ATP 3-39.10 POLICE OPERATIONS (AUGUST 2021)

Appendix A

A-4

ATP 3-39.10

24 August 2021

OTHER POLICE AGENCIES

A-16.

The PM often relies on outside police agencies for assistance and to share police information and

intelligence. The PM develops memorandums of agreement and understanding with local police agencies in

support of various emergency and public safety issues. Local and state police representatives should be

invited to installation planning meetings, working groups, and forums to exchange ideas, solicit input, and

participate in appropriate exercises. Antiterrorism efforts should always include local, state, and federal

police and intelligence agencies as required by AR 525-13 and DODI 2000.12. Any HN law enforcement

and intelligence personnel should be included when overseas and within the limits of operational security.

These agencies are valuable sources of information and support to installation commanders and special staff.
A-17.

Advances in database technology, combined with an explosion in information sharing and networking

among police agencies, have resulted in the development and expansion of robust information repositories.

Army law enforcement personnel continue to access the National Crime Information Center database, but

increasingly turn to databases from corrections systems for fugitive information and to Department of

Homeland Security and Federal Bureau of Investigation systems for terrorist threat information. DOD

proprietary automation systems (such as ALERTS) greatly improve interoperability and eliminate seams that

criminal and other threats might otherwise exploit.
A-18.

The authority for Army law enforcement to collect and store law enforcement information is covered

by numerous laws, regulations, and policies. ATP 3-39.20 contains an extensive list of documents and sources

that outline the authorities and constraints related to information storage and sharing.

24 August 2021

ATP 3-39.10

B-1

Appendix B

Criminals

Criminal elements exist at every level of society and in every operational environment

(OE). Their presence, whatever their level of capabilities, adds to the complexity of

any OE. They may be intertwined with irregular forces and possibly with regular

military and/or paramilitary forces of a nation-state. However, they may also pursue

their criminal activities independent of such other actors.

CHARATERISTICS

B-1.

Some individuals, groups, and activities are criminal or illegal only because they violate laws

established by a recognized governing authority. Others may violate moral or ethical standards of a given

society or of the international community.

Note.

In some operational environments, the threat is more criminal than military or paramilitary

in nature. Insurgents, guerrillas, or other armed groups often use or mimic established criminal

enterprises and practices to move contraband, raise funds, or otherwise further their goals and

objectives.

B-2.

Criminal activity is a category of violence that is enmeshed in the daily life of most people in both

urban and rural areas. However, criminal activity thrives in areas where there is instability and lack of

government control or law enforcement. The actions of insurgents and guerrillas further erode stability and

effective governance, creating more opportunities for criminal pursuits. Sometimes, given those

opportunities, insurgent or guerrillas themselves turn to crime—either to sustain themselves or for personal

profit. It may be difficult to distinguish crime from ethnic feuds, ideological and theological extremism, or

other elements of a culture that incite insurgency or guerrilla warfare.
B-3.

Governing authorities often characterize insurgents and guerrillas as bandits. The reason for this is that

their activities in opposing the governing authority and sustaining themselves are illegal (from the

government perspective). Acts of subversion may be against the law (that is, criminal) even if not violent.

SCOPE

OPERATIONS

B-4.

Criminal organizations are normally independent of nation-state control. Large-scale organizations

often extend beyond national boundaries to operate regionally or worldwide. Large-scale organizations may

have the capability to adversely affect legitimate political, military, and judicial organizations. However,

individual criminals or small-scale criminal organizations (gangs) typically do not. Still, any criminal

organization can affect such government organizations and/or military operations by becoming affiliated with

the irregular opposing force (OPFOR) or with military forces of another nation-state.
B-5.

Unless a criminal organization is in league with government officials, it must operate in ungoverned

or poorly governed areas. Otherwise, the governing authority would interfere with the criminal activity. In

today’s world, the ungoverned area may be virtual—in the Internet and cyberspace. Criminal organizations

can draw on virtual sanctuaries such as websites, chat rooms, and blogs.
B-6.

Criminal organizations desire a space where they can conduct their activities unconstrained by a

government. They may seek to create or maintain a region where there is no governmental control or only

governmental control that they can co-opt. Such an area allows them sufficient latitude to operate and

discourage rival criminal enterprises. From this base area, they can generate more and more violence and

instability over wider sections of the political map.

Appendix B

B-2

ATP 3-39.10

24 August 2021

B-7.

Some criminal organizations can generate instability and insecurity within a state or across borders.

They can become partners with insurgents in order to further their criminal ends. A criminal organization

takes on the characteristics of an insurgency when it uses subversion and violence to negate law enforcement

efforts. Some criminal organizations may seek to co-opt political power through corruption and intimidation.

The more they seek freedom of action, the more they inhibit state sovereignty. A criminal organization may

create its own form of government by providing protection and enforcing its will on the populace. If it can

challenge the governing authority’s control beyond the local level of government, it in effect becomes an

insurgency unto itself, although its ends are materially focused rather than ideological.

RELATIONS

WITH

OTHER

ORGANIZATIONS

AND

ACTORS

B-8.

Criminal organizations may have some type of relationship with guerrilla and/or insurgent

organizations or other actors, based on similar or shared goals and/or interests. The nature of the shared goal

or interest determines the tenure and type of relationship and the degree of affiliation. Any affiliation depends

on the needs of the criminal organization at a particular time. To criminals, any cooperation with other actors

is viewed through the lens of profitability. They may actually oppose other actors whose activities degrade

their criminal enterprises.

Note.

Criminals and criminal organizations, both armed and unarmed, may be considered

noncombatants as long as they are neutral. However, they may be considered as combatants if

they become affiliated with regular military or irregular forces. In the latter case, they can be

considered part of the irregular OPFOR.

RREGULAR

ORCES

B-9.

By mutual agreement, or when their interests coincide, criminal organizations may become affiliated

with insurgents and/or guerrillas controlling and operating in the same area. Such allies can provide security

and protection against government forces or other common enemies. They can also provide support to the

criminal organization’s activities. In exchange, the criminal organization may provide financial assistance,

advanced technologies, or weapons.
B-10.

Mutual interests of criminals, insurgents, and/or guerrillas can include preventing extra regional or

local government forces from interfering in their respective spheres. The amount of mutual protection

depends on the size and sophistication of each organization and its level of influence on the government or

the local population.
B-11.

On behalf of a criminal organization, insurgents or guerrillas can conduct—



Diversionary actions.



Reconnaissance and early warning.



Money laundering.



Smuggling.



Transportation.



Civic actions.

B-12.

Criminal organizations may not be part of an insurgency. However, their activities—such as theft,

hijackings, kidnappings, and smuggling—can further undermine the governing authority. Insurgent

organizations often link themselves to criminal networks to obtain funding and logistics support. In some

cases, insurgent networks and criminal networks become indistinguishable. Many insurgent organizations

are more similar to organized crime in their organizational structure and relations with the populace than they

are to military units.

Note.

If an insurgent organization creates a shadow government, criminals may co-opt elements

of that government for their own benefit or reach agreements for mutual benefit.

Criminals

24 August 2021

ATP 3-39.10

B-3

ATION

-S

TATE

ILITARY OR

ARAMILITARY

ORCES

B-13.

At times, criminal organizations might also be affiliated with nation-state military and/or paramilitary

actors. In time of war, a state may encourage and materially support criminal actions that contribute to the

breakdown of civil control in a neighboring country. Regular, reserve, and militia forces of a state can

maintain various relationships with criminal organizations. Special-purpose forces can support criminal

organizations and possibly conduct operations in conjunction with them.

OCAL

OPULACE

B-14.

Criminal organizations may conduct civic actions to gain and maintain support of the populace. A

grateful public can provide valuable security and support functions. The local citizenry may willingly provide

ample intelligence collection, counterintelligence, and security support. Such support can also be the result

of bribery, extortion, or coercion. For example, a criminal organization might use bribery or extortion to

induce members of the local populace to act as couriers or otherwise support its activities. It might also coerce

a businessperson into running a front company on its behalf.

RIVATE

ECURITY

OMPANIES

B-15.

Large criminal organizations may hire private security contractors to guard key facilities. Private

security contractors can also provide bodyguards for a criminal leader or conduct surveillance or a search at

a site prior to his arrival.

ERSONNEL

B-16.

In most countries and cultures, criminals fall into the lower orders of social groups. However, there are

some cases in which the criminals are well known and receive a degree of respect for their adherence to

traditional social values and their public social works (civic actions).
B-17.

Criminals may or may not be armed. For instance, individuals who perform money laundering or

operate front companies might not be armed. Individual criminals or gangs might be affiliated with insurgents

or guerrillas and still perform support functions that do not involve weapons. Conversely, some criminals are

armed noncombatants who are not part of or affiliated with any military or paramilitary organization. Some

minor criminals may use their weapons for activities such as extortion and theft. They might even steal from

local government or extra regional forces, to make a profit. Opportunists may decide to hijack a vehicle or a

convoy by force of arms.
B-18.

Individual criminals may be completely neutral or have leanings for either side, or several sides. At

least at the outset, they may not be members of or directly affiliated with the irregular OPFOR. However,

since some of them are already armed, they could easily become combatants, if their situation charges. While

some noncombatants are normally unarmed, there is always the potential for them to take up arms in reaction

to developments in the operational environment and their perception of the actions of local governing

authorities or an extraregional force.

Note.

Most criminals (especially noncombatants) are not irregular forces or part of the irregular

OPFOR. However, they are included in this Army techniques publication because of their

relationships and interactions with the irregular OPFOR. Their criminal acts can add to the general

instability caused by the irregular OPFOR.

MOTIVATIONS

B-19.

Criminals, unlike insurgents or guerrillas, are seldom driven by any political or religious ideology.

They exist to make money or to wield power. However, some criminal organizations may align themselves

with insurgents or guerrillas if their interests are mutually supportable. Criminal organizations may even

become affiliated with military or paramilitary forces of a nation-state if their interests coincide.

Appendix B

B-4

ATP 3-39.10

24 August 2021

Note.

Insurgents, guerrillas, or nation-states may espouse a rigid religious or political ideology.

However, they may set aside those principles when using the drug trade or other criminal activities

to finance their operations.

ROFIT

B-20.

The primary motivation of criminals is making as much money as possible with as little risk as possible.

To make a profit, they may fill a need or want with otherwise unavailable products or provide services that

are illegal. To mitigate risk, they may buy influence with politicians and police officials. Failing that, they

may eliminate those law enforcement and legal system personnel who interfere with their activities, as well

as criminal competitors.
B-21.

The enemies of criminal organizations are any political, military, legal, or judicial institutions that

impede their actions and interfere with their ability to make a profit. However, there are other groups that

conduct drug-trafficking or other illegal actions as a means to purchase weapons and finance other

paramilitary activities. Criminals may tolerate or cooperate with such groups as long as they do not appear

to be competitors or infringe on their own ability to make a profit. A criminal organization may sell or trade

information to a military or paramilitary organization, for profit or mutual benefit.

