This is the kind of story that would be funny were it not so serious.
I spoke with a CEO of a CU in the Midwest last week who asked to remain anonymous but who also wanted to share the story of a bomb threat called into her credit union and the almost Keystone Kops-like events of the hours that followed. She did so out of the hope other CEOs and managers will learn from it, especially when it comes to disaster plans that were bought from some vendor and which every CU hopes it will never have to follow, and the assumptions you may be making about emergency response.
In this case, the CEO had left the office for the day. It was a Friday, around 5:30, and the CU was closed with the exception of a drive-through that operates later hours. The phone rang, with the number showing as an "unknown number." Before hanging up, the caller told the teller supervisor that there was a bomb in the credit union and that it was set to go off within three hours.
Coincidentally, the credit union had participated relatively recently in a teleconference hosted by its league on just this kind of threat, and CU staff moved to follow procedures that had been discussed during that teleconference and in its own emergency plan, which it had also gotten from its league. The teller supervisor called the CEO, who responded by noting the steps that should be taken, and asking the supervisor to return a call when the police arrived.
That's when CU staff learned they had better order take-out; it was going to be awhile.
"After 30 minutes I had gotten no call back from the teller supervisor," the CEO said. "When I called back I found out the police had said, 'We don't check for bombs. You should look around. If you see something suspicious, then we'll call the state's bomb squad.'"
I've not written any threat-response manuals, but am hazarding a guess that the poke-around-and-see-what-happens strategy is not among the wisest of procedures when it comes to a potential bomb, even if you do have an intern.
"Our bomb threat training said that everyone should stay calm, should not handle (any suspicious package), and then call 911," the CEO related. "I assumed from that that the police would come into the office, perhaps with a bomb-sniffing dog, to see if there was anything suspicious."
Not wanting to put staff at risk, the credit union closed early for the weekend, and by the time it re-opened on Monday the CEO and others had concluded it was hoax, as similar threatening phone calls had been made to other institutions in town in recent weeks. "On Monday I called the local police because I thought that this can't be right, but it is," the CEO said. "They told me that if there truly is a bomb threat they contact the state police bomb squad, which is about 90 minutes away."
A police officer did arrive on that Friday, approximately 40 minutes after the initial 911 call. In an e-mail from the police department that came in response to the CEO's inquiry about procedures, the police said their limited resources were delayed that day, as officers were already responding to a home invasion investigation and a sexual assault.
"Your staff was correctly advised by our officers that we do not search buildings for explosives nor do we dictate when a business will be evacuated due to a bomb threat," the police said in the e-mail. "Our officers do not search for explosives since we would rarely have knowledge of what items should or should not be located within the facility."
In the aftermath, the CEO noted, the credit union has found the fake bomb threat has put not just its emergency response plan into question, but has raised other issues it had not previously given thought to. For instance, all the incoming phone lines ring into the CU's main office, so even if there were a bomb about to go off, credit union staff wouldn't know if the bomb was located in the main office or in one of the branches.
Another issue raised by the hoax was that one branch is located in a strip mall with commercial businesses located on each side of it. Should staff in that location alert workers at the other businesses so they can be made aware of the threat? "Should a business or institution wish to evacuate, our department offers assistance in doing so in a safe and controlled manner," the police department statement went on to say. "Excluding an exigent circumstance, the owner or administration of the facility is responsible for deciding if an evacuation is warranted."
"We called the police," noted the CEO, "but what was the point?"
Frank J. Diekmann is publisher of Credit Union Journal and can be reached at fdiekmann@cujournal.com.
