Module 01 — Terrorism (Protection of Premises) Act 2025

The Alert

A sold-out Saturday night. An unattended bag. A staff member who saw something. Your procedures are about to be tested.

THREAT LEVEL: SUBSTANTIAL

00:00:00 GREEN 01 — The Alert

SITUATION FEED

SITUATION BRIEFING

Saturday, 21:47

The Meridian is at 1,043 of its 1,100 capacity. DJ set is 90 minutes in. 14 bar staff, 6 door supervisors, 3 floor managers on duty.

You are Alex Cartwright, Venue Security Manager and designated senior individual under Section 10 of the Terrorism (Protection of Premises) Act 2025. Your security plan is documented. Your staff completed ACT Awareness training last month. Tonight, you find out if any of it actually works.

VENUE PROFILE

■ The Meridian — live music and events venue, Birmingham city centre. Capacity: 1,100 (enhanced tier)
■ Security plan submitted to SIA in January 2027. Last CTSA assessment: November 2026. Rating: Satisfactory
■ Tonight: sold-out DJ night. Estimated crowd: 1,043. Two entry points, four emergency exits
■ Your radio crackles. It's Nathan on Door 1. His voice is steady but urgent: "Control, I need you at the south entrance. Now."

00:00:00 GREEN 01 — The Alert

SITUATION FEED

ACTIVITY 1 — INTEL TRIAGE

Intel Triage

Four items hit your feed simultaneously. The control room screen is blinking. Saturday night at capacity — everything lands at once.

Drag to rank these by priority. What gets your attention first?

ASSESSMENT

00:00:00 AMBER 01 — The Alert

SITUATION FEED

21:49 — INCIDENT REPORT

Nathan's Report

You reach the south entrance in 90 seconds. Nathan is standing beside a pillar near the cloakroom, positioning himself to observe without being obvious. He's logged the time on his incident sheet.

NATHAN COLE

Door Supervisor — Door 1

CLEARANCE: OPERATIONAL

Nathan Cole — Door 1

21:32 — I observed a male, late 20s, dark jacket, rucksack, approach the south entrance. He didn't queue. He stood back about 15 metres, appeared to be observing the queue and the door search process for approximately 4 minutes.

Nathan Cole

21:36 — He walked past the entrance toward the loading bay. I kept visual. He placed the rucksack against the wall beside the fire exit on the south side. Then he walked away. He didn't enter the venue.

Nathan Cole

21:38 — I radioed Kev on Door 2 to cover my position and went to check. The rucksack is still there. It's a black North Face bag, approximately 40 litres. Slightly open at the top. I didn't touch it.

You

Good. Did he look at any cameras? Did he make eye contact with anyone?

Nathan Cole

No eye contact. But here's the thing — he looked at the fire exit. Not the door. The exit sign above it. Like he was checking it was there.

00:00:00 AMBER 01 — The Alert

SITUATION FEED

ACTIVITY 2 — FIRST RESPONSE

First Response

1,043 people inside. A sold-out night. An unattended bag beside a fire exit. A male who watched the door search process and then left without entering.

It could be nothing. But Nathan's description matches hostile reconnaissance indicators from your ACT training: observing security procedures, timing patrols, identifying exits.

You have 60 seconds. Nathan is watching you. The clock is real.

RESPONSE WINDOW

00:00:00 RED 01 — The Alert

█ SITUATION UPDATE — 21:51

Full Evacuation

You

All stations, all stations. Code Red. Initiate full evacuation. All exits except south fire exit. PA team, activate evacuation message now.

Priya Sharma

Alex, are you serious? There are a thousand people in here. The DJ is mid-set. If we hit the PA now, we could have a crush at the north doors.

You

Priya, I need you on the north exit managing flow. Get your floor team on it. Now.

Priya Sharma

Copy. But if this is a rucksack full of someone's laundry, we just killed a £40,000 night and we'll be on social media by midnight.