OWER

B-22.

Individual criminals and criminal organizations commit crimes not only for money, but also to gain

power and prestige. Actions such as assassination, murder, and maiming are intended to demonstrate the

criminal organization’s power and control. That power may be over public officials, persons it cannot

otherwise control or intimidate, criminal competitors, or people disloyal to the organization.
B-23.

Larger criminal networks and transnational criminal organizations conduct criminal activities on a

scale that can threaten whole societies and/or the international community. They can render governments

corrupt and ineffective. They often begin to control ungoverned territory within a nation-state, acquire

political power in poorly governed regions, and eventually vie with the governing authority for influence in

government-controlled space. They also look for ways to exert power and influence internationally.

CRIMINAL ORGANIZATIONS

B-24.

Very few crimes can be carried out by an individual criminal. Therefore, some form of organization is

normally required. It may be a group of two or three individuals or a larger, more sophisticated organization.

The higher the level of organization, the greater the potential for profit and power. Criminal organizations

may not change their structure in wartime, unless wartime conditions favor or dictate different types of

criminal action or support activities.
B-25.

Weapons and equipment vary based on type and scale of criminal activity. Criminal organizations at

the higher end of the scale can take on the characteristics of a paramilitary organization—either for self-

protection or as a private army for hire. Criminals may have the best technology, equipment, and weapons

available, simply because they have the money to buy them.
B-26.

Criminal organizations generally fall into three types: gangs, large-scale criminal networks, and

transnational criminal organizations. Some gangs and criminal networks develop into larger criminal

networks and possibly into transnational criminal organizations. Thus, the lines of separation are not always

clear-cut. However, there are some basic differences in how these three types are structured and how they

operate.

ANGS

B-27.

Some criminals may form loosely associated organizations with no true formal structure. These small

gangs are a concern to local law enforcement, but normally are not a threat to legitimate institutions.

Nevertheless, their often unpredictable acts of violence can destabilize the social and political environment.

Smaller gangs tend to have loose, unsophisticated leadership focused on turf protection, gang loyalty, and

Criminals

24 August 2021

ATP 3-39.10

B-5

local, petty crime (such as theft or small-scale drug sales). Even when many gangs with various leaders

operate in the same areas, they may or may not interrelate with each other.
B-28.

These smaller gangs are not irregular forces, but their impact on the local populace can be significant

and may actually assist irregular forces. Even small gangs may become affiliated with insurgents or guerrillas

if they stand to gain profit or power.
B-29.

Some smaller gangs may develop into larger gangs or into large-scale criminal networks. This can

happen in two ways. A small gang may grow into a larger organization, or several gangs may (willingly or

forcibly) be joined to form a larger organization.

ARGE

–S

CALE

RIMINAL

ETWORKS

B-30.

Gangs may develop into large-scale criminal networks. At this level, they expand illicit business,

increase profits, and typically focus on trafficking and market protection. These networks and the gangs that

comprise them also continue with the traditional sources of illegal income. However, they are much more

versatile, flexible, and able to adapt to various opportunities. The large number of criminal organizations

loosely associated with one another is able to exploit more opportunities with a variety of means. Large-scale

criminal networks can include any or all of the actions listed under CRIMINAL ACTIVITIES later in this

appendix.

Note.

The term

criminal network

more closely captures the loose structure of many large criminal

groups that do have an enduring association but are more fluid and adaptable than the more specific

terms

syndicate

cartel

imply.

B-31.

Most criminal networks are loosely structured and function primarily because each participant is

pursuing his own interests. Such a network is not necessarily a formally structured, hierarchical organization

with one individual controlling and running the operation. Rather, it may be a loose-knit, intricate web of

individuals or groups selected for their particular skills. However, they frequently continue to operate

independently until the network needs their skills. The network can quickly assemble the appropriate

resources to take advantage of opportunities for specific illegal activities and then release these assets

between jobs. This reduces exposure to detection and keeps individuals from having too much information

about the overall operation.
B-32.

Even when there are strong vertical links, there can still be a great deal of autonomy among the

numerous small gangs that make up the network. The hierarchy may receive payments from those lower in

the organization, but each gang is free to pursue its own criminal enterprises when the larger organization

does not require its services. The small gangs may still operate relatively independently (and perhaps

competitively). They do not necessarily share key information with the larger structure. Even the highest

level leadership may not be aware of all operations.
B-33.

These criminal networks use violence as a means to create and protect their market as well as

marginalize and control their competition. They seek to control or weaken state security institutions. They

often begin to dominate community life within large areas of a nation-state. Criminal groups at this level may

begin to develop overtly political agendas to improve their market share. They may overtly challenge state

security and sovereignty. They may use subversion and violence as political interference to negate law

enforcement efforts directed against them.
B-34.

Criminal networks that control local or regional markets may have ties to and frequently do business

with criminal organizations in other regions or other countries. They do so when they need wider networks

of customers, fences, money-laundering expertise, access to technologies, and other essentials for an effective

criminal venture.
B-35.

Some criminal networks may develop into larger criminal networks or into transnational criminal

organizations. In some cases, a smaller network may simply grow into a larger organization. In other cases,

several networks may willingly join to form a larger organization. In still other cases, smaller organizations

may be forced (by coercion or by circumstances) to become part of a larger organization.

Appendix B

B-6

ATP 3-39.10

24 August 2021

RANSNATIONAL

RIMINAL

RGANIZATIONS

B-36.

Some criminal organizations develop into sophisticated transnational criminal organizations. These

organizations may have ambitious economic and political agendas. They often begin to fill the power vacuum

in ungoverned or poorly governed regions within a nation-state and to challenge government control of other

regions. This provides the transnational organization with security and freedom of movement to pursue its

criminal enterprises. In some cases, the organization becomes a de facto insurgency with ends focused on the

material rather than ideological goals. Actions can include any or all of the items listed under CRIMINAL

ACTIVITIES later in this appendix—such as drug and arms trafficking, money laundering, and terrorism.

Transnational criminal organizations develop their own transit routes for illegal shipments and develop their

own access to contraband.
B-37.

Transnational criminal organizations take advantage of increased opportunities for profit and power

that are found internationally. Globalization is not limited to legal trade and commerce. Criminals in various

countries can cooperate in criminal ventures that take place across several countries. The increasing ease and

effectiveness of global communications plays a significant role in arranging criminal ventures and in

laundering the proceeds.
B-38.

For example, smuggling is a big business that requires international organization. Illegal substances or

legal goods less expensive elsewhere are smuggled across state boundaries. (Drugs are the most lucrative of

smuggled items.) A significant part of the profits may go to suppliers and associates in other countries, and

profits may be laundered using international financial systems.
B-39.

Also contributing to the international nature of crime is the increased movement of people across

borders. Businesses, both legitimate and illegitimate, benefit from expanding global travel. Another aspect is

movement of people forced from their homes by war or political persecution. Others move in order to seek

the opportunity to build a better life for themselves and their families. The vast majority of these people are

not criminals. However, the size of the movement provides perfect cover for those who are connected to

transnational criminal organizations. Some migrants avoid formal channels and pay smugglers to get them

into another country.

CRIMINAL ACTIVITIES

B-40.

Criminals use many and varied tactics and techniques. Some of these methods overlap with one

another. The activities typically include an objective to make fiscal profit and/or achieve influence.

ECURITY

B-41.

Security is crucial for criminal organizations. They may use the highest degree of sophistication

available to conduct intelligence collection and counterintelligence activities. These activities are a priority

and can be well funded. Intelligence sources may extend to high levels within government and law

enforcement agencies. The local populace may willingly provide ample intelligence collection,

counterintelligence, and security support. Intelligence and security can also be the result of bribery, extortion,

or coercion.
B-42.

Most members of criminal organizations are capable of protecting themselves and their assets.

Typically, they carry small-caliber weapons, such as handguns, pistols, rifles, and shotguns. They are lightly

armed out of necessity or convenience, not for lack of resources. When greater force of arms is necessary to

control people, protect vital resources, or obtain information, these organizations typically have members

who can use heavier arms, such as machineguns and assault weapons. Large criminal organizations may hire

PSCs to conduct surveillance, provide personal security for leaders, or guard key facilities.

HEFT

B-43.

Theft is the taking of another person’s property without that person’s permission or consent with the

intent to deprive the rightful owner of it. Thus,

theft

is an overarching term that covers various crimes against

property such as burglary, embezzlement, larceny, looting, robbery, and fraud. See also identity theft and

intellectual property theft, both under Cybercrime.

Criminals

24 August 2021

ATP 3-39.10

B-7

RAUD

B-44.

A fraud is an intentional deception made for personal gain and/or to damage another individual or

entity. Defrauding people or entities of money or valuables is a common purpose of fraud. Fraud can

include—



Ponzi schemes.



Insider trading.



Embezzlement.



Insurance scams.



Money laundering.



Forgery.



Identity theft.



ACKETEERING

B-45.

A racket is a fraudulent scheme, enterprise, or activity. It is usually an illegitimate business made

workable by bribery or intimidation. A racketeer is one who extorts money or advantages by threats of

violence, by blackmail, or by unlawful interference with business or employment. Therefore, racketeering

overlaps with bribery, intimidation, and extortion.
B-46.

In racketeering, a criminal organization typically creates or perpetuates a problem or the perception of

a problem for which it then offers a solution, for a fee. The intent is to engender continual patronage. In the

traditional example of a protection racket, the racketeer informs a store owner that a substantial monthly fee

will be required in exchange for protection. The protection provided takes the form of the absence of damage

inflicted upon the store or its employees by the racket itself. Another example is malicious software

(malware) that pretends to be detecting spyware or other infections on a computer and offers to download a

cleaning utility for a fee. In actuality, the distributor of the malware is also the maker of the cleaning utility.

(This aspect of racketeering overlaps with the category of cybercrime, discussed below.) In addition to

protection rackets, racketeering can also involve numbers rackets or illegal lottery.
B-47.

Racketeering can also include seemingly legitimate businesses that provide a front for illegal activity

such as buying and selling illegal merchandise. Loan sharking is another form of racketeering in which a

criminal offers loans at extremely high interest rates to borrowers who cannot qualify for loans from

legitimate sources. The debtor faces violence or other criminal means to cause harm if the debt is not paid.
B-48.

Black markets fall under racketeering as illegal businesses. These can include traded goods and

services such as biological organs, transportation providers, illegal drugs, prostitution, weaponry, alcohol,

tobacco, currency, and fuel. Black markets tend to flourish in most countries during wartime, due to rationing,

and impact commodities such as food, fuel, rubber, and metal.

AMBLING

B-49.

In most societies, the act of gambling is in itself not illegal. What becomes illegal is an illicit business

based on gambling (also called gaming). It is illegal because either—



It is conducted in a fraudulent manner.



