Module 01 — Terrorism (Protection of Premises) Act 2025

The Alert

A sold-out Saturday night. An unattended bag. A staff member who saw something. Your procedures are about to be tested.

THREAT LEVEL: SUBSTANTIAL
00:00:00 GREEN 01 — The Alert
SITUATION FEED

Saturday, 21:47

CCTV — CONTROL ROOM — 21:47
Security control room with wall of CCTV monitors showing crowded nightclub venue

The Meridian is at 1,043 of its 1,100 capacity. DJ set is 90 minutes in. 14 bar staff, 6 door supervisors, 3 floor managers on duty.

You are Alex Cartwright, Venue Security Manager and designated senior individual under Section 10 of the Terrorism (Protection of Premises) Act 2025. Your security plan is documented. Your staff completed ACT Awareness training last month. Tonight, you find out if any of it actually works.

VENUE PROFILE
The Meridian — live music and events venue, Birmingham city centre. Capacity: 1,100 (enhanced tier)
■ Security plan submitted to SIA in January 2027. Last CTSA assessment: November 2026. Rating: Satisfactory
■ Tonight: sold-out DJ night. Estimated crowd: 1,043. Two entry points, four emergency exits
■ Your radio crackles. It's Nathan on Door 1. His voice is steady but urgent: "Control, I need you at the south entrance. Now."
00:00:00 GREEN 01 — The Alert
SITUATION FEED

Intel Triage

CONTROL ROOM — MULTI-FEED ACTIVE — 21:48
Control room desk with phone, radios, and email notification on monitor, CCTV wall behind

Four items hit your feed simultaneously. The control room screen is blinking. Saturday night at capacity — everything lands at once.

Drag to rank these by priority. What gets your attention first?

ASSESSMENT
00:00:00 AMBER 01 — The Alert
SITUATION FEED

Nathan's Report

CCTV — SOUTH ENTRANCE — 21:49
South entrance of The Meridian at night, queue barriers and security lighting

You reach the south entrance in 90 seconds. Nathan is standing beside a pillar near the cloakroom, positioning himself to observe without being obvious. He's logged the time on his incident sheet.

Nathan Cole, Door Supervisor
NATHAN COLE
Door Supervisor — Door 1
CLEARANCE: OPERATIONAL
Nathan Cole — Door 1
21:32 — I observed a male, late 20s, dark jacket, rucksack, approach the south entrance. He didn't queue. He stood back about 15 metres, appeared to be observing the queue and the door search process for approximately 4 minutes.
Nathan Cole
21:36 — He walked past the entrance toward the loading bay. I kept visual. He placed the rucksack against the wall beside the fire exit on the south side. Then he walked away. He didn't enter the venue.
Nathan Cole
21:38 — I radioed Kev on Door 2 to cover my position and went to check. The rucksack is still there. It's a black North Face bag, approximately 40 litres. Slightly open at the top. I didn't touch it.
You
Good. Did he look at any cameras? Did he make eye contact with anyone?
Nathan Cole
No eye contact. But here's the thing — he looked at the fire exit. Not the door. The exit sign above it. Like he was checking it was there.
00:00:00 AMBER 01 — The Alert
SITUATION FEED

First Response

CCTV — SOUTH FIRE EXIT — 21:50
Unattended black rucksack beside a green fire exit door with illuminated EXIT sign

1,043 people inside. A sold-out night. An unattended bag beside a fire exit. A male who watched the door search process and then left without entering.

It could be nothing. But Nathan's description matches hostile reconnaissance indicators from your ACT training: observing security procedures, timing patrols, identifying exits.

You have 60 seconds. Nathan is watching you. The clock is real.