ASSESSMENT: NEUTRAL

Full evacuation is a legitimate response under your Section 5 public protection procedures. However, an immediate full evacuation without first cordoning and reporting carries risks: crowd crush at exits, panic, injuries from the evacuation itself. The ACT framework recommends a proportionate response — assess, cordon, report — before full evacuation unless there is an imminent threat to life. It's not wrong. But it's not optimal.

LEGAL INSIGHT

Proportionality Under Section 5

Section 5 requires procedures that are 'appropriate' and 'reasonably practicable' to reduce harm. This means proportionate to the threat level. The ACT framework teaches a graduated response: SEE it, SAY it, SORT it. 'Sorting it' doesn't always mean full evacuation.

00:00:00 AMBER 01 — The Alert

█ SITUATION UPDATE — 21:51

Cordon and Report

You

Nathan, establish a cordon. Nobody within 100 metres of that bag. Lock the south fire exit from inside — use the override. I want Kev and Danny on the internal perimeter. Priya, redirect all foot traffic to the north bars.

Nathan Cole

Copy. Cordon going in now. South exit locked.

You

I'm calling 999. Nathan, stay on the radio. If that bag moves, if anyone approaches it, if anything changes — you tell me immediately.

Priya Sharma

Understood. I'll close the south bar and move staff to north. Patrons won't even notice if we're quick.

ASSESSMENT: OPTIMAL RESPONSE

This is the ACT-recommended proportionate response. You've followed the See It, Say It, Sort It framework. Cordoning the area and reporting to police is consistent with your Section 6 public protection measures — specifically monitoring and controlling movement of individuals. You've contained the potential threat without creating a secondary risk from evacuation.

LEGAL INSIGHT

Graduated Response

Section 6 requires 'appropriate measures' to reduce vulnerability and harm. A cordon reduces vulnerability (restricts access to the threat). Locking the exit and redirecting traffic reduces harm (moves people away). This is a proportionate activation of your public protection measures.

00:00:00 RED 01 — The Alert

█ SITUATION UPDATE — 21:51

Personal Investigation

You

I'll go check it out. It's probably nothing. Nathan, hold position.

Nathan Cole

Alex — I'd strongly advise against approaching the item. ACT training is clear: do not touch, do not move, do not use a mobile phone near it. Report it.

You

I'm not going to touch it. I'm just going to look.

Nathan Cole

With respect, that's exactly what the training says not to do. If this is a device and it's on a timer or a command wire, you're putting yourself in the blast zone.

ASSESSMENT: PROCEDURAL FAILURE

Nathan is right. The ACT Awareness training explicitly states: do not touch, do not approach, do not use mobile phones near suspicious items. By approaching the bag yourself, you've violated your own security plan — the plan you submitted to the SIA under Section 7. Your door supervisor tried to stop you. You overruled him. That's a leadership failure compounding a procedural one.

LEGAL INSIGHT

Your Own Plan Is Your Obligation

Section 7 requires enhanced duty venues to document their procedures and submit them to the SIA. Once submitted, those procedures aren't suggestions — they're your stated compliance position. Deviating from your own documented procedures during an incident is exactly what the SIA will examine.

00:00:00 RED 01 — The Alert

█ TIME EXPIRED — DEFAULT ACTION TAKEN

No Decision

Nathan Cole

Alex? Alex — what's the call? I've got an unattended item 8 metres from a fire exit with a thousand people on the other side of the wall.

You

I'm... thinking.

Nathan Cole

Respectfully, we don't have time for thinking. We need a decision. Cordon, evacuate, or something — but standing here doing nothing isn't an option.

ASSESSMENT: INDECISION

Indecision in a security incident is itself a decision — the worst one. While you hesitated, 1,043 people remained in proximity to an unassessed item. The Section 10 designation exists because someone needs the authority to make real-time decisions. If the designated individual freezes, the system fails. Nathan has begun implementing a cordon on his own initiative. He shouldn't have had to.