The governing authority has outlawed it.



The gambling enterprise fails to share all its profits with the governing authority.

B-50.

Many types of gambling have been, or still are, illegal in some places. Hence, criminals may be the

only operators of some games. Even when a governing authority legalizes some gambling ventures, it may

be difficult to keep criminals from becoming involved, due to the huge potential for profits. Besides gaming

operations recognized and (sometimes poorly) regulated by the state, there are many other gambling

opportunities in which criminals may be involved.
B-51.

Gambling is often associated with other types of crime. Operators of legal gambling establishments

may receive kickbacks for allowing money laundering. Gambling operations earn large amounts of cash and

Appendix B

B-8

ATP 3-39.10

24 August 2021

present particular opportunities for skimming and money laundering. Aside from skimming profits from a

legalized gambling enterprise, skimming can also occur with the granting of credit, which can lead into loan

sharking. In particular, problem gamblers who need money for gambling may easily fall prey to loan sharks.

Compulsive gambling can also lead to crimes such as embezzlement, robbery, check forgery, and fraud.

ROSTITUTION

B-52.

Prostitution is the practice of indulging in sexual relations for money. As a criminal enterprise, it also

involves a criminal or criminal organization that profits from the commercial sex act. Prostitutes may also

profit from the venture, although the criminal organization gets its cut. However, prostitution may be linked

to human trafficking, in which case the criminals get all the profits.

XTORTION

B-53.

Extortion is the act of obtaining money, materiel, information, or support by force or intimidation.

Criminal organizations use extortion to obtain information or cooperation or to protect members. Examples

of extortion include—



Intimidating politicians to vote in a manner favorable to the criminal organization.



Intimidating judges to free an organization member.



Forcing a farmer to grow drug-producing crops.



Extorting money from local businesses in exchange for protection, which means not harming the

business or its members.



Using death threats against an individual or his family to cause him to provide information or

resources.



Intimidating other people not to take action against the criminal organization.



Using information warfare methods to create and maintain fear caused by extortion.

RIBERY

B-54.

Bribery is giving money or other favors to influence someone. Criminals give money to people in

power who make or influence decisions. For example, bribes to law-enforcement officials can cause them to

have their patrols avoid a criminal organization’s transit routes. If the organization is unable to bribe

someone, it employs harsher methods, such as extortion, assassination, or murder, to gain cooperation.

RSON

B-55.

Arson is maliciously burning another person’s dwelling, structures, or property. This may be done to

as punishment for noncompliance with internal rules of criminal organizations. It may be the result of not

paying the criminal organization for protection. It may also be done on a for-hire basis or as a means to inflict

terror on a targeted person or group.

IJACKING

B-56.

Hijacking is stealing or commandeering a conveyance. Criminals may conduct a hijacking to produce

a spectacular hostage situation. Sometimes criminals may hijack a conveyance as a means of escape; in that

case, the criminals may eliminate any unneeded people and materiel, such as hostages or baggage.

IDNAPPING

B-57.

Kidnapping is an abduction or transportation of a person or group by force. The person is kept in false

imprisonment (confinement without legal authority). This may be done for ransom or in furtherance of

another crime (such as human trafficking or hostage taking). This type of crime has become very popular

with criminal organizations, and the methods vary by region. Kidnapping flourishes particularly in fragile or

failed states and regions in conflict, as drug traffickers and other criminal organizations fill the vacuum left

by governing authority.

Criminals

24 August 2021

ATP 3-39.10

B-9

B-58.

The risk in kidnapping is relatively lower than in hostage taking. This is primarily because the criminals

take the kidnapped victim to a location controlled by the criminal organization. The criminals then make

demands and are willing to hold a victim for a long time, if necessary.

OSTAGE

AKING

B-59.

Hostage taking is typically an overt seizure of a person or persons to gain publicity, concessions, or

ransom. Unlike kidnapping, where usually a prominent individual is taken, the hostages are usually not well

known figures. Criminals attempt to hold hostages in a neutral or friendly area. The planning and execution

of a hostage taking are similar to those of a kidnapping or hijacking. However, criminals may also take

hostages as an expedient measure when they have difficulty exiting a crime scene.

URDER

B-60.

Murder is the unlawful killing of another human being without justification or excuse. Murder is

perhaps the single most serious criminal offense. Criminal organizations use murder as an enforcement tool

and as a method of generating revenue in murder-for-hire schemes.

SSASSINATION

B-61.

An assassination is the murder (usually of a prominent person) by a sudden and/or secret attack. It is

usually prompted by religious, ideological, political, or military motives, but may be done for payment.

Criminals and criminal organizations may use an assassination—



For monetary gain.



To exert terror.



To display power.



To exact revenge on a public official.



To eliminate people they cannot intimidate.



To punish people who have left the criminal organization.

AIMING

B-62.

Maiming is a deliberate act to mutilate, disfigure, or severely wound a person so as to cause lasting

damage. Maiming can involve assault and battery on a person with intent to inflict serious injury. Other

methods include—



Male castration.



Female genital mutilation.



Burning or branding.



Forcible tattooing.



Cutting off limbs.



Removal of tongue, eyes, or ears.



Throwing a corrosive acid or alkali to cause blindness or scarring.

B-63.

The person maimed is an outward sign of the criminal organization’s power and control. A criminal

organization often uses or threatens maiming—



To enforce order within the organization.



To collect debts.



For extortion.



As a for-hire operation to generate revenue.

MUGGLING

B-64.

Smuggling is the clandestine transportation of illegal goods or persons. It usually involves illegal

movement across an international border. There are various motivations to smuggle. These include

Appendix B

B-10

ATP 3-39.10

24 August 2021

participation in illegal trade, illegal immigration or emigration, and tax evasion. Smuggling is often related

to trafficking in persons, drugs, or arms.

RAFFICKING

B-65.

Trafficking is the transportation of goods or persons for the purpose of making a profit. Criminals

conduct illegal trafficking. Human trafficking (trafficking in persons) is the second largest criminal activity

in the world—followed by drug trafficking and arms trafficking.

Humans

B-66.

Human trafficking is the recruitment, transportation, transfer, harboring, or receipt of persons

(including children) for the purpose of exploitation. It involves the threat or use of force, coercion, abduction,

fraud, deception, and/or abuse. Criminals choose to traffic human beings because, unlike other commodities,

people can be used repeatedly and because human trafficking requires little in terms of capital investment.

Human trafficking may take two forms:



Sex trafficking in which a person is induced to perform a commercial sex act.



The recruitment, harboring, transportation, provision, or obtaining of a person for labor or

services, for the purpose of subjection to involuntary servitude, debt bondage, or slavery.

B-67.

Human trafficking is not the same as people smuggling. A smuggler may facilitate illegal entry into a

country for a fee, but on arrival at their destination, the smuggled person is free. The trafficking victim is

coerced in some way and is further exploited after arrival, in order to derive profits. Victims do not agree to

be trafficked; they are tricked, lured by false promises, or forced into it. Traffickers control their victims by

coercive tactics including deception, fraud, intimidation, isolation, physical threats and use of force, debt

bondage, or even force-feeding drugs.

Drugs

B-68.

The illegal drug trade is a black market consisting of production, distribution, packaging, and sale of

illegal psychoactive substances. The legality or illegality of the black markets purveying the drug trade is

relative to geographic location. The drug-producing countries may be inclined to tolerate the drug traffickers

because of bribery or the effect on the country’s economy. Drugs often cross international borders in order

to reach the best paying customers. The massive profits inherent to the drug trade serve to extend its reach.

The social consequences of drug trade include crime, violence, and social unrest.

Arms

B-69.

Arms trafficking involves illicit transfers of arms, ammunition, and associated materials. Criminal

organizations may be involved in two types of arms trafficking:



Small-scale transactions by individuals or small firms that deliberately transfer arms to illicit

recipients.



Higher-value or more difficult illicit shipments of arms involving corrupt officials, brokers, or

middle men motivated mainly by profit.

B-70.

Arms trafficking is driven by a variety of clients, which include—



Embargoed governments.



Armed groups involved in war, banditry, terrorism, or insurgency.



Criminals and criminal organizations.



Citizens who cannot obtain guns legally.

B-71.

Some arms and ammunition may come from illicit arms manufacturers. However, the source of a large

proportion of illicit conventional arms is government disposals of surplus arms or thefts from insecure

government stockpiles. Governments themselves may deliberately facilitate covert flows of arms to their

proxies or allies, or to embargoed or suspect destinations for profit.
B-72.

Arms trafficking is widespread in regions of political turmoil. However, it is not limited to such areas.

Most arms trafficking occurs at the regional or local level. Among the most common forms are numerous

Criminals

24 August 2021

ATP 3-39.10

B-11

shipments of small numbers of weapons that, over time, result in the accumulation of large numbers of illicit

weapons. While individual transactions occur on a small scale and do not draw attention, the sum total of

weapons trafficked is large.

YBERCRIME

B-73.

Cybercrimes are offenses targeting or using information technology. This includes computers,

computer networks, and other telecommunication networks such as the Internet (chat rooms, emails, notice

boards, and groups) and mobile phones. Such crimes may threaten not only individuals and groups but also

a nation’s security and financial health. Cybercrimes can facilitate a variety of other criminal activities,

including money laundering, extortion, fraud, racketeering, gambling, smuggling, and trafficking.
B-74.

Criminals exploit the speed, convenience, and anonymity that modern technologies offer in order to

commit a diverse range of criminal activities. The global nature of the Internet allows criminals to commit

almost any online illegal activity anywhere in the world. In the past, cybercrime has been committed by

individuals or small groups of individuals. However, an emerging trend is for criminal networks and

criminally minded technology professionals to work together and pool their resources and expertise.
B-75.

Cybercrimes include network intrusions, hacking attacks, malicious software, and account takeovers

leading to significant data breaches affecting every sector of the world economy. Advances in computer and

telecommunications technology and greater access to personal information via the Internet have created a

virtual marketplace for transnational cyber criminals to share stolen information and criminal methodologies.

The increasing level of collaboration among cyber criminals raises the level of potential harm to individuals,

companies, and governments. Members of online forums discuss cybercrime topics of interest. Criminal

purveyors buy, sell, and trade—



Malicious software.



Hacking services.



Spamming devices.



Personal identification information.



Credit and debit card data.



Bank account information.



Brokerage account information.



Counterfeit identity documents.



Other forms of contraband.

B-76.

Cybercrime falls into the following broad categories:



Network intrusions and related offenses.



National security, protective intelligence, insider threat, and defense industrial base related

offenses.



Financially motivated cyber offenses.

Computer Crimes

B-77.

Computer crime refers to any crime that involves a computer or computer network. The computer or

network may be the target, or it may be used in the commission of a crime, the primary target of which is

independent of the computer network or device.

Crimes Targeting Computers

B-78.