RESPONSE WINDOW
00:00:00 RED 01 — The Alert
█ SITUATION UPDATE — 21:51

Full Evacuation

You
All stations, all stations. Code Red. Initiate full evacuation. All exits except south fire exit. PA team, activate evacuation message now.
Priya Sharma
Alex, are you serious? There are a thousand people in here. The DJ is mid-set. If we hit the PA now, we could have a crush at the north doors.
You
Priya, I need you on the north exit managing flow. Get your floor team on it. Now.
Priya Sharma
Copy. But if this is a rucksack full of someone's laundry, we just killed a £40,000 night and we'll be on social media by midnight.
ASSESSMENT: NEUTRAL
Full evacuation is a legitimate response under your Section 5 public protection procedures. However, an immediate full evacuation without first cordoning and reporting carries risks: crowd crush at exits, panic, injuries from the evacuation itself. The ACT framework recommends a proportionate response — assess, cordon, report — before full evacuation unless there is an imminent threat to life. It's not wrong. But it's not optimal.
00:00:00 AMBER 01 — The Alert
█ SITUATION UPDATE — 21:51

Cordon and Report

You
Nathan, establish a cordon. Nobody within 100 metres of that bag. Lock the south fire exit from inside — use the override. I want Kev and Danny on the internal perimeter. Priya, redirect all foot traffic to the north bars.
Nathan Cole
Copy. Cordon going in now. South exit locked.
You
I'm calling 999. Nathan, stay on the radio. If that bag moves, if anyone approaches it, if anything changes — you tell me immediately.
Priya Sharma
Understood. I'll close the south bar and move staff to north. Patrons won't even notice if we're quick.
ASSESSMENT: OPTIMAL RESPONSE
This is the ACT-recommended proportionate response. You've followed the See It, Say It, Sort It framework. Cordoning the area and reporting to police is consistent with your Section 6 public protection measures — specifically monitoring and controlling movement of individuals. You've contained the potential threat without creating a secondary risk from evacuation.
00:00:00 RED 01 — The Alert
█ SITUATION UPDATE — 21:51

Personal Investigation

You
I'll go check it out. It's probably nothing. Nathan, hold position.
Nathan Cole
Alex — I'd strongly advise against approaching the item. ACT training is clear: do not touch, do not move, do not use a mobile phone near it. Report it.
You
I'm not going to touch it. I'm just going to look.
Nathan Cole
With respect, that's exactly what the training says not to do. If this is a device and it's on a timer or a command wire, you're putting yourself in the blast zone.
ASSESSMENT: PROCEDURAL FAILURE
Nathan is right. The ACT Awareness training explicitly states: do not touch, do not approach, do not use mobile phones near suspicious items. By approaching the bag yourself, you've violated your own security plan — the plan you submitted to the SIA under Section 7. Your door supervisor tried to stop you. You overruled him. That's a leadership failure compounding a procedural one.
00:00:00 RED 01 — The Alert
█ TIME EXPIRED — DEFAULT ACTION TAKEN

No Decision

Nathan Cole
Alex? Alex — what's the call? I've got an unattended item 8 metres from a fire exit with a thousand people on the other side of the wall.
You
I'm... thinking.
Nathan Cole
Respectfully, we don't have time for thinking. We need a decision. Cordon, evacuate, or something — but standing here doing nothing isn't an option.
ASSESSMENT: INDECISION
Indecision in a security incident is itself a decision — the worst one. While you hesitated, 1,043 people remained in proximity to an unassessed item. The Section 10 designation exists because someone needs the authority to make real-time decisions. If the designated individual freezes, the system fails. Nathan has begun implementing a cordon on his own initiative. He shouldn't have had to.
00:00:00 AMBER 01 — The Alert
SITUATION FEED

Police Response

Nine minutes have passed. Regardless of your first action, the police have been contacted. PC Tom Davies — the Counter Terrorism Security Advisor assigned to your venue — is en route. ETA: 12 minutes.

The crowd inside is unaware. The DJ is playing. The bars are serving. But your radio is buzzing. Priya has just reported something from the north mezzanine.

And she's not happy about it.

