Counter-terrorism for critical infrastructure security officers: hostile reconnaissance, suspicious items and Martyn’s Law
How security officers protecting UK critical infrastructure can spot hostile reconnaissance, respond to suspicious items and attacks, and prepare for Martyn's Law.
This article is general guidance and is not legal advice. Always follow your employer’s policy and your site’s assignment instructions.
The UK depends on critical national infrastructure (CNI): energy, water, transport, telecommunications, health, food, finance and more. If these systems are disrupted, the effects can reach millions of people. That makes them attractive targets for terrorists, hostile states and other criminals.
Security officers at power stations, data centres, water treatment works, transport hubs and similar sites are a vital part of the country’s defence. This guide explains how to spot early warning signs, respond to threats and keep up with the changing law.
Key Takeaways
- Attacks are usually preceded by planning and hostile reconnaissance, which alert officers can disrupt.
- Engaging politely with people (See, Check and Notify) deters and detects hostile activity.
- Use HOT and the 4 Cs for suspicious items, and Run, Hide, Tell during an attack.
- Insider threats are as important as outside threats.
- Martyn’s Law is expected to come into force in spring 2027, with the SIA as regulator.
What counts as critical national infrastructure?
The UK government groups CNI into sectors, including chemicals, civil nuclear, communications, defence, emergency services, energy, finance, food, government, health, space, transport and water. Not every site in these sectors is classed as critical, but many share the same security needs: strong perimeters, strict access control, vigilant staff and fast reporting.
Protective security advice for these sites comes from the National Protective Security Authority (NPSA), which works alongside counter-terrorism policing.
Understanding the threat
The UK national threat level is set by the Joint Terrorism Analysis Centre and published on the MI5 threat levels page. Check it regularly, as it can change quickly after an incident.
Threats to CNI can include:
- physical attacks using vehicles, weapons or explosives;
- sabotage of equipment or control systems;
- cyber attacks, sometimes supported by physical access;
- insider threats from staff or contractors;
- protest activity that disrupts operations;
- drones used for surveillance or disruption.
Martyn's Law and what it means for security staff
The Terrorism (Protection of Premises) Act 2025, known as Martyn’s Law, is named after Martyn Hett, one of the 22 people killed in the Manchester Arena attack. The Security Industry Authority (SIA) is the regulator. According to the SIA’s guidance, the Act is expected to come into force in spring 2027. Check that page for the SIA’s latest regulatory guidance.
The law mainly covers publicly accessible premises and events, split into a standard tier (for expected capacities of 200 to 799 people) and an enhanced tier (800 or more). Some CNI sites, such as major stations or hospitals, may be in scope; others with no public access may not. Either way, its principles, such as having clear procedures for evacuation, invacuation, lockdown and communication, are good practice for every site.
Preparing your site for Martyn’s Law? The free ACT e-learning from ProtectUK is a good start for your whole team, and our ACT training guide explains how to do it.
Spotting hostile reconnaissance
Attackers usually research their target. This planning stage is when they are most vulnerable to detection. Watch for people who:
- photograph or film fences, gates, cameras, control rooms or guard positions;
- spend time near the site without a clear reason, or return repeatedly;
- show unusual interest in shift changes, deliveries or security routines;
- test your response, for example by leaving an item or touching a fence to trigger an alarm;
- try to get information from staff in person, by phone or on social media;
- use drones near the site;
- appear nervous, avoid cameras or change direction when they see security.
Attackers want certainty. A visible, alert and unpredictable security operation makes planning much harder.
See, Check and Notify
See, Check and Notify (SCaN) is an NPSA-developed approach that helps staff deter and detect hostile activity. The idea is simple:
- See unusual behaviour.
- Check it, often by engaging with the person in a friendly way: “Hello, can I help you with anything?”
- Notify the right people, such as your control room or the police.
Most people you speak to will be innocent. For someone carrying out reconnaissance, being noticed and spoken to is often enough to make them abandon the target.
Learn HOT and Run, Hide, Tell for free
The ACT Awareness and ACT Security e-learning from ProtectUK is free and takes just over two hours for both courses.
Strengthening everyday security
The basics matter most on critical sites:
- Access control: check every pass against the person and their authorisation, every time.
- Vehicle checks: confirm deliveries are expected and inspect vehicles as policy requires.
- Perimeter patrols: look for damaged fences, dug-out ground, cut locks and items left near boundaries.
- CCTV: monitor actively and investigate alarms promptly.