Criminals can cause damage to computers in many ways. For example, an unauthorized intruder can

send commands that delete files or shut the computer down. Intruders can initiate a denial-of-service attack

that floods the victim computer with useless information and prevents legitimate users from accessing it. A

virus or worm can use up all of the available communications bandwidth on an agency or corporate network,

making it unavailable to employees. When a virus or worm penetrates a computer’s security, it can delete

files, crash the computer, install malicious software, or do other things that impair the computer’s integrity.

Appendix B

B-12

ATP 3-39.10

24 August 2021

B-79.

Extortion threats involving damage to a computer are a high-technology variation of old-fashioned

extortion. Intruders may threaten, unless their demands are met, to—



Penetrate a system and encrypt or delete a database (erasing or corrupting data or programs).



Distribute denial-of-service attacks that would shut down (or slow down) the victim’s computers.



Steal confidential data.

Note.

The threat does not need to be sent electronically.

B-80.

Crimes may involve intercepting or interfering with communications through the use of electronic,

mechanical, or other devices. This applies to electronic communications as well as oral and wire

communications via common carrier transmissions. This may involve—



Spyware or intruders using packet sniffers.



Persons improperly cloning email accounts.



Other surreptitious collection of communications from a victim’s computer.

B-81.

The crime may extend to the unauthorized disclosure of the contents of an illegally intercepted

communication or using such information for other criminal purposes. Such crimes may also injure or destroy

various types of communication operated or controlled by a government or used for a state’s military or

paramilitary functions.

Crimes

Using Computers

B-82.

Crimes using computers or facilitated by computers include—



Unauthorized access to computers (even government computers and perhaps law enforcement).



Unauthorized access to stored communications (including email, social networking data, and

voicemail).



Fraud (computer fraud and wire fraud).



Identity theft.

Fraud

B-83.

Computer fraud is the use of information technology to commit fraud. Criminals may devise various

schemes or artifices to obtain money, property, goods, or services of measurable value. These include—



Accessing a computer without authorization to obtain—



Commercial data.



Information contained in a financial record of a financial institution.



Information contained in a file of a consumer reporting agency on a customer.



Information from any government department or agency.



Information from a protected computer.



Accessing without authorization a government, commercial, or personal computer and affecting

the use of the owner’s operation of the computer.



Accessing a protected computer with the intent to defraud and thereby obtain anything of value.



Causing the transmission of a program, information, code, or command that causes damage to a

computer system, personal injury, or a threat to public health or safety.



Trafficking in passwords or similar information through which a computer may be accessed

without authorization.



Manipulating market data for criminal purposes.

Note.

Data or information or even the use of a computer can be regarded as a thing of value.

Criminals

24 August 2021

ATP 3-39.10

B-13

B-84.

Computer fraud can also fall under the more general category of wire fraud. In what is considered wire

fraud, criminals may use fraudulent pretenses, representations, or promises transmitted by various means of

telecommunication, including—



Wire.



Radio.



Television.



Mobile phone.



Facsimile.



Telex.



Modem.



Internet.

B-85.

Money mule schemes could be categorized as computer or wire fraud. In such schemes, criminals trick

people into moving money for them. Through Internet phishing, criminals can steal money from unsuspecting

people by accessing their accounts. The phishers then face the problem of moving the large sums of money

acquired from the victims to their own accounts, often in other countries, without attracting suspicion.

Traditionally, drug smugglers have used people (referred to as mules) willing to carry small amounts of drugs

across borders for them for a price. In a variant of this scheme, phishers recruit innocent people in the

countries where their victims reside by offering them a lucrative job using their home computers. Those

recruited are usually unaware that these are not legitimate business opportunities. Thus, phishers can dupe a

large number of individuals (called money mules) into accepting relatively small amounts of money stolen

from people’s accounts and transferring the funds to the phishers in return for a commission.

Identity Theft

B-86.

Identity theft is almost always committed to facilitate other crimes. It involves unauthorized transfer,

possession, or use of a means of identification of another person with the intent to commit, or to aid or abet,

or in connection with, any unlawful activity. Most commonly, it involves the misuse of another individual’s

personal identifying information for fraudulent purposes. With relatively little effort, an identity thief can use

this information to take over existing credit accounts, create new v accounts in the victim’s name, or even

evade law enforcement after the commission of a violent crime. Identity thieves also sell personal information

online to the highest bidder, often resulting in the stolen information being used by a number of different

perpetrators. Personal information can also be obtained for the purpose of blackmail or other forms of

extortion.
B-87.

Criminals can obtain credit and debit card numbers by hacking into the wireless computer networks of

major retailers. Network intrusions can compromise the privacy of individuals if data about them or their

transactions resides on the victim network. Once inside the networks, criminals install sniffer programs that

capture card numbers, as well as passwords and account information. After collecting the data, they conceal

it in encrypted computer servers that they control. Then they sell the credit and debit card numbers through

online transactions to other criminals. In addition to these carders, there are phishers who obtain the same

type of information via fraudulent emails.
B-88.

The unlawful use of identification information can involve access device fraud. Such fraud can include

any device, number, or other means of account access that can be used to obtain money, goods, services, or

other things of value. It can also involve unlawful access to buildings or facilities.

Intellectual Property Crimes

B-89.

Intellectual property crimes involve theft of material protected by copyright, trademark, patent, or

trade-secret designation. Such intellectual property is vital to local, national, and international economies.

The interconnected global economy creates unprecedented business opportunities to market and sell

intellectual property worldwide. Geographic borders present no impediment to international distribution

channels. If the product cannot be immediately downloaded to a computer, it can be shipped and arrive by

next day air. However, the same technology that benefits rights-holders and consumers also benefits

intellectual property thieves seeking to make a fast, low-risk profit. In addition, trafficking in counterfeit

merchandise also generates large profits.

Appendix B

B-14

ATP 3-39.10

24 August 2021

B-90.

The most egregious violators are large-scale criminal networks and transnational criminal

organizations whose conduct threatens not only intellectual property owners but also the economy of nation-

states. Because many violations of intellectual property rights involve no loss of tangible property and do not

require direct contact with the rights-holder, the owner often does not even know that it is a victim for some

time.
B-91.

Intellectual property crimes can overlap with computer crimes, especially in the following areas:



Unauthorized access of a computer to obtain information.



Mail or wire fraud (can include the internet).



Devices to intercept communications.

B-92.

Unauthorized obtainment of information or electronic media covered by copyright, trademark, patent,

or trade-secret designation robs the rights-holders of their ideas, inventions, and creative expressions. Such

theft is facilitated by digital technologies and Internet file sharing networks.
B-93.

Although fraud schemes can involve copyrighted works, it is not mail or wire fraud unless there is

evidence of any misrepresentation or scheme to defraud. Mail and wire fraud may exist, even if the

perpetrator tells his direct purchasers that his goods were counterfeit, as long as he and his direct purchasers

intended to defraud the direct purchaser’s customers. Wire fraud can include the Internet.
B-94.

Intellectual property crimes may involve intercepting and acquiring the contents of communications

through the use of electronic, mechanical, or other devices. Criminals may then market the contents of an

illegally intercepted communication, including intellectual property.

ONEY

AUNDERING

B-95.

A criminal organization conducts money-laundering activities to transfer funds into the legitimate

international financial system. Because of the legal restrictions levied by a governing authority, the

organization must have a way of transferring dirty (illegally earned) money into clean money. The

organization smuggles some currency back to its country of origin. However, large sums of foreign currency

are not feasible for the organization because it must use the legal currency of its country to make transactions.

For example, a farmer cannot receive payment for his drug crops in the foreign currency because he would

be unable to use it.
B-96.

A more productive way to transfer funds into the legitimate financial system is to operate through front

companies. Front companies are legitimate businesses that provide a means to launder money. The criminal

organization establishes its own front companies or approaches legal companies to act as intermediaries.

Some front companies, such as an import or export business, may operate for the sole purpose of laundering

money. Other companies (possibly targets of extortion) operate as profit-making activities and launder money

as a service to the organization. Criminal organizations operate front companies in their own country, as well

as in other countries.
B-97.

Personnel involved in money laundering can include accountants, bankers, tellers, and couriers. Some

are willing participants in the money-laundering process and accept bribes for their services. Extortion and

intimidation keep unwilling members active in the process. Members of money-laundering organizations also

establish and operate front companies.
B-98.

Some members, such as accountants and bankers, perform their normal functions as in a legal business.

However, they may conduct illegal acts on behalf of the organization. Because of banking regulations,

members must conduct activities that do not draw attention to themselves. As an example, couriers deposit

in bank accounts a level of funds small enough to avoid banking regulations. However, not all countries have

such regulations, making it easier to launder large sums of money.
B-99.

Couriers conduct many transactions with financial institutions. They travel from bank to bank making

deposits or converting money into checks and money orders to prepare for smuggling activities. Money-

laundering personnel may also use electronic fund transfers, which make tracking of illegal transactions much

more difficult, especially when the country has lax banking laws.

Criminals

24 August 2021

ATP 3-39.10

B-15

CIVIC ACTION

B-100.

Criminal organizations conduct programs of patronage under the guise of civic actions. These

programs are only indirectly intended to benefit the general populace. Rather, the main intent of the criminal

organizations is to gain and maintain support, reward their supporters, and facilitate their continued activities.

They may build a school, improve a road, or supply food and medicine. These projects benefit the local

population because they improve the people’s quality of life and may improve their standard of living. For

example, road building makes it easier to transport goods to market and creates jobs. Some of the jobs may

be temporary, such as those in construction, while others may be permanent, such as those in education and

clinics. Through its propaganda efforts, the criminal organization ensures that the population knows who is

making the improvements.
B-101.

Sometimes the criminal organization cooperates with an insurgent force to conduct civic actions.

They do not cooperate for ideological reasons. Their sole purpose is to inhibit the governing authority’s

ability to affect their activities by gaining the inherent security a grateful public can provide.

INFORMATION WARFARE

B-102.

Criminal organizations may have the resources to conduct a variety of information warfare activities.

However, their focus is often on a well-orchestrated perception management (propaganda) effort. This can

be a powerful tool for intimidating enemies (governing authority and criminal competitors) and encouraging

support of the organization’s money-making efforts. The use of perception management techniques can

ensure that the population knows who is making improvements in the local environment and allow the

organization to take credit for other benefits it provides to the local population.
B-103.

The criminal organization can also use counterpropaganda to spin events against the governing

authority. For example, the government may burn a farmer’s drug-producing crop and then broadcast

announcements that the action is a direct result of the farmer’s involvement with an illegal activity. However,

the criminal organization can counter this by instilling the idea that the governing authority does not have

programs to help the farmer make profits legally and reminding the populace of the new medical clinic it

built.
B-104.

Various elements of information warfare can also be instrumental in other criminal activities. For

instance, perception management and deception are related to fraud, including computer fraud. Information

attack and computer warfare are parts of cybercrime.

