utilizes an electric blasting cap or electronic bridge wire detonator, the metal wires or components can act as receiving antennas, inducing an electrical current sufficient to detonate the explosive device without warning.
  4. Emergency Notification: Walk well outside the 100-metre standoff zone or utilize a hardwired analog landline telephone to dial 911. Request immediate response from local police and the Police Explosive Disposal Unit (EDU).

Bomb Threat Procedures & Telephonic Threat Management

While suspicious packages represent physical discoveries, many bomb threats are delivered telephonically. Security guards answering central switchboards or emergency desks must handle bomb threat calls with exceptional poise, using a standardized Bomb Threat Telephone Checklist.

Managing the Telephone Call

  • Remain Calm and Attentive: Do not interrupt the caller. Keep the caller talking as long as possible. The longer the call lasts, the more operational intelligence can be gathered.
  • Discreet Communication: While keeping the caller on the line, silently write a note to a colleague (e.g., "Bomb threat on line 1 - call 911 on another phone") to alert supervisors and law enforcement immediately.
  • Exact Verbatim Wording: Record the caller's exact words on paper. Note the exact time the call was received, the telephone line it arrived on, and the call display information.

The Nine Critical Bomb Threat Questions

Guards must systematically ask the caller the following tactical questions:

  1. When is the bomb going to explode?
  2. Where is the bomb right now? (Building, floor, room)
  3. What does the bomb look like?
  4. What kind of bomb is it? (Chemical, pipe bomb, dynamite)
  5. What will cause it to detonate? (Timer, remote trigger, tripwire)
  6. Did you place the bomb?
  7. Why did you place the bomb?
  8. Where are you calling from?
  9. What is your name?

Analyzing Caller Characteristics and Background Cues

As the conversation unfolds, the guard must actively listen for auditory and psychological markers:

  • Voice Profile: Estimated age, gender, accent (regional or foreign), pitch, tone (calm, excited, angry, slurred, nasal, stuttering, intoxicated, disguised).
  • Speech Patterns: Rapid, slow, deliberate, scripted, incoherent, laughing, or reading from a written manifesto.
  • Background Acoustic Environment: Street traffic, train horns, factory machinery, music, office typing, PA announcements, children crying, aircraft, or cellular static.

Evacuation Decision and Search Protocol

  • Evacuation Authority: Under Canadian law, the legal decision to evacuate a commercial property rests with the property owner, building manager, or designated tenant representative, not the junior security guard, unless an active device is visually confirmed or public emergency services (police/fire incident commanders) order a mandatory evacuation.
  • Search Execution: If an evacuation is ordered or a search is initiated prior to police arrival, facility staff and security guards familiar with the building should conduct visual sweeps of their own work areas. Outside police officers do not know where janitorial supplies belong or what items are normal. Security guards must perform visual sweeps only (scanning floor, waist level, eye level, and ceiling). If any suspicious or out-of-place object is found, NEVER touch it. Mark the room, evacuate the sector, establish the 100-metre standoff perimeter, and report to emergency responders.
Test Your Knowledge

A mobile patrol security guard is dispatched to an intrusion alarm at a corporate commercial park at 02:30. Upon arriving at the site and conducting an exterior perimeter inspection, the guard discovers a smashed ground-floor window and a rear fire exit door propped open with a block of wood. How should the guard proceed?

A
B
C
D
Test Your Knowledge

An office security guard stationed in a corporate mailroom receives an unexpected courier parcel addressed to the company CEO. The package features excessive postage stamps, a handwritten label with misspelled corporate titles, oily stains discolouring the brown paper wrapping, and a faint scent resembling bitter almonds. What combination of actions is mandatory for the guard?

A
B
C
D
Test Your Knowledge

A security guard answers the central security desk telephone and an unidentified caller states: 'A bomb has been placed inside your corporate complex and will explode within two hours.' According to standard emergency response protocols, how should the guard manage this telephone call?

A
B
C
D