- Unpredictability: vary patrol times, routes and search patterns.
- Information security: never discuss site security in public or online.
- Hostile vehicle mitigation: know where the site’s barriers, bollards and blockers are, check they are in the correct position on every patrol, and never leave a vehicle barrier raised or a gate open unattended.
CNI control rooms run 24 hours a day
Train for your SIA CCTV licence in three days at one of our London centres.
Suspicious items: HOT and the 4 Cs
Assess any unattended item using HOT:
- Hidden: has it been deliberately concealed?
- Obviously suspicious: wires, batteries, liquids, powders or unusual smells?
- Typical: is it out of place for the location?
If an item is suspicious, apply the 4 Cs:
- Confirm it is suspicious.
- Clear the area, moving people well away.
- Communicate: move away from the item, then call 999 and tell your control room.
- Control access to the area until police arrive, keeping people behind the cordon.
National guidance suggests starting distances of 100 metres for a small item such as a bag, 200 metres for a large item such as a suitcase or a car, and 400 metres for a large vehicle such as a van or lorry. Then follow the instructions of police and your control room.
Do not touch, move or cover the item. Do not use radios or mobile phones close to it. Call 999.
| Situation | Action |
|---|---|
| Suspicious item | HOT, then 4 Cs, then call 999 |
| Hostile reconnaissance suspected | Engage if safe, record details, notify control and police |
| Weapons or terrorist attack | Run, Hide, Tell |
| Suspicious vehicle | Do not approach if it appears to pose a threat, record registration, call 999 |
| Non-urgent concern | Report through ACT online or the anti-terrorism hotline |
Responding to an attack: Run, Hide, Tell
If a weapons or terrorist attack happens, follow the national advice:
- Run to a place of safety if there is a safe route. Leave belongings behind. Encourage others to come with you.
- Hide if you cannot run. Find cover from gunfire, lock or barricade yourself in, stay away from doors, be quiet and silence your phone.
- Tell the police by calling 999 when it is safe. Give your location, the attackers’ descriptions and direction, and what they are doing.
When armed police arrive, follow their instructions, keep your hands visible and avoid sudden movements.
Insider threats
Some of the most damaging incidents involve people who already have access. Warning signs can include:
- trying to access areas or information not needed for their role;
- unusual working hours without a clear reason;
- taking photographs of sensitive areas or documents;
- sudden changes in behaviour, finances or loyalties;
- expressing extremist views or sympathy for violence;
- disabling or bypassing security controls.
Report concerns calmly and factually through your organisation’s proper channels. Do not investigate or confront colleagues yourself.
Screening is the first defence against insider threat. Security officers on CNI sites are normally vetted to BS 7858, which checks identity, address history, employment and criminal records, and some roles require government security clearance on top. Keep your own records in order, because gaps in your history slow the process down.
Training makes the difference
Counter-terrorism awareness is now part of SIA licence-linked training. The free ACT Awareness and ACT Security e-learning on ProtectUK gives every member of staff the basics, from HOT assessments to Run, Hide, Tell, and you need both certificates before an SIA refresher course. Many high-security sites also train their staff in SCaN, so ask what your site expects. Redo the e-learning regularly to keep the skills sharp.
How to report concerns
- Emergency or immediate threat: call 999.
- Non-urgent suspicious activity: report online through the government’s Action Counters Terrorism page at gov.uk/ACT, or call the confidential anti-terrorism hotline on 0800 789 321.
- Internally: tell your control room and security manager, and log the details.
Good reports include the date, time, location, descriptions of people and vehicles, registration numbers, what they were doing, and CCTV references.
How to work in critical infrastructure security
Power stations, data centres, water sites and transport hubs need trained security officers. Employers usually ask for:
- An SIA Security Guard or Door Supervisor licence. Door Supervisor is the more flexible choice because it includes physical intervention
- BS 7858 screening, which the employer arranges, and government clearance for some sites
- ACT counter-terrorism awareness, which covers HOT, the 4 Cs and Run, Hide, Tell
- A CCTV licence for control room roles, which many CNI sites run around the clock
- An Emergency First Aid certificate, which the SIA requires for Door Supervisor and Security Guard training (our courses include it)
You can book first aid, SIA and CCTV courses at our partner centres across London, and ACT is free online through ProtectUK.
Build your counter-terrorism skills
The free ACT e-learning helps security staff recognise and respond to terrorist threats. Combine it with an SIA licence course to work confidently on high-security sites across London.