TERRORISM

B-105.

Terrorism is always illegal, whether conducted by insurgents, guerrillas, or criminals. When

conducted by regular military forces or other agencies of a nation-state (perhaps in the form of ethnic

cleansing or confiscation of private property), other states can consider it illegal by international standards.

For criminal organizations, terrorism becomes an action against an adverse governing authority, a criminal

competitor, or an innocent populace. See chapter 6 for more information on terrorism.

24 August 2021

ATP 3-39.10

C-1

Appendix C

Special Response Considerations

Police operations include responses to many incidents that are outside the boundaries

of normal law enforcement and police responses or that, due to the sensitivity of the

incident, may require specific actions or considerations. This appendix addresses select

special-response considerations.

RESPONSE REQUIREMENTS

C-1.

Ensuring that personnel respond quickly and appropriately when incidents occur is an essential part of

the police mission. Special-response situations may include domestic disturbances, active shooters, hostage

situations, and natural or man-made disasters. Typically, these events involve one or more of the following

factors (although the presence of one factor by itself does not automatically mean that an incident is critical):



Threat or act of violence.



Loss of life, significant injury, or significant damage to property.



Substantial resource demands.



Close public scrutiny through the media.



Coordination among federal law enforcement agencies, state or local law enforcement agencies,

public affairs, emergency relief services, or emergency response services.

C-2.

Regardless of the type of incident, all law enforcement responses require some general actions to

protect the public, protect evidence, and gather information. Personnel may be apprehended, if required,

based on the incident and the available information. In most cases, the initial report of an incident will be

communicated to the police operations center or military police desk.
C-3.

The police operations center or desk section should attempt to obtain the following information from

the caller and any accessible law enforcement databases:



The nature of the alleged incident.



The address or specific location of the alleged incident.



The nature of injuries, if any.



A telephone number where the caller can be reached and a determination as to whether the caller

is the victim or a witness.



The involvement or presence of firearms or other weapons, if any.



The need for fire department, ambulance, or other emergency response.

NITIAL

NFORCEMENT

ESPONSE

C-4.

A law enforcement patrol will typically be dispatched to the scene of an incident. Upon arrival at the

scene, law enforcement patrol responsibilities can include—



Maintaining radio communications with the military police desk.



Assessing immediate or potential dangers and taking actions, as appropriate, to mitigate risk to the

public and emergency response personnel.

Appendix C

C-2

ATP 3-39.10

24 August 2021



HAZMAT, fire, or explosive hazards.



Active shooters, violent persons, or other threats.



Environmental conditions (traffic, weather, smoke).



Requesting additional emergency response capabilities.



Medical.



Fire.



HAZMAT response.



Civil engineers.



Towing services.



Establishing control of the incident scene.



Controlling traffic.



Securing identified crime scenes.



Evacuating personnel and establishing a perimeter, if required.



Identifying victims and injured personnel and rendering first aid, as appropriate.



Identifying evidence and establishing measures to protect or preserve evidence.



Identifying witnesses, victims, or potential subjects.



Detaining personnel at the scene (in a safe location) to conduct interviews.

NTERVIEWS AND

CENE

ROCESSING

C-5.

Initial interviews will typically be conducted by law enforcement patrol personnel. After establishing

control of the incident, responding law enforcement patrols should initiate the interview process beginning

with identified victims, potential subjects, and witnesses. If a large number of personnel require interviews,

additional patrols should be requested. Witnesses, victims, and alleged subjects should be separated to the

fullest extent possible. All initial interviews should be conducted separately.
C-6.

Law enforcement personnel should ensure that victims are interviewed in an area that is out of sight

and hearing range of alleged suspects, witnesses, and bystanders. Follow-on interviews and possible law

enforcement interrogations may be required by military police investigators or USACIDC SAs, depending

on the circumstances and severity of the incidents. Law enforcement patrol personnel do not conduct law

enforcement interrogations. Circumstances will dictate how complete the interviews will be at the scene.

Written statements should be collected when possible. In cases where interviews do not result in a written

statement, the law enforcement patrol personnel should document the interview in their patrol report. Law

enforcement patrol personnel must ensure that responding military police investigators and USACIDC SAs

are briefed, as required, on conducted interviews, identified and collected evidence, and initial impressions

and observations.

ACTIVE SHOOTERS

C-7.

An active shooter is typically characterized as one or more subjects participating in a random or

systematic shooting spree. They demonstrate intent to continuously cause serious physical injury or death to

others. Active shooters are intent on committing mass casualties, unlike criminals who engage in crimes

(robbery, hostage taking). Subjects are considered active shooters if they—



Continue to actively shoot.



Take additional victims.



Exhibit a willingness to harm others or themselves unless stopped by authorities.

Special Response Considerations

24 August 2021

ATP 3-39.10

C-3

C-8.

Consequently, incidents with active shooters are dynamic events that often defy normal response

protocols. Recent history suggests that the typical police response, contain and control while awaiting the

arrival of tactical units, is ineffective. In an incident with an active shooter, time is clearly not an ally of first

responders. Training, instincts, and initiatives of first responders that are capably equipped have proven more

effective than rigid interdiction protocols.
C-9.

Response tactics to incidents involving active shooters must be simple by design; flexible in nature;

easy to implement; and effective against a fast-moving, unpredictable suspect. Initial responders arriving on-

scene should have the authority and capability to take action without waiting for command directives or the

arrival of specialty units (SRTs, negotiators). The goal of police intervention in these incidents is to neutralize

the threat by various means, up to and including the use of deadly force. As with most emergencies, an

effective response requires informed decision making, clear lines of decision authority based on established

rules for use of force, and reliable communications.
C-10.

Federal Bureau of Investigation studies have concluded that—



Emergency management preplanning is critical.



Responders arriving first have a drastic effect on the progress of the incident. They must quickly

and safely conduct a situational assessment.



Immediate interagency cooperation and the establishment of incident commands are essential.



Clear and reliable communications are necessary for effective operations.



Helicopter access for overhead assessments is a positive response asset.



Key agencies and supporting entities (emergency operations centers, hospitals) should be

mobilized as quickly as possible.



Media response (large and immediate) is likely.



Additional responder personnel will attempt to converge on the scene.



Fire and emergency medical personnel should wear helmets and clearly marked clothing.



Body armor should be worn by personnel responding within range of the shooter.



Tactical medics to support law enforcement operations are beneficial.



A shooter may use secondary devices.

C-11.

Emergency planning for active shooters requires a commonly accepted set of assumed operational

conditions that provide a foundation for establishing protocols and procedures. Responses to active-shooter

scenarios must be trained and exercised with all participating elements to ensure full understanding and

implementation of active-shooter response protocols. In the case of an active shooter—



An incident may occur at any time of the day or night and on any day of the week.



Most acts occur without warning; the succession of events is often unpredictable.



The suspect may be better armed than the police, sometimes making use of automatic weapons,

explosives, booby traps, and body armor.



Assailants will have some degree of familiarity with the building or location they choose to

occupy.



Military police control the situation to minimize chaos and panic.



Military police must prepare for mass fatalities and to render first aide to injured victims.

C-12.

One of the most urgent concerns for responding law enforcement personnel is the safety of the public.

Developing and maintaining working partnerships with appropriate staffs, building managers, or

administrators responsible for high-population areas (schools, shopping areas, hospitals) is essential in

responding to critical incidents. Schools may be of specific concern due to the impact on children. Military

police planners should coordinate with the appropriate staffs of these entities within their AO to ensure that

Army law enforcement personnel understand the response policies and procedures of each element.

Administrators and staff should also be briefed on law enforcement actions and expectations in the event of

an incident. In the event of an active-shooter or other critical incident, a well-coordinated and effective

Appendix C

C-4

ATP 3-39.10

24 August 2021

response is needed to ensure the safety of persons involved. Specific circumstances will dictate the best

course of action to protect potential victims. These courses of action include—



Evacuations.

Potential victims may be evacuated from their current location when conditions are

safer outside a building or away from the immediate danger area. All persons within the danger

area or hazard zone will be directed to leave their current location and move to a designated safe

area. The evacuation of an entire facility or area may not always be prudent, especially if

evacuation may lead to other risks by taking the occupants out of the physically secure

environment of the facility and into the streets.



Reverse evacuations.

When conditions are safer inside a building, personnel may be directed to

seek shelter indoors. After personnel are inside, the building exterior doors should be locked and

lock-down or shelter-in-place procedures should be initiated. Likewise, if the situation makes

movement hazardous and cover is unavailable, personnel may be directed to stay behind cover at

their present location. A perimeter should be established to control the area.



Lock-down or shelter-in-place procedures.

When a person or situation presents an immediate

threat to personnel in a building, the order to initiate lock-down or shelter-in-place procedures may

be given. All doors leading to hallways or outside the building should be locked; personnel should

stay in their offices, work areas, and classrooms and away from windows. Initial notification may

be made using public address and emergency notification systems.

C-13.

Active-shooter situations are dynamic and tend to evolve quickly. First responders faced with an

active-shooter situation should be prepared for many possible outcomes. Active-shooter incidents may

continue for long periods or end suddenly. Regardless, military police and USACIDC Soldiers must be

prepared for—



Mobile crises.

The shooter continues to fire, but has chosen to do so while on the move.



Fleeing suspects.

The shooter has ceased the act and has fled the scene; however, he remains

mobile in the immediate area. The shooter has continued capability and opportunity to engage

additional victims.



Suicide or suicide threats.

The shooter ceases shooting others and has committed suicide or

threatens to do so. This includes suicide-by-cop scenarios.



Homicide investigations.

The shooting has ceased, the shooter has been captured or terminated,

and the process of investigation has begun.



Trauma responses.

The shooting has ceased, the shooter has been captured or terminated, and a

large number of victims require medical attention.

BOMB THREATS AND SUSPICIOUS PACKAGES

C-14.

A bomb threat is a communication, usually verbal or written, expressing intent to detonate an explosive

or incendiary device to cause property damage, death, or injuries—whether or not such a device actually

exists. Typically delivered by telephone or other telecommunication means, most threats are intended to

cause disruption or diversion—as hoaxes or for reasons other than actual destruction of property—rather than

warning of real devices. Many bomb threats that are not pranks are made as parts of other crimes (extortion,

arson, robbery). Actual bombings for the malicious destruction of property, terrorism, or murder are often

perpetrated without warnings.
C-15.

A suspicious package can be an out-of-place object in a location. Suspicious items can appear harmless

(backpack left at a bus stop or sidewalk, parcel found in an office space, toolbox left in a parking lot).

Suspicion arises when no one claims ownership of the item or the item just seems out of place. At times, a

suspicious package may have characteristics consistent with devices or material meant to cause harm (visible

timing devices, apparent explosive material, wires, oily residue, powdery substances).
C-16.