LEGAL INSIGHT

The Cost of Hesitation

Section 10 designates an individual with 'responsibility for ensuring' compliance. This is an active duty, not a passive one. The SIA will not ask whether you made the perfect decision. They will ask whether you made a timely, reasonable decision consistent with your procedures. No decision is never reasonable.

00:00:00 AMBER 01 — The Alert

SITUATION FEED

21:58 — POLICE RESPONSE

Police Response

Nine minutes have passed. Regardless of your first action, the police have been contacted. PC Tom Davies — the Counter Terrorism Security Advisor assigned to your venue — is en route. ETA: 12 minutes.

The crowd inside is unaware. The DJ is playing. The bars are serving. But your radio is buzzing. Priya has just reported something from the north mezzanine.

And she's not happy about it.

00:00:00 AMBER 01 — The Alert

SITUATION FEED

ACTIVITY 3 — RADIO EXCHANGE

Radio Exchange

PRIYA SHARMA

Front of House Manager

CLEARANCE: OPERATIONAL

Priya's voice comes through on the radio. She's flagged something — but she's also pushing back on the cordon. How you handle this conversation determines whether your team stays unified or fractures under pressure.

Choose your response. Your tone matters as much as the content.

ASSESSMENT

00:00:00 AMBER 01 — The Alert

SITUATION FEED

22:14 — POLICE ON SITE

PC Davies Arrives

PC TOM DAVIES

Counter Terrorism Security Advisor (CTSA)

CLEARANCE: OPERATIONAL

PC Tom Davies arrives at the south entrance. He's in plainclothes tonight — he was off duty when the call came in. He flashes his warrant card at Nathan, who logs him through.

You brief him at the south entrance. He listens without interrupting, then asks three questions: 'Where's the bag now? Where's the woman now? And have you called Helen?'

The bag hasn't moved. The woman left through the north exit 6 minutes ago. You haven't called Helen yet.

PC Davies: 'The bag needs to be assessed by EOD. That could take 90 minutes. I'm recommending partial evacuation of the south side. But that's your call. It's your venue, your procedures, your Section 7 plan.'

Then Danny radios in. There's a man at the main entrance claiming the bag is his.

00:00:00 AMBER 01 — The Alert

SITUATION FEED

ACTIVITY 4 — EVIDENCE ASSESSMENT

Evidence Assessment

KIERAN WALSH

Bag Owner — Guest List

CLEARANCE: OPERATIONAL

Kieran Walsh, late 20s, dark jacket. He says he left his bag by the south fire exit to take a phone call and forgot it. He's on the guest list. His ticket is genuine.

PC Davies says: 'Don't let him near the bag. But before I talk to him, I want you to think about what you know. Not what you feel — what you know.'

Drag each piece of evidence into the correct column. Or click a card, then click a column.

SUPPORTS THREAT

SUPPORTS INNOCENT

INCONCLUSIVE

ASSESSMENT

00:00:00 AMBER 01 — The Alert

█ SITUATION UPDATE — 22:25

Holding the Line

PC Davies

Good assessment. The bag stays cordoned, nobody approaches, and I'll take a statement from Mr Walsh while we wait for EOD. What's his demeanour?

You

Nervous. Fidgeting. But that could be because he's being questioned by security at a police cordon.

PC Davies

Or it could be something else. Either way, we wait.

You

Kieran, I understand this is frustrating. We've had a report about an unattended item and we have a specialist team arriving in about 12 minutes. It's a safety precaution.

Kieran Walsh

Are you serious? It's my bag. I can describe everything in it.

You

I believe you. But until the item is assessed, nobody goes near it — including us. Can I get you a water while you wait?

Kieran Walsh

...Yeah, alright.

Holding the perimeter while treating Kieran with dignity is the proportionate response. PC Davies will verify his story independently. EOD will assess the bag. You don't need to resolve the ambiguity yourself.