00:00:00 AMBER 01 — The Alert
SITUATION FEED

Radio Exchange

CCTV — NORTH MEZZANINE — 22:01
Nightclub mezzanine level overlooking a packed dance floor with DJ booth in distance
Priya Sharma, FoH Manager
PRIYA SHARMA
Front of House Manager
CLEARANCE: OPERATIONAL

Priya's voice comes through on the radio. She's flagged something — but she's also pushing back on the cordon. How you handle this conversation determines whether your team stays unified or fractures under pressure.

Choose your response. Your tone matters as much as the content.

ASSESSMENT
00:00:00 AMBER 01 — The Alert
SITUATION FEED

PC Davies Arrives

PC Tom Davies, Counter Terrorism Security Advisor
PC TOM DAVIES
Counter Terrorism Security Advisor (CTSA)
CLEARANCE: OPERATIONAL

PC Tom Davies arrives at the south entrance. He's in plainclothes tonight — he was off duty when the call came in. He flashes his warrant card at Nathan, who logs him through.

You brief him at the south entrance. He listens without interrupting, then asks three questions: 'Where's the bag now? Where's the woman now? And have you called Helen?'

The bag hasn't moved. The woman left through the north exit 6 minutes ago. You haven't called Helen yet.

PC Davies: 'The bag needs to be assessed by EOD. That could take 90 minutes. I'm recommending partial evacuation of the south side. But that's your call. It's your venue, your procedures, your Section 7 plan.'

Then Danny radios in. There's a man at the main entrance claiming the bag is his.

00:00:00 AMBER 01 — The Alert
SITUATION FEED

Evidence Assessment

CCTV — MAIN ENTRANCE — 22:20
Venue main entrance at night with security cordon and police lights
Kieran Walsh, Bag Owner
KIERAN WALSH
Bag Owner — Guest List
CLEARANCE: OPERATIONAL

Kieran Walsh, late 20s, dark jacket. He says he left his bag by the south fire exit to take a phone call and forgot it. He's on the guest list. His ticket is genuine.

PC Davies says: 'Don't let him near the bag. But before I talk to him, I want you to think about what you know. Not what you feel — what you know.'

Drag each piece of evidence into the correct column. Or click a card, then click a column.

SUPPORTS THREAT
SUPPORTS INNOCENT
INCONCLUSIVE
ASSESSMENT
00:00:00 AMBER 01 — The Alert
█ SITUATION UPDATE — 22:25

Holding the Line

PC Davies
Good assessment. The bag stays cordoned, nobody approaches, and I'll take a statement from Mr Walsh while we wait for EOD. What's his demeanour?
You
Nervous. Fidgeting. But that could be because he's being questioned by security at a police cordon.
PC Davies
Or it could be something else. Either way, we wait.
You
Kieran, I understand this is frustrating. We've had a report about an unattended item and we have a specialist team arriving in about 12 minutes. It's a safety precaution.
Kieran Walsh
Are you serious? It's my bag. I can describe everything in it.
You
I believe you. But until the item is assessed, nobody goes near it — including us. Can I get you a water while you wait?
Kieran Walsh
...Yeah, alright.

Holding the perimeter while treating Kieran with dignity is the proportionate response. PC Davies will verify his story independently. EOD will assess the bag. You don't need to resolve the ambiguity yourself.

00:00:00 GREEN 01 — The Alert
SITUATION FEED

Resolution

STATUS — ALL CLEAR — 22:47
Venue door opening with warm light, security cordon removed, returning to normal

EOD arrives at 22:43. They assess the bag. Four minutes of silence on the radio that feel like forty.

At 22:47, the EOD team leader gives the all-clear. The bag contains clothes, a phone charger, a bottle of ibuprofen, and a copy of a train ticket from Manchester Piccadilly to Birmingham New Street. It belongs to Kieran Walsh. He's telling the truth.

The woman on the mezzanine is never identified. She may have been a TikTok content creator. She may have been something else. You'll never know.