The initial moments of a bomb threat or the discovery of a suspicious package is crucial to the

evaluation of an incident. To ensure the successful resolution of the incident, a bomb threat or suspicious

package contingency plan should be developed and rehearsed by personnel. This is typically a component of

the installation force protection, antiterrorism, or physical security plan. The contingency plan enables

training on procedures for bomb threat or suspicious package responses. Military police staffs should ensure

that procedures outlined in the plan are coordinated with the appropriate staff, building managers, or facility

Special Response Considerations

24 August 2021

ATP 3-39.10

C-5

administrators within the AO. Military police planners should coordinate with the appropriate staffs of these

entities within their AO to ensure that Army law enforcement understands the response policies and

procedures of each element. Administrators and staff should also be briefed on law enforcement actions and

expectations in the event of an incident.
C-17.

Bomb threats and suspicious packages require a multifunctional response, including assets from law

enforcement, fire departments, emergency medical response organizations, and EOD. Upon notification of a

bomb threat or suspicious package, law enforcement patrols will—



Respond to the scene of the bomb threat or suspicious package and secure the area. The scene

should be treated as a crime scene until directed otherwise by law enforcement supervisors.



Ensure that additional response elements have been notified, including—



Fire department personnel.

Fire department personnel normally respond to the scene and

stand by. Fire is a common occurrence in connection with an explosive detonation. The early

notification of fire department personnel can assist in minimizing property damage and injury

if a device detonates.



Emergency medical personnel.

Emergency medical personnel may arrive at the scene in a

standby status. The potential for injury with any explosion or HAZMAT dispersal is high.

Time can be saved by having trained medical personnel stand by with an ambulance in case

of injuries.



EOD personnel.

EOD personnel should be notified immediately; although under normal

situations, EOD personnel do not typically respond to a bomb threat unless a suspicious item

is located. EOD personnel may be able to tell if other threats of a similar type have been

received and if a bomb was subsequently discovered. They can also give guidance if a device

is located. See AR 75-15 for information on EOD responsibility.



Military working dogs.

Patrol explosive detector dogs are trained to passively respond to

explosive material and components.



Other elements.

Other elements should be notified, based on local policy (PM, higher

commanders, public affairs)



Cordon off the target area to prohibit bystanders from entering the threatened location. The initial

cordon distance should be at least 100 meters for placed explosive objects and at least 200 meters

for potential vehicle-borne explosives. This distance may be increased based on the discovery of

an actual device, the size of the device, or advice from EOD or explosive experts.



Provide traffic control, to include roadblocks and checkpoints 100 meters or more from the area,

to keep out everyone except authorized personnel.



Be prepared to wear personal protective equipment as required.



Determine if the building is occupied. If it is not occupied, obtain and report the names and

telephone numbers of the persons responsible for the area to the military police desk.



Notify the supervisors of nearby buildings and prepare them to evacuate if necessary.



Obtain facts for the preliminary investigation.



Stay on scene until relieved by the law enforcement supervisor.

C-18.

Evacuation is not necessary for all bomb threats. Immediate action can include—



Searches without evacuations.



Movement of personnel within the area to a safer location.



Partial evacuations.



Total evacuations.

C-19.

The decision to evacuate and search an area or building is typically made by those in charge of the

targeted facility (commanders, facility managers). Leaders and supervisors may solicit the support of facility

workers who may be the most familiar with their surroundings and most apt to recognize anomalies. Law

enforcement supervisors may direct an evacuation when exigent circumstances exist, based on identified

threats, advice from EOD experts, and established local procedures. When possible, the decision to evacuate

is left to the facility commander or site manager.

Appendix C

C-6

ATP 3-39.10

24 August 2021

C-20.

The facility commander or manager should—



Notify the PMO of the bomb threat or suspicious package and the actions taken.



Maintain communications with the military police desk or on-site law enforcement patrols.



Decide if the facility will react to the threat or conduct business as usual.



Determine if a supervisor’s search will be conducted without evacuation.



Decide if the building will be evacuated and searched.



Serve as the primary person responsible for the search team.



Execute control of operations within the emergency operations center.



Determine if and when normal operations will resume after the search if no device is discovered.



Clear the area immediately and ensure that EOD is notified if a device is discovered.

C-21.

When a large facility is involved, it can be very difficult and time-consuming to ensure the absence of

bombs or other hazardous devices or substances. The decision to evacuate is determined based on the

evaluation of available information, including—



Information received and documented on a bomb threat checklist. (See ATP 3-39.32.) If the

bomber describes, in detail, the type of device, its location, and the placing of the device, the threat

may be deemed more credible. Threats with little to no detail may indicate that the subject merely

wants to disrupt operations at the target location. A decision to evacuate and disrupt operations

may only serve the purpose of the subject.



Information and advice from support agencies (EOD, fire departments).



The criticality of the mission of the targeted facility.

C-22.

Law enforcement personnel may support a bomb search, but they do not generally conduct one because

they are not familiar with the search area. A search of an area for a suspect device or package requires intimate

knowledge of the area. This allows search personnel to identify items or arrangements that are out of place.

In most cases, MWDs certified in explosives detection should be used to detect and locate potential

explosives within a defined search area

(See ATP 3-39.34.) Upon discovery of a suspect package, device,

vehicle, or other item must not be disturbed and EOD should be notified to confirm the existence of an

explosive device and to take action to render the device safe. See ATP 3-39.32 for additional information on

bomb threat response.

Note.

MWDs will not be used to verify suspicious packages. They can assist by searching the

cordon area and around the package for hidden secondary devices.

DOMESTIC DISTURBANCES

C-23.

Law enforcement personnel respond to reports of domestic disturbance just as they would to any other

report of a criminal nature or a request for assistance. A domestic disturbance can manifest itself in several

forms. Two of these forms are—



Domestic dispute.

A domestic dispute is an argument that could cause a pattern of behavior that

results in emotional or psychological abuse, economic control, or interference with the personal

liberty of a current or former spouse, a person with whom the abuser shares a child in common,

or a current or former intimate partner with whom the abuser shares or has shared a common

residence. During a domestic dispute, law enforcement typically has four courses of action

available:



Mediation.



Referral.



Temporary separation.



Apprehension.



Domestic violence.

Domestic violence is any person who commits a violent offense against a

spouse, an intimate partner, or an immediate family member of that person; or with intent to

Special Response Considerations

24 August 2021

ATP 3-39.10

C-7

threaten or intimidate a spouse, an intimate partner, or an immediate family member of that

person—



Commits an offense under the UCMJ against any who commits a violent offense against a

spouse, an intimate partner, or an immediate family member of that person.



Commits an offense under the UCMJ against any property, including an animal with intent to

threaten or intimidate a spouse, an intimate partner, or an immediate family member of that

person, violates a protection order or with intent to commit a violent offense against a spouse,

an intimate partner, or an immediate family member of that person, violates a protection order;

or assaults a spouse, an intimate partner, or an immediate family member of that person by

strangling or suffocating.

Note.

These actions limit law enforcement discretion in many instances, but serve to protect all

parties involved in domestic violence incidents. Domestic violence is a violation of the UCMJ and

local and state laws.

C-24.

When Army law enforcement personnel receive a report of a domestic disturbance incident, the police

operations center or desk section should attempt to determine (from the caller and identified accessible law

enforcement databases)—



The nature of the alleged incident.



The address or specific location of the alleged incident.



The nature of injuries, if any.



A telephone number where the caller can be reached and a determination as to whether the caller

is the victim or a witness.



The involvement or presence of firearms or other weapons, if any.



The need for fire department, ambulance, or other emergency response.



Confirmation of sexual assault from the victim.



If the alleged suspect is present. If the alleged suspect is not present, law enforcement personnel

should obtain their name, description, direction of flight, mode of travel, and possible use of

alcohol or drugs.



If there are children present.



If others are present at the scene, what involvement they play in the alleged incident, and their

relationship to those involved in the incident.



If there have been previous domestic disturbance incidents involving the individuals.



If there is a protective order in effect involving the individuals.

AFETY

C-25.

The safety of an alleged victim becomes a primary concern of the law enforcement personnel receiving

the initial report. Law enforcement personnel receiving the call should attempt to keep the alleged victim on

the line until the patrol arrives. They may advise the alleged victim to await the arrival of the patrol at a

neighbor’s house or a convenience store or, if the perpetrator returns, to leave the location. If the caller is a

witness, the dispatcher must keep them on the phone and relay ongoing information to the responding patrol.

NITIAL

ESPONSE

C-26.

Once the police operations center has received a call of domestic disturbance and has obtained as much

information as possible concerning the individuals involved (including a history of past incidents), the

information is relayed to the responding law enforcement patrol in person or via a secure radio network. The

police operations center must periodically check the safety of the responding patrol at the scene as in other

life-threatening calls.

Appendix C

C-8

ATP 3-39.10

24 August 2021

C-27.

At least two law enforcement personnel are required for response to a domestic disturbance in progress

or to one that just occurred. The law enforcement patrol must approach the scene of a domestic disturbance

call with great caution and treat the incident as one of high risk, taking into consideration such things as—



Parking away from the residence.



Waiting for backup. This is especially important when a patrol consists of one person.



Stopping and listening from a safe vantage point before attempting contact (to increase situational

understanding).



Checking for the assailants outside the residence.

C-28.

Upon arrival and after determining the best method for approaching the incident, law enforcement

patrol personnel identify themselves, explain their presence, and request entry to the residence. The law

enforcement personnel request to speak to the person who placed the call. If the caller is someone other than

the victim, law enforcement personnel should not reveal the name or location of the caller. They should be

persistent in accessing and speaking to the victim privately. If law enforcement personnel are refused entry

and forced entry appears imminent to investigate the call, the desk sergeant or other appropriate law

enforcement representative will coordinate with the SJA for legal advice.
C-29.

If there is an obvious imminent threat to persons at the location and the patrol determines that

immediate forced access is required for the protection of persons at the site, law enforcement personnel may

proceed without waiting for SJA or other approval. They should thoroughly document their observations in

the patrol report, specifically the details that warranted the immediate entry. Additionally, law enforcement

personnel are responsible for—



Remaining at the scene and speaking to the victim when there is evidence that indicates a crime

has occurred. Such evidence may be the condition of the scene or the state of the person who is

speaking to law enforcement personnel.



Remaining at the scene if they believe that serious injury has occurred or will occur.



Entering quarters with consent of the parties involved or, if necessary, without consent to prevent

serious bodily injury or render emergency first aid to injured persons.



Driving by the location after departing the scene to observe for any further disturbances.



Parking away from the scene location if remaining in the area to continue observation of the

premises.

C-30.

Once law enforcement personnel have accessed the scene, they establish control by––



Identifying potential weapons in the surrounding areas.



Separating the alleged victim and the alleged suspect.



Restraining, detaining, or apprehending the alleged suspect as needed.



Assessing injuries, administering first aid, and notifying emergency medical services when

necessary.



Inquiring about the alleged incident.



