Responding to incidents and taking care of yourself

1Checkpoints, carjacking and armed robbery

• Checkpoint: slow down early, switch on the interior light at night, keep hands visible, stay calm and polite, present your documents, hide nothing, take no photos, offer no money. Report your passage by radio.
• Carjacking or armed robbery: do not resist. Property can be replaced; lives cannot. Move slowly, announce what you are doing, hand over what is demanded, do not stare at the attackers.
• After the incident: get to safety, alert your focal point, seek medical help if necessary.

2Abduction and explosive devices

Abduction: the first few minutes are the most dangerous. Do not resist, stay calm, obey simple orders, look after your health (eat, drink, move), keep a routine and keep hope. Your organisation has a crisis management procedure: trust it.

Explosive devices and explosive remnants of war (UXO, mines): stay on roads and paths that are in use; if you see a suspicious object: do not touch, move away by the same route, mark the area if it is safe to do so and report it to the authorities and mine action actors.

Gunfire: get down, take cover behind a solid obstacle, wait until it stops before moving.

3Sexual violence and health

In the event of a sexual assault against a staff member, the organisation must offer confidential support. The HIV post-exposure prophylaxis (PEP) kit must be taken as soon as possible, within 72 hours at the latest; know where it is stored.

Health: up-to-date vaccinations, malaria prevention, safe water, known insurance and medical evacuation plan.

4Reporting and taking care of yourself

Every incident, including a near miss, is reported promptly to your security focal point: who, what, where, when, and what was done. Reports make it possible to adjust the risk analysis for everyone; some organisations share them anonymously with security forums.

Cumulative stress and traumatic stress are also security risks: an exhausted professional makes poor decisions. Sleep, take breaks, stay in touch with your loved ones, talk about it, use the psychological support on offer.

To go further: the free UN online course BSAFE and, before a posting in a very dangerous area, practical HEAT/SSAFE training.

5Checkpoints, carjacking and robbery: detailed protocols and preparation

Basic reflexes (staying calm, hands visible, non-resistance) save lives, but they are not enough for a team leader. The team leader must prepare teams before an incident, organise how each person behaves during the incident, and manage the aftermath. This section details the three most frequent situations on the road.

Checkpoints: types and reading the situation

Checkpoint protocol, step by step

1. On approach (200 to 300 m): the vehicle team leader reports the checkpoint by radio ("Alpha 2, checkpoint at point Bravo, we are approaching"); slow down gradually; dipped headlights by day, interior light on and headlights dipped at night; windows partly open; music off; sunglasses removed.
2. When stopped: engine running unless told otherwise; only one person speaks, usually the driver or the designated vehicle team leader; the others stay silent, hands visible.
3. Inspection: show the documents requested, no more; do not hand over the original passport if a certified copy is enough, unless firmly required; allow the vehicle to be searched without obstruction and observe without comment.
4. Problematic demands: politely refuse to carry armed persons, uniforms or goods; politely refuse to pay; if the pressure becomes threatening, give in rather than put yourself at risk, then report it.
5. After passing through: drive normally, without sudden acceleration; report by radio ("checkpoint passed, nothing to report" or a brief description); write a detailed report on return.

Carjacking: what happens in a few seconds

Violent vehicle theft is one of the most dangerous incidents, because perpetrators are often tense, sometimes under the influence of drugs, and react to any sudden movement. Injuries occur mainly when a victim resists, tries to escape by car or makes a gesture that is misinterpreted (reaching for a phone, unfastening a seat belt too quickly).

• Before: vehicles with no apparent value where possible, no visible items, doors locked in town, enough distance from the vehicle in front to manoeuvre, arrival at the residence or office with the gate opened in advance.
• During: stop the vehicle, put it in neutral or park, handbrake on, hands visible on the steering wheel or dashboard; announce each movement before making it ("I am unfastening my seat belt", "I am getting out"); do not stare at the perpetrators; leave the keys, engine running, and move away from the vehicle.
• Passengers: get out on the same side if asked, stay together, do not try to retrieve belongings, unless a child or vulnerable person is in the vehicle, in which case say so calmly.
• After: get to safety, check for injuries, call the base; do not pursue the perpetrators; report immediately. GPS tracking is not for pursuit, but for informing the authorities.

Armed robbery at a residence or office

A safe room (safe room) is only useful if the alarm is raised early enough to get there, and if it contains an independent means of communication, water and a reinforced door. If the perpetrators are already inside, non-resistance applies. A small sum of cash set aside in advance ("deterrence money", often the equivalent of USD 50 to 100) can defuse a situation, provided the organisation's policy allows it and nobody claims to have nothing.

