4.2 Suspicious Packages & Unknown Substances

Key Takeaways

  • Common indicators of suspicious packages include excessive postage, greasy stains, wires, and no return address.
  • Upon discovering a suspicious package, never touch or move it; immediately isolate the area and evacuate nearby rooms.
  • Turn off HVAC systems during "white powder" or chemical incidents to prevent the aerosolized spread of the agent.
  • Avoid using radios or cell phones within 50 feet of suspected explosives to prevent accidental detonation.
Last updated: July 2026

Security guards frequently manage access control and mailroom security, placing them firmly on the front lines for intercepting suspicious packages and unknown substances. Given the extensive history of targeted attacks using the postal system and improvised explosive devices (IEDs)—such as the 2001 Anthrax attacks which deeply affected the D.C. area, and the historical Unabomber campaign—the ability to rapidly identify and systematically respond to these threats is paramount. A suspicious package is broadly defined as any piece of mail, luggage, or unattended item that exhibits characteristics commonly associated with explosives or chemical, biological, radiological, and nuclear (CBRN) threats. Common visual indicators of a suspicious package are vast but highly specific. They include excessive postage (often used to avoid interacting face-to-face with a postal clerk), oily or greasy stains indicating leaking materials, protruding wires or aluminum foil, rigid or uneven envelopes, unprofessionally wrapped parcels with excessive tape, lacking a return address entirely, or bearing a return address that dramatically mismatches the postmark. Additionally, packages that emit strange odors (such as almonds, garlic, or marzipan), have restrictive markings (e.g., "Personal," "Confidential," "Do Not X-Ray"), or are addressed to a generalized title rather than a specific person should raise immediate suspicion. Unattended bags in public areas, especially near critical infrastructure, transit hubs, or crowded spaces, must unconditionally be treated as potential IEDs until explicitly cleared by specialized law enforcement.

Beyond explosive devices, the threat of CBRN materials requires specific, highly stringent, and immediate protocols. The acronym CBRN stands for Chemical, Biological, Radiological, and Nuclear threats. Chemical agents may present as liquids, powders, or invisible gases and can cause an extremely rapid onset of symptoms among victims, such as difficulty breathing, burning eyes, nausea, convulsions, or blistering of the skin. Biological agents, such as Anthrax or Ricin, are particularly insidious; they are often disseminated via the mail system as fine powders (the notorious "white powder" incidents) and may not cause immediate symptoms upon exposure, yet they are highly lethal if inhaled or absorbed. Radiological threats, frequently referred to as "dirty bombs," combine conventional explosives with radioactive material intended to contaminate a wide area, requiring highly specialized Geiger counters and detection equipment to identify. Nuclear threats, while less common for mail delivery, remain a catastrophic critical concern in high-threat metropolitan areas like Washington, D.C.

The immediate security protocol upon discovering a suspicious package or an unknown substance is incredibly strict and entirely non-negotiable: DO NOT HANDLE, MOVE, SHAKE, OR OPEN THE ITEM. The primary and overriding goal is to minimize human exposure and isolate the threat. If you encounter a suspicious package, immediately stop what you are doing, set the item down gently if you are holding it, and instruct all others to step away immediately. Isolate the area by securing the perimeter, closing doors if possible, and ensuring no one enters the immediate vicinity. If a white powder or potential biological/chemical agent is suspected, it is absolutely critical to turn off the facility's Heating, Ventilation, and Air Conditioning (HVAC) systems immediately. Shutting down the HVAC prevents the aerosolized spread of the agent through the ductwork throughout the entire building, containing the lethal contamination to the initial room of discovery.

CBRN and Suspicious Package Indicators

Threat CategoryWarning Signs and Indicators
Explosives (IEDs)Protruding wires, excessive weight for its size, ticking or buzzing sounds, lopsided or uneven packaging, excessive tape, oily stains.
Biological AgentsUnexplained powders (especially fine white powder), strange insect activity, mass casualties with no obvious physical trauma, delayed onset illnesses.
Chemical AgentsUnexplained odors (e.g., bitter almonds, garlic, cut grass, apple blossoms), low-lying clouds or fog indoors, multiple people rapidly exhibiting watery eyes, choking, or skin blistering.
RadiologicalUnexplained heat emitting from a package, heavy shielding (like lead making a small box very heavy), visible radiation warning symbols, glowing materials.

Following isolation, you must evacuate the immediate area and nearby rooms, directing occupants to a pre-designated safe zone that is upwind and uphill from the incident (to avoid airborne contamination and heavier-than-air gases). Be careful not to create a panic, but act with clear authority and urgency. Notify emergency responders by calling 911 immediately. Provide dispatchers with the exact location of the item, a detailed physical description (size, shape, color, specific markings), and crucial information about any exposed individuals or symptoms observed. There is a vital communication restriction during these events: Do not use two-way radios, walkie-talkies, or cell phones within 50 feet of a suspected explosive device. The radio frequency (RF) transmissions from these devices can potentially induce a current and trigger the detonator of an IED. Exposed individuals who came into contact with a powder or chemical should be directed to wash their hands and face with soap and water if a facility is immediately available, but they must remain on-site in a separate, isolated holding area. They cannot be allowed to leave the premises, as they must be medically evaluated and decontaminated by hazardous materials (HAZMAT) teams. Proper management of a suspicious package incident relies on maintaining absolute calm, strictly securing the perimeter, controlling communication devices, and allowing highly trained emergency responders, such as the MPD Explosive Ordnance Disposal (EOD) team or the FBI, to neutralize the threat safely.

Test Your Knowledge

What is the primary reason for turning off the HVAC system when an unknown white powder is discovered in an office building?

A
B
C
D
Test Your Knowledge

If you discover a suspicious package that you suspect may be an improvised explosive device (IED), which of the following actions should you AVOID doing?

A
B
C
D
Test Your Knowledge

Which of the following is a common visual indicator of a suspicious mail package?

A
B
C
D