Identifying all occupants and witnesses on the premises.



Separating occupants and witnesses from the alleged victims and suspects and keeping all persons

out of hearing range of one another.



Conducting a protective sweep to locate persons who may be hiding or injured.

Note.

If the domestic dispute is a verbal altercation, law enforcement personnel may consider

mediation as a method of gathering more information and determining if a crime or abuse has

occurred. After separating the two disputants and obtaining the facts, the officers should attempt

to bring parties together to discuss the problem and possible solutions. Based on the results of this

mediation effort, Army law enforcement may refer the parties for appropriate professional

assistance, separate the parties involved in the dispute, or if required apprehend the parties.

Special Response Considerations

24 August 2021

ATP 3-39.10

C-9

CENE

ROCESSING

C-31.

Law enforcement personnel will follow the guidance of ATP 3-39.12 for processing a crime scene.

Because of the unpredictability and volatility of a domestic disturbance, some specific procedures are

included here. Law enforcement personnel will continue processing the scene by—



Attempting to locate the potential whereabouts of the alleged subject (if the subject has fled the

scene).



Interviewing witnesses as fully and as soon as circumstances allow. When witnesses provide

information regarding previous incidents, law enforcement personnel should document it to

establish a pattern. Witness names, addresses, and phone numbers must be recorded for follow-on

interviews or possible court testimony.



Interviewing children (preferably alone) in a manner appropriate to their age taking into

consideration the emotional trauma displayed by the child and the child’s developmental level.

Any interviews should be limited to statements of injuries and what they saw. Further questioning

and interviews should be conducted by military police investigators or USACIDC SAs.

Photographs of the children should also be taken by military police investigators, USACIDC SAs,

or medical personnel. Law enforcement personnel must verify that any children present were not

abused and document the children’s names and ages, signs of trauma, any apparent healing of past

abuse wounds, and statements.



Collecting and preserving all physical evidence necessary to establish what took place, including

photographic evidence substantiating the victim’s injuries, the crime scene condition, and

evidentiary articles that substantiate the incident. See ATP 3-39.12 for collecting and processing

evidence.

C-32.

Law enforcement personnel must follow established procedures for apprehending (military) and

detaining (civilian) personnel and advising military personnel of Article 31 of the UCMJ or turning over

civilians to appropriate civilian authorities. These procedures must be conducted according to the SOP of the

police operations center. The investigator’s statement must clearly state why an apprehension was not made

if probable cause existed. These established procedures include—



Seeking appropriate legal advice if the seizure of firearms not directly related to the incident is

contemplated.



Seizing weapons for safekeeping. If there is a weapon in the alleged subject’s possession, which

in the judgment of law enforcement personnel, would put the victim or alleged subject at risk, the

weapon should be seized for safekeeping. Weapons may be seized regardless of whether an

apprehension has been made.



Explaining to the alleged victim why an apprehension or detention is not going to be made if it is

not authorized. The decision to apprehend or detain is the responsibility of law enforcement

personnel.



Remaining at the scene to ensure that the situation is completely under control.



Advising the alleged victim of the availability of local shelters, victim advocate and domestic

violence services, and procedures for obtaining legal protection orders. If the alleged victim opts

to go to a shelter, law enforcement personnel are obligated to remain at the scene while personal

effects are being gathered and to provide transportation if required.

PPREHENSIONS AND

ETENTIONS

C-33.

When law enforcement personnel are confronted with the decision to execute an apprehension or

detention, they should not consider the following:



The victim’s opposition to apprehend or detain the alleged suspect or claims of being unwilling to

prosecute the alleged suspect. The decision to prosecute is made by the commander or a U.S.

attorney; prosecution is the decision of the government, not the victim.



Any speculation that the victim may not follow through with prosecution.



Concerns regarding financial consequences of an apprehension.



Speculation that the apprehension may not lead to a conviction.

Appendix C

C-10

ATP 3-39.10

24 August 2021



The relationship or marital status of the parties involved (for example, individuals who are not

married, are separated, or are pending divorce).



The denial by either party that the abuse occurred when there is evidence of domestic violence.



Verbal assurances that the violence will cease.



The racial, cultural, social, political, professional, or sexual orientation of the victim or the

accused.



The location of the incident.



The absence of visible injuries.

OLLOW

-U

NVESTIGATIONS

C-34.

All domestic disturbance reports prepared by law enforcement patrols should be reviewed by the chief

of military police investigations or USACIDC SAs and given follow-up investigation as needed. Follow-up

investigations should be initiated within 48 hours of the occurrence of the assault. Cases in which a crime

was alleged, but a patrol did not make an apprehension at the scene, must be annotated in a raw data file.

Follow-up investigations should examine the case to determine if available information, evidence, or leads

have been overlooked by law enforcement patrols or investigators.
C-35.

Follow-up investigations should focus on attempting to prove the case without the participation or

cooperation of the victim in the prosecution. Each case should be analyzed in the following manner: Can the

elements of the offense be established without the testimony of the victim? If not—



Will the victim appear in court and testify truthfully if subpoenaed to do so?



Can further investigations identify additional witnesses or information to pursue prosecution with

an uncooperative or hostile victim?



Are there additional physical evidence items, prior inconsistent statements, witness statements,

911 tapes, circumstantial evidence, or defendant statements available?

EMOTIONALLY DISTURBED PERSONS

C-36.

Law enforcement personnel may be called upon to respond to individuals who are emotionally

disturbed at some level. Many of these conditions can be severe and result in erratic or violent behavior. The

condition may be associated with environmental factors, medical conditions, or substance-related causes.

There may or may not be an underlying mental illness related to the emotional state.
C-37.

Mental illness or emotional distress, especially when combined with excessive alcohol or drug use can

result in a substantial risk of—



Physical harm (self-inflicted) to the disturbed individual.

This may be manifested by threats

of, or attempts at, suicide or serious bodily harm.



Physical harm to other persons.

This may be manifested by homicidal or other violent behavior

and serious bodily harm to others.



Physical impairment of the disturbed individual.

This may be manifested by evidence that the

person’s judgment is so affected that he is unable to protect himself.

C-38.

Not all emotionally disturbed persons are dangerous. Some may become dangerous only under specific

circumstances or conditions that trigger a volatile reaction. Indications that an emotionally disturbed person

may present an immediate or potential danger include the following:



Statements by the subjects which suggest that they are prepared to commit a violent or dangerous

act. Such comments may range from subtle innuendos to a direct threat that, when taken in

conjunction with other information, paints a more complete picture of the potential for violence.



Past history of mental illness or treatment and a personal history of violence under similar or

related circumstances.



Lack of control of emotions (rage, anger, fright, agitation). Signs of lack of control include extreme

agitation, wide eyes, and rambling thoughts or speech. The subject clutching themselves or other

objects to maintain control, begging to be left alone, or offering frantic assurances that he is all

right may also suggest that the individual is close to losing control.

Special Response Considerations

24 August 2021

ATP 3-39.10

C-11

C-39.

Law enforcement personnel dealing with emotionally disturbed persons must be aware of the

surrounding environment. A chaotic and volatile environment can trigger dangerous responses by

emotionally disturbed persons. Agitators who may affect the person, large crowds, or loud noisy

environments may incite violence. Law enforcement personnel must always be aware of any weapons or

items that can be used as weapons that are within a potentially disturbed person’s area. Any weapons (or

items that can be used as weapons) should be moved or the emotionally disturbed person should be moved

to a location where potential weapons are not readily available.
C-40.

Emotionally disturbed persons may harm themselves (through direct physical harm or through

irrational actions that place them in danger) or be a threat to others in the area. Emotionally disturbed persons

or persons suffering from excessive alcohol or drug use may be taken into custody to prevent harm to the

individual, other persons, or both. If an individual is identified by law enforcement personnel as emotionally

disturbed, police intervention may be required to reduce any potential threat that the individual poses.

Considerations for dealing with emotionally disturbed persons include—



Requesting backup.

An emotionally disturbed person should not be dealt with alone. A backup

law enforcement patrol should be requested at the earliest opportunity.



Calming the environment.

When possible, eliminate lights and sirens, disperse crowds, and

assume a quiet and nonthreatening manner when approaching or conversing with the person.



Taking precautions to not excite the person.

Precautions may include—



Moving slowly and providing reassurance that the police are there to help and that appropriate

care will be provided.



Not threatening the person with arrest or in any other manner as this may cause additional

fright, stress, and potential aggression.



Avoiding topics that may agitate the person and guiding the conversation toward subjects that

help bring the person back to reality.



Communicating with the person.

Attempt to determine what is bothering the individual. Relate

concern for their feelings and allow them to vent feelings. Where possible, gather information

about the person from acquaintances and family members. Request professional assistance if

needed.



Acting truthfully.

If subjects become aware of deception, they may withdraw from the contact in

distrust and may become hypersensitive or retaliate in anger.

C-41.

Emotionally disturbed persons taken into custody should be taken to the emergency room for

evaluation by medical professionals. Medical professionals should determine what action is appropriate.

Under most circumstances, emergency medical services should transport the subject. Only under exigent

circumstances should law enforcement personnel transport an emotionally disturbed person. One or more

law enforcement personnel may be required to accompany an individual to the emergency room. They may

be required to ride in the ambulance if the subject is combative or uncooperative. The emotionally disturbed

person should be searched for weapons and may require appropriate restraints. Individuals should not be left

unattended at treatment facilities. Law enforcement personnel should remain with the subject until released

by a physician or counselor.
C-42.

Law enforcement personnel, normally law enforcement investigators, may be required to interview an

emotionally disturbed person if the individual is a subject or witness in a criminal incident. Typically, basic

law enforcement patrol personnel will not attempt to interview an emotionally disturbed person beyond

efforts to obtain basic information at the incident scene. Law enforcement personnel conducting interviews

of emotionally disturbed persons should exercise care when dealing with mentally ill persons during all

interviews. Emotionally disturbed persons should never be left alone; if there is any indication of

unpredictable or violent behavior, two officers should be with the person at all times.

HAZMAT

C-43.

A HAZMAT incident may be a spill or release of toxic industrial materials (toxic industrial chemicals,

toxic industrial radiological materials, or toxic industrial biological materials) inside a building or into the

environment. The user may manage simple spills; however, major spills or emergencies require emergency

assistance from emergency response elements. Many times, HAZMAT incidents may not be immediately

Appendix C

C-12

ATP 3-39.10

24 August 2021

known until identified by first responders. HAZMAT incidents may also coincide with an attack intent on

causing damage, casualties, and terror within the target population. Military police and USACIDC elements

must be familiar with protocols for responding to a scene with HAZMAT present.
C-44.