Non-resistance must be taught, rehearsed and backed by management. A staff member who has handed over the vehicle, cash or equipment must never be sanctioned or suspected as a matter of principle: this is how the rule is sustained.

6Kidnapping, explosive devices and gunfire: understanding in order to respond better

The phases of a kidnapping

Specialists distinguish four phases, each with its own recommended conduct:

1. Capture: the most violent phase, lasting from a few seconds to a few minutes. The kidnappers are under stress. Do not resist, do not try to escape unless there is an obvious and safe opportunity (which is extremely rare), obey simple orders.
2. Transport: often long and uncomfortable (blindfolded, in a car boot, forced march). Stay calm, memorise what you can (sounds, duration, turns) without showing it, ask for water or to go to the toilet.
3. Captivity: from a few hours to several months. The recommendations of HEAT courses and the lessons learned from former hostages converge: establish a routine (sleep, physical exercise, hygiene), eat and drink even without appetite, keep a calm dignity, humanise your relationship with the guards without being ingratiating (talk about your family and daily life, not politics or religion), make no promises, do not lie about verifiable facts, and trust your organisation.
4. Release or rescue: a release can be as dangerous as the capture (transfers, confusion). In the event of an armed intervention: drop to the ground, hands visible and empty, do not run, obey the orders of the intervention forces, who do not immediately know who is a hostage.

Preparation by the organisation

• Proof-of-life questions: on arrival, every exposed staff member completes three to four personal questions to which only they know the answer (for example "name of your first pet"). They are kept sealed by the crisis team and make it possible to verify that a person is alive during a negotiation.
• Written policy: the organisation defines in advance its position on ransoms (many organisations and several States apply a no-payment policy), who leads crisis management, the use of specialist kidnap response consultants, any insurance cover and how families will be informed.
• Confidential information: family contacts, the person's wishes (who to inform, who not to inform), medical information and essential treatments.

Explosive devices, landmines and explosive remnants of war

Landmines, explosive remnants of war (unexploded or abandoned ordnance) and improvised explosive devices kill and maim thousands of civilians every year and also affect humanitarian staff. The basic rules of explosive ordnance risk education, defined by the International Mine Action Standards (IMAS), are simple:

• Before: know the contaminated areas (maps from the United Nations Mine Action Service or the national authority), ask communities, stay on roads and paths used daily, never leave the road surface to relieve yourself or to make a U-turn on the verge in a suspect area.
• Warning signs: signs (often a skull and crossbones or a red triangle), stones painted red, crossed branches, abandoned fields, animal carcasses, a road suddenly avoided by local people.
• Faced with a suspicious object: stop, do not touch, do not approach, warn others, withdraw by exactly the same route, mark it from a distance if this can be done safely, report the precise location.
• If a vehicle enters a minefield: stop, do not get out, call for help, wait for deminers; if getting out is essential, reverse exactly in your own tracks.
• Improvised explosive devices: in affected contexts, procedures include varying routes and timings, watching for anything unusual (abandoned vehicle, new object at the roadside, wires), and sometimes safety distances from military convoys (often several hundred metres, according to local procedures).

Direct and indirect fire

• Direct fire (small arms, aimed fire): drop to the ground immediately, seek cover from bullets (thick wall, vehicle engine block, ditch), not just concealment from view (a car door or a bush will not stop a bullet), wait until the firing stops, move only if the cover is inadequate.
• Indirect fire (shells, rockets, mortars): get down, in a reinforced shelter or on the ground floor away from windows; do not go outside after the first explosion, as others often follow; wait at least 15 to 20 minutes after the last detonation, or for instructions from the base.
• In a vehicle: if the road ahead is blocked by gunfire, turn around if possible; if the vehicle is hit and immobilised, get out on the side away from the firing and take cover.

These behaviours cannot be learned from a text. Before a posting to a very dangerous area, practical hostile environment training (HEAT, or SSAFE for United Nations personnel) is essential; many organisations and donors require it.

7Sexual violence, medical emergencies and the medical plan

Care for a staff member who is a survivor of sexual violence

Sexual violence affects humanitarian staff, women and men, whether committed by third parties or by colleagues. The recommendations of GISF and Report the Abuse, together with WHO protocols for the clinical management of survivors, set out a survivor-centred approach: safety, confidentiality, respect for the survivor's choices, non-discrimination.

Practical arrangements: every base has PEP kits stored at an appropriate temperature, with expiry dates checked, and at least two people trained to provide them and to refer. Staff know that the kit exists and where it is without having to ask a supervisor. Information about the incident is limited to what is strictly necessary: the security report states "serious incident against a person" without identifying details if the survivor so wishes.