The south side reopens at 23:02. The DJ extends his set by 30 minutes. The bars pour an extra £4,200 before close. Kieran Walsh gets his bag back and stays for the rest of the night.

Helen arrived at 23:00. At 01:30, after the venue empties, she pours two coffees in the office.

00:00:00 GREEN 01 — The Alert
SITUATION FEED

Security Sweep

DEBRIEF — VENUE FLOORPLAN ANALYSIS — 01:30
Architectural blueprint on dark desk with green glowing location markers, pen and radio

Helen pushes a blank incident report form across the desk. 'That went well,' she says. 'Better than I expected for the first real test. But walk me through the sweep you should have run once you had the full picture — the bag, the mezzanine woman, Kieran at the entrance. If this had been coordinated, where do you check, and in what order?'

Trace your security sweep. Click locations in the order you'd check them.

THE MERIDIAN — VENUE FLOORPLAN 0 / 6
SOUTH FIRE EXIT MAIN ENTRY N
CONTROL
ROOM
(CCTV)
MAIN FLOOR
DJ BOOTH
NORTH
MEZZANINE
LOADING
BAY
MAIN
ENTRANCE
SOUTH FIRE EXIT
ASSESSMENT
00:00:00 GREEN 01 — The Alert
SITUATION FEED

Helen's Briefing

VENUE OFFICE — POST-INCIDENT — 02:00
Dark venue office with desk lamp, laptop showing SBAR form, two chairs
Helen Osei, General Manager
HELEN OSEI
General Manager
CLEARANCE: OPERATIONAL

Helen finishes her coffee. 'Right. I need something I can take to the board on Monday morning. And I need it structured — not a story, a briefing. Situation, Background, Assessment, Recommendation. Four boxes. Fill them in.'

Compose your SBAR briefing for Helen. Select the best option for each field.

S — SITUATION
B — BACKGROUND
A — ASSESSMENT
R — RECOMMENDATION
HELEN'S RESPONSE
ASSESSMENT
00:00:00 RESOLVED 01 — The Alert
█ INCIDENT CLOSED — 02:15

Incident Closed

Nobody was hurt. The bag was innocent. The total cost: approximately £3,800 in refund vouchers and one extended DJ set. The total cost of not being prepared: up to £18 million in penalties under Section 18, a restriction notice under Section 14 — and the knowledge that 22 people died at Manchester Arena because no one was required to have a plan. Now someone is. That someone is you.

RESPONSE RATING
CLEARANCE LEVEL
--
-- / --
00:00:00 RESOLVED 01 — The Alert
01
Triage Is the First Test — On a busy night, the ability to cut through noise and identify what matters is the difference between a managed incident and a missed one. Your Section 5 procedures must be activatable under real conditions.
02
Proportionate Response Saves Lives — The ACT framework teaches graduated response: See it, Say it, Sort it. Full evacuation isn't always the answer. Cordon, report, and manage — then escalate if needed.
03
Communication Holds Teams Together — How you talk to your team under pressure determines whether they're partners or subordinates. Tiered communication — security gets detail, floor managers get context, bar staff get readiness cues.
04
Evidence Over Instinct — Distinguishing what supports a threat, what's genuinely unclear, and what's innocent is analytical work. 'I had a feeling' is not defensible. 'I assessed six pieces of information' is.
05
Systematic Sweeps, Not Reactive Searches — A security sweep starts with information (control room), moves to the primary threat, traces the subject's route, checks secondary indicators, reviews access points, and only then assesses the crowd. Going straight to the people means moving without intelligence.
06
Communicate Up with Precision — SBAR isn't a form — it's a thinking framework. Situation gives facts, Background establishes compliance, Assessment is honest about gaps, Recommendation is specific and costed. Every link in the reporting chain needs clarity, not reassurance.

Named after Martyn Hett, one of 22 people killed at Manchester Arena on 22 May 2017.
The difference between those outcomes and tonight's is preparation — and that preparation is now the law.