The decision to declare an incident controlled and stabilized is made by emergency response elements

that are trained to identify and safely mitigate the effects of HAZMAT. These elements typically include fire

department personnel, environmental health and safety personnel, or HAZMAT teams. Depending on the

nature and magnitude of the incident, assistance and services may be required from other public support

agencies or specialized contractors to identify and mitigate potential or actual HAZMAT situations. Fire

control or hazardous debris and spills may require evacuations of nonessential personnel from the area.
C-45.

When faced with a potential HAZMAT incident, law enforcement patrols should always proceed with

caution. Public safety and the safety of first responder personnel are paramount. Initial response

considerations include—



Approaching the scene.

Personnel must approach an incident with caution and from an upwind

direction. They should also wear personal protective equipment, as appropriate, for the incident.



Securing the scene.

Personnel must secure the scene by isolating the spill or leak for at least 50

meters in all directions. The perimeter may require expansion based on direction from qualified

HAZMAT personnel or

Emergency Response Guidebook

data.



Assessing the situation.

Consider the following:



Did a spill or leak occur? How much HAZMAT has spilled (estimate the quantity if

unknown)? Has the spill reached, or does it have the potential to contact, surface water or

public drainage systems?



What are the existing weather conditions?



What are the conditions of the terrain?



Does this situation place people, property, or the environment at risk?



What actions need to be taken immediately (evacuation, additional resources)?



Identifying the hazards.

Personnel should identify hazards (if possible) by using information

contained on placards, container labels, shipping documents, safety data sheets, and railcar and

road trailer identification charts. Vehicle drivers can also assist in identifying hazards. If the

substance cannot be identified, personnel must maintain a secure perimeter and obtain support

from qualified HAZMAT personnel.



Reporting and obtaining assistance.

Personnel should always obtain assistance when dealing

with HAZMAT, including—



Notifying the military police desk. Ask the military police desk to notify the responsible

agencies and call for assistance from qualified personnel.



Obtaining emergency response phone numbers. In the event that contact cannot be made with

anyone, look for emergency response phone numbers in the shipping documents.



Referring to the

Emergency Response Guidebook

. It can be a useful tool for first responders

to identify and appropriately react to potential HAZMAT incidents.



Deciding actions.

Take command of the scene or situation. Military police patrols must consider

several factors, including—



What is the risk?



What conditions are competing for law enforcement patrol attention (heavy traffic areas that

require traffic control, high population areas that require immediate notification or

evacuation, potential explosive or fire hazards)?



Will rescue attempts to people, property, or the environment help or aggravate the situation?



What is the estimated arrival time of additional response assets? Are they better equipped and

qualified to attempt rescue?



Is it better, all things considered, to maintain perimeter control and wait?

Special Response Considerations

24 August 2021

ATP 3-39.10

C-13



Responding appropriately.

Response operations include—



Establishing an incident command post.



Identifying and establishing a casualty triage, treatment area, and decontamination corridor if

necessary.



Maintaining continuous communications with the military police desk.



Reassessing the situation continually.



Avoiding HAZMAT.

Avoidance includes the following—



Do not walk on or touch spilled material.



Do not inhale fumes, smoke, or vapors.



Do not mark the area with flares or any other material that could ignite flammable or explosive

HAZMAT.



Reducing exposure to radiological hazards through time, distance and shielding

. (Reduce

time spent in the vicinity of the hazard, maintain an appropriate distance, and shield either the

substance or personnel).

HOSTAGE SITUATIONS

C-46.

Hostage situations can develop without warning and for a variety of reasons. They are all unique in

their characteristics and require rapid response by law enforcement patrols and follow-on personnel to

increase the probability of a successful outcome. Hostage situations can be the result of—



Terrorist operations.



Perpetrators seeking revenge or profit (ransom).



Domestic violence or other relationship problems.



Mental illness or impairment.



A thwarted crime in progress.



Suicide-by-cop scenarios.

C-47.

Initial law enforcement patrols responding to a hostage situation should immediately notify the military

police desk or police operations center of their arrival and exact location. Patrol vehicles should be parked a

safe distance from the building or area, typically no closer than 50 meters. This decision should be based on

the terrain, the weapons the hostage taker may have available, and other environmental considerations. Law

enforcement patrols should position themselves where they can best observe and control the area. Other

considerations include—



Avoiding exposure to gunfire by the hostage taker (always exit vehicles on the side away from the

hostage taker).



Taking cover behind vehicles (preferably the engine block), walls, trees, or other protective

objects.



Positioning to allow as much visual coverage of the scene as possible.



Directing bystanders to take cover or depart the area to limit the likelihood of bystander injury.



Securing a perimeter around the scene to seal the area.



Ensuring that constant observation of all entrances and exits is established.



Requesting immediate backup and informing the military police desk or operations center of how

many additional patrols are required to control the scene.

C-48.

The scene should be evaluated to determine as much information as possible. Bystanders or witnesses

on-scene that can provide information should be quickly interviewed. Military police patrols should attempt

to verify information through their own observations. Patrols should determine and immediately report—



The number of subjects.



Subjects who are armed and what types of weapons they have.



The number of hostages.



Other helpful information, including descriptions of hostage takers, vehicles driven, and behaviors

and demeanors.

Appendix C

C-14

ATP 3-39.10

24 August 2021

C-49.

All patrols should remain in their assigned positions until relieved. Duties could consist of sealing

avenues of escape, evacuating surrounding buildings, rerouting traffic away from the scene, keeping

entrances and exits to the location of the hostage taker under constant watch, and removing bystanders after

obtaining their identification and other pertinent information.
C-50.

Hostage situations require extensive resources and support by specific law enforcement capabilities.

These capabilities work in concert as personnel attempt to peacefully conclude incidents or, if necessary,

remove the hostage taker as a threat to protect victims and bystanders. The following support elements may

be required:



USACIDC elements.



Hostage and crisis negotiators.



SRTs.



Emergency medical services.



Fire department services.



Outside law enforcement agencies.



EOD teams.



MWD teams.

C-51.

Any hostages that escape or are released must initially be treated as possible threats. Because law

enforcement personnel do not know who the hostage taker or their friends are, handcuff all persons and move

them to a safe and secure area until their identities are determined.
C-52.

Hostage situations can last for several hours or several days, depending on the will of the hostage taker,

the resources available to the hostage taker, and other variables. Constant surveillance of the hostage taker

should be maintained, if possible. The law enforcement personnel should try to gain as much information as

possible about the person or persons committing the act. Observations can include things that may seem

unimportant (clothing, identified habits, threatening actions, activities that seem out of the ordinary or out of

place). These pieces of information can be valuable to hostage negotiators in dealing with hostage takers.
C-53.

Communication with the hostage taker should only be done by trained hostage negotiators who are

authorized to communicate with hostage takers. The USACIDC is responsible for providing hostage

negotiation assets, internal to USACIDC or through supporting law enforcement agencies. Hostage

negotiation is an art, not a science; it is very much a learned skill. Do not attempt to negotiate with a hostage

taker. If communication with the hostage taker cannot be avoided—



Do not make threats, offers, or promises.



Do not refuse the subject’s demands; tell the hostage taker that you must check with the supervisor.



Do not answer questions and demands until the negotiators arrive; create delays.

LAW ENFORCEMENT RAIDS

C-54.

Normally, law enforcement raids are conducted to apprehend offenders, obtain evidence of illegal

activity, safeguard hostages, or recover U.S. government property. In contingency operations, combined

U.S., multinational, or HN law enforcement raids may be used to collect information, capture or eliminate

threats (terrorists, criminals, insurgents), or confiscate weapons.
C-55.

The law enforcement raids are most effective when conducted by SRTs in cooperation with specially

trained law enforcement personnel (such as military police or USACIDC SAs skilled in raids, apprehensions,

and evidence collection and preservation). (See AR 190-14.) At a minimum, each raid team should have at

least one trained, experienced investigator who is responsible for collecting and processing evidence.

Specially trained SRTs are suited for high-risk law enforcement raids in high-threat environments. The SRTs

are experienced military police and trained in breaching techniques, barrier penetration, and threat and

occupant control. See ATP 3-39.11.

REPARATION

C-56.

The preparation and planning of law enforcement raids must be thorough, led by reliable police and

other intelligence personnel, and rehearsed until the raiding force reaches battle drill precision. The PMs,

Special Response Considerations

24 August 2021

ATP 3-39.10

C-15

military police commanders, staffs, and USACIDC elements plan and coordinate law enforcement raids.

Planning and coordination activities include—



Coordinating legal aspects with the supporting SJA.



Ensure that there is probable cause to conduct the raid.



Coordinate with the local SJA, military magistrate, or judge to obtain authorization for the

raid. (Army law enforcement personnel must adhere to the laws governing authority,

jurisdiction, responsibility, search and seizure, apprehension, and use of force.)



Conducting a thorough reconnaissance of the target location to—



Observe activity at the target location.



Determine entrance and exit routes.



Identify the best route of entry to the target.



Identify the vantage points, movements, or behavioral patterns of the occupants of the area.



Identify the points offering observation and fields of fire for the raiding party and the

occupants of the raid area or building.



Obtain blueprints of the building. When reconnoitering a specific building, blueprints will

help identify the interior arrangements of the buildings, to include the placement of doors and

windows, their construction, and the direction in which they open. Law enforcement

personnel should determine likely points of exits and entrances, to include emergency doors

and fire escapes.

Note.

Law enforcement personnel must not enter a building before a raid if it will in any way

jeopardize the mission.



Obtaining videos or photographs of persons entering and leaving the target location.



Determining the raid team composition to establish a chain of command for each raiding team and

within each team. The raiding party is typically composed of the following:



Entry team.

This team is normally used to make apprehensions (as needed) and to recover

property. The team may have a recorder, a photographer, and an evidence custodian.



Security team.

This team provides security for the entry team. It also seals off possible

avenues of approach and escape.



Reserve team.

This team reinforces or assists when needed. Part of the team may stay

mobile for use as a pursuit unit. If it is not needed for its basic purpose, the team can

augment processing procedures and help control the raid site.



Prisoner team.

This team enters a secured building and takes charge of prisoners

apprehended by the entry team.



Medical team.

This team should include a doctor if possible. The team normally remains

with the reserve team and treats injuries, as required.



Determining equipment requirements. Selected equipment must suit the purpose of the raid and

the expected degree of opposition. Too much equipment can slow the raiding party; too little

equipment can hamper the effectiveness of the raid. Equipment considerations include—



Weapons.

Weapons must be carefully selected. Personnel must take into consideration the

armament of the subject, the terrain of the neighborhood, and the degree of resistance

expected.



Riot control equipment.

If riot control equipment is to be used, personnel should identify

the type of equipment required and obtain clearance from the installation commander.

Consider the wind direction and traffic and population density. Remember to provide the

raiding party with protective masks.



Communications equipment.

Consider the requirement for radios, telephones, and visual

signals (hand and arm signals, sounds [such as a whistle]). Personnel must always plan for an

alternate means of communication.

ATP 3-39.10 POLICE OPERATIONS (AUGUST 2021) - page 8