The base medical plan

Every base has a written medical plan, updated every six months, which answers the following questions:

• Where are the primary, secondary and tertiary health facilities, with access times by day and by night, actual capacity (operating theatre, blood bank, radiology) and contacts?
• What means of evacuation exist: base vehicle, ambulance, humanitarian flight, the insurer's air ambulance, and with what activation times?
• Who decides on a medical evacuation and who contacts the insurer, with which phone number and which policy number?
• Who is trained in advanced first aid, and where are the trauma kits?
• What are the staff's blood groups, and is there a network of volunteer donors?

A distinction is made between casualty evacuation (CASEVAC, rapid transport of a casualty to the nearest facility using whatever means are available) and medical evacuation (MEDEVAC, medically supervised transport, often by air, organised by the insurer or a service provider). For severe trauma, the commonly used target is to reach a surgical facility within one or two hours; in many isolated contexts this is impossible, hence the importance of first aid on site: stopping bleeding (tourniquet, pressure dressing), recovery position, protection against hypothermia.

Day-to-day health

• Malaria: insecticide-treated nets, repellents, chemoprophylaxis for non-immune people according to medical advice, rapid diagnostic tests at the base. Any fever in an endemic area is malaria until proven otherwise.
• Water and food: treated water, hand hygiene, caution with raw food.
• Vaccinations: according to national and WHO recommendations (yellow fever, hepatitis, typhoid, pre-exposure rabies for certain postings, meningitis, cholera depending on the context).
• Chronic conditions: at least a three-month supply of medication for the staff concerned, with a prescription.

8Reporting and analysing incidents: from flash report to trend analysis

An effective reporting system serves three purposes: triggering a rapid response (care, search, securing other teams), enabling learning (adapting procedures) and feeding into collective risk analysis (security forums). GISF and Insecurity Insight have published detailed guidance on security incident information management (Security Incident Information Management), which recommends a three-stage process.

The three levels of reporting

Full incident report template

1. Identification: number, date and time, precise location (coordinates if possible), type of incident according to the organisation's classification.
2. People involved: position and status (national, international, partner), without sensitive health data; names only in the restricted version.
3. Chronology: minute-by-minute account, from departure to return to safety.
4. Consequences: injuries, material losses (value), disruption of activities.
5. Response: what was done, by whom, at what time; compliance with procedures.
6. Analysis: was the organisation targeted? Why this place, this time, this target? Link with previous incidents or with the programme (targeting, recruitment, dispute with a supplier)?
7. Recommendations: changes to procedures, the security level or the risk assessment, with a person responsible and a deadline.
8. Follow-up: support offered to the people concerned, insurance claims, information to the authorities, sharing with the forum.

Analysing trends

A single incident tells a story; fifty classified incidents reveal a trend. The security focal point keeps a simple database (spreadsheet) recording for each incident: date, time, location, type, presumed perpetrator, target, severity, outcome. A quarterly analysis answers specific questions: which days and times see the most robberies? Which roads? Do incidents target national or international staff, women or men more often? Are near misses increasing? This work feeds directly into the review of the risk assessment.

Why incidents go unreported

• Fear of sanctions or of being judged reckless.
• Fear of losing one's job or of seeing activities suspended (common among national staff and partners).
• Normalisation: "that checkpoint happens every day".
• Shame or fear of stigma (sexual violence, harassment).
• An overly cumbersome procedure.

A reporting culture is built by example: systematic feedback to the person who reported, no sanctions for an incident reported in good faith, and visible changes showing that the report made a difference.

9Stress, traumatic stress and team well-being

The CHS (Commitment 8) and the staff care principles of the Antares Foundation (Managing Stress in Humanitarian Workers: Guidelines for Good Practice) regard support for well-being as an organisational responsibility, not a private matter. Stress is not only a health issue: exhausted staff take risks, ignore procedures and communicate poorly.

Three forms of stress

What the organisation must put in place

• Before departure: selection and preparation (briefing on stress, fitness assessment if the post is highly exposed).
• During the posting: a reasonable workload, at least one day off per week, rest and recuperation (R&R) cycles suited to the context (often every 6 to 12 weeks in the most difficult duty stations), confidential access to psychological support, including for national staff.
• After a critical incident: psychological first aid (according to the WHO guide, Psychological First Aid: Guide for Field Workers, 2011): look, listen, link; no forced retelling of the event. Single-session psychological debriefing imposed on everyone is no longer recommended by WHO guidance on the management of acute stress.
• At the end of the posting: end-of-assignment interview, information on resources available after return.