00:00:00 GREEN 01 — The Alert

SITUATION FEED

22:47 — ALL CLEAR

Resolution

EOD arrives at 22:43. They assess the bag. Four minutes of silence on the radio that feel like forty.

At 22:47, the EOD team leader gives the all-clear. The bag contains clothes, a phone charger, a bottle of ibuprofen, and a copy of a train ticket from Manchester Piccadilly to Birmingham New Street. It belongs to Kieran Walsh. He's telling the truth.

The woman on the mezzanine is never identified. She may have been a TikTok content creator. She may have been something else. You'll never know.

The south side reopens at 23:02. The DJ extends his set by 30 minutes. The bars pour an extra £4,200 before close. Kieran Walsh gets his bag back and stays for the rest of the night.

Helen arrived at 23:00. At 01:30, after the venue empties, she pours two coffees in the office.

00:00:00 GREEN 01 — The Alert

SITUATION FEED

ACTIVITY 5 — SECURITY SWEEP

Security Sweep

Helen pushes a blank incident report form across the desk. 'That went well,' she says. 'Better than I expected for the first real test. But walk me through the sweep you should have run once you had the full picture — the bag, the mezzanine woman, Kieran at the entrance. If this had been coordinated, where do you check, and in what order?'

Trace your security sweep. Click locations in the order you'd check them.

THE MERIDIAN — VENUE FLOORPLAN 0 / 6

CONTROL
ROOM
(CCTV)

MAIN FLOOR
DJ BOOTH

NORTH
MEZZANINE

LOADING
BAY

MAIN
ENTRANCE

SOUTH FIRE EXIT

ASSESSMENT

00:00:00 GREEN 01 — The Alert

00:00:00 RESOLVED 01 — The Alert

█ INCIDENT CLOSED — 02:15

Incident Closed

Nobody was hurt. The bag was innocent. The total cost: approximately £3,800 in refund vouchers and one extended DJ set. The total cost of not being prepared: up to £18 million in penalties under Section 18, a restriction notice under Section 14 — and the knowledge that 22 people died at Manchester Arena because no one was required to have a plan. Now someone is. That someone is you.

RESPONSE RATING

CLEARANCE LEVEL

--

-- / --

00:00:00 RESOLVED 01 — The Alert

DEBRIEF — KEY TAKEAWAYS

01

Triage Is the First Test — On a busy night, the ability to cut through noise and identify what matters is the difference between a managed incident and a missed one. Your Section 5 procedures must be activatable under real conditions.

02

Proportionate Response Saves Lives — The ACT framework teaches graduated response: See it, Say it, Sort it. Full evacuation isn't always the answer. Cordon, report, and manage — then escalate if needed.

03

Communication Holds Teams Together — How you talk to your team under pressure determines whether they're partners or subordinates. Tiered communication — security gets detail, floor managers get context, bar staff get readiness cues.

04

Evidence Over Instinct — Distinguishing what supports a threat, what's genuinely unclear, and what's innocent is analytical work. 'I had a feeling' is not defensible. 'I assessed six pieces of information' is.

05

Systematic Sweeps, Not Reactive Searches — A security sweep starts with information (control room), moves to the primary threat, traces the subject's route, checks secondary indicators, reviews access points, and only then assesses the crowd. Going straight to the people means moving without intelligence.

06

Communicate Up with Precision — SBAR isn't a form — it's a thinking framework. Situation gives facts, Background establishes compliance, Assessment is honest about gaps, Recommendation is specific and costed. Every link in the reporting chain needs clarity, not reassurance.

Named after Martyn Hett, one of 22 people killed at Manchester Arena on 22 May 2017.
The difference between those outcomes and tonight's is preparation — and that preparation is now the law.

The Alert

Saturday, 21:47

Intel Triage

Nathan's Report

First Response

Full Evacuation

Cordon and Report

Personal Investigation

No Decision

Police Response

Radio Exchange

PC Davies Arrives

Evidence Assessment

Holding the Line

Resolution

Security Sweep

Helen's Briefing

Incident Closed