The team leader's role

The manager is the first line of support. They observe changes in behaviour, hold regular one-to-one meetings, lead by example (taking their own days off), shield the team from overload imposed by headquarters or donors, and refer without diagnosing. The Inter-Agency Standing Committee Guidelines on Mental Health and Psychosocial Support in Emergency Settings (2007) point out that support for staff, national and international, is part of any response.

National staff: a frequent blind spot

National staff often live through the same events as the population (loss of family members, displacement, insecurity at home), have no rest cycle outside the area and have less access to psychological support services, which are often designed in English or French for expatriates. Good practice consists of offering services in people's own language, with trained local professionals, providing additional days off after a collective incident and involving national staff in designing support arrangements.

10Full example: vehicle theft on the Moussala-Tindi road

Fictional context: the NGO "Eau et Vie" is running a water, sanitation and hygiene project in the fictional district of Moussala. On Tuesday 14 March, a vehicle leaves at 7.30 a.m. for the village of Tindi (52 km) with a driver, a national engineer and an international monitoring officer. Check-ins are scheduled every 30 minutes by satellite phone, and by VHF up to km 15.

Chronology of the incident and the response

Analysis (full report at 7 days)

• Target: the vehicle (recent, highly sought-after 4x4). Three similar thefts in the district in two months, two of them against other NGOs, all between 8 a.m. and 10 a.m., on the same section of track.
• Procedures: non-resistance and the duress code worked; the missed check-in procedure was followed within the set timeframes. However, the previous thefts from other NGOs had been shared at the forum but not incorporated into the base's risk assessment, last reviewed seven months earlier.
• Aggravating factors: identical departure times for three weeks; the presence of an expatriate, which increased the value of the target; the newest vehicle in the fleet assigned to this mission.

Recommendations and follow-up

What the example shows: a well-managed incident is not an incident without mistakes. The analysis revealed a systemic weakness (incorporation of external data), more significant than individual behaviour, which had been exemplary.

11Common mistakes, variations and interview questions

Common mistakes

• Immediately sending a search team after a missed check-in, without an assessment: this risks exposing a second team to the same danger.
• Circulating the details of an incident widely (names, nature of an assault): breach of confidentiality, risk to the people concerned.
• Suspecting national staff as a matter of principle after a theft: climate of mistrust, loss of information.
• Resuming activities without analysis because "nobody was hurt".
• Forgetting families: they hear about the incident through rumour before hearing from the organisation.
• Expired or missing PEP kits at the moment they are needed.

Variations by context

• Sudden-onset crisis: health facilities may be overwhelmed or destroyed; the medical plan must be rebuilt within a few days and trauma kits reinforced.
• Urban setting: robberies and "express" kidnappings (forced cash machine withdrawals) are more frequent; the amount of cash and the number of bank cards carried are limited.
• Camp: incidents linked to distributions (crowd surges, threats) dominate; the response relies on site organisation and dialogue with committees.
• Remote management and local partners: the partner must have access to the same emergency arrangements (emergency fund, insurance, psychological support); otherwise the organisation transfers the risk without transferring the protection.

Interview questions

1. "A vehicle has missed its check-in for 40 minutes. Describe what you do."

A strong answer cites the missed check-in procedure with timeframes, multiple means of calling, GPS tracking, contacts along the route, freezing other movements, escalation up the management line, and an assessment before any team is sent.

2. "A colleague tells you she was sexually assaulted last night. What do you do?"

Immediate safety, non-judgemental listening, confidentiality, information on urgent care (PEP within 72 hours, emergency contraception), respect for her choices, referral according to the procedure, reporting limited to the strict minimum, follow-up. The answer avoids conducting an investigation oneself.

3. "How do you build a reporting culture?"

A simple procedure, no sanctions for good-faith reporting, systematic feedback, visible trend analysis, inclusion of near misses.

4. "How do you support a team after a serious incident?"

Psychological first aid, practical needs first, no compulsory debriefing, individual follow-up after a few days and then after one month, referral to professionals, adjusted work arrangements, particular attention to national staff.

Key references

• Operational Security Management in Violent Environments (GPR8): Humanitarian Practice Network.
• GISF guides on security incident information management, on managing sexual violence against aid workers and on crisis management.
• Psychological First Aid: Guide for Field Workers (2011): WHO, War Trauma Foundation and World Vision International.
• Managing Stress in Humanitarian Workers: Guidelines for Good Practice: Antares Foundation.
• IASC Guidelines on Mental Health and Psychosocial Support in Emergency Settings (2007).
• Clinical Management of Rape and Intimate Partner Violence Survivors: WHO, UNHCR and UNFPA.
• International Mine Action Standards (IMAS), in particular on explosive ordnance risk education.
• BSAFE online course and SSAFE training: United Nations Department of Safety and Security.