Skip to content
  • Home
  • SCaN for Security Managers

SCaN for Security Managers

This page is a dedicated space for security managers to utilise the SCaN tools and guidance available and tailored for security staff

Last Updated 22 January 2024

SCaN for Security - Module 1

This module forms part of the SCaN for Security Managers programme. Those with managerial responsibility can share this with front-line security at an organisation, venue or event to further staff knowledge of hostile reconnaissance and how to help counter it. 

You can find out more about SCaN for Security managers and the wider SCaN programme by speaking to your local Counter Terrorism Security Advisor (CTSA).

SCaN for Security Managers logo

This module is tailored for front line security staff. It includes the core SCaN training:

  • See - understanding what hostile reconnaissance is and how to spot it
  • Check - knowing what to do if you suspect hostile reconnaissance or identify suspicious activity
  • Notify - who should you tell and what should you tell them

And includes training tailored for front line security staff:

  • How a hostile thinks and feels when undertaking hostile reconnaissance as part of attack planning
  • How the power of hello can disrupt hostile reconnaissance and suspicious activity
  • What a security operative can and cannot legally do, if they suspect hostile reconnaissance or identify suspicious activity
  • The importance of having and maintaining good situational awareness
  • What to consider when communicating with a face covering

Click to view a subtitled version of the SCaN for Security module.

SCaN for All Staff

The SCaN for All Staff awareness module, is available on the Highfield e-learning website.

Security managers from organisations, venues and events are strongly recommended to utilise the facilitator notes and knowledge check to run facilitated SCaN For All Staff sessions with their staff, and not just ask staff to view this film on its own. If facilitated group sessions are not possible, use the 'Individual' option or embed the awareness package in your own e-learning systems, however, these are not the recommended options. 

The SCaN For All Staff module is designed for all members of staff across an organisation venue or event, to increase their awareness of hostile reconnaissance and how they can help to counter it.

The short, dramatic film highlights the importance of staff vigilance and the role they can play in disrupting the planning of a hostile act. 

SCaN For All Staff logo

You can download a copy of the film, knowledge check and facilitators notes to run sessions for your staff in-house. Packages that support you to facilitate 30 and 60-minute sessions are available. You can also download a SCORM file to use this package on your own e-learning system. 

This module is designed for All Staff and outlines the core components of SCaN: 

  • See - understanding what hostile reconnaissance is and how to spot it
  • Check - knowing what to do if you suspect hostile reconnaissance or identify suspicious activity
  • Notify - who should you tell and what should you tell them

If you cannot access the awareness package via Highfield e-learning, please use the information and technical support request option in the FAQs.

In the unlikely event that you are still unable to access the package via Highfield e-learning, the video without facilitators notes or a knowledge check is available to view on the

MODULE ONE 

1 INT. RAIL STATION CONCOURSE - DAY 1 

We open inside a busy rail station where commuters go their various ways and station staff and vendors serve and observe. Watching this everyday scene from the upper level we see X1 (mid 30s white female). As she watches, we see her from a number of different perspectives; through a crowd of people, on a security camera, from a distance and then quite near. She then sees an advertising board displaying the ‘See it, Say it, Sorted’ message about being vigilant about suspicious activity. She furtively looks around, then walks away. She looks towards the camera and does a double take, as if suddenly realising she is being watched. She seems a little jumpy as she fixes the camera with a stare. 

X1

You don’t see what I see. You see a busy station, I see an opportunity. You see people, I see numbers. 

She makes an explosion with her hands. 

Boom! 

X1 (CONT'D) 

Impact. Disruption. Chaos. 

She turns and sets off on her way. We track with her and she talks to camera. 

X1 (CONT'D)

What? Not what you were expecting? 

As she speaks, we see her morph into different people of different races, cultures and genders. Firstly, she morphs into X2, a man of Middle Eastern origin (20s). 

X2

What about now? Does this fit with 

your stereotype?

X2 morphs into X3 a black female in a suit(40s). 

X3

How about now? Whatever image you have in your head, things are never as simple as they might seem. 

X3 morphs into X4, middle aged white male. 

X5

The world’s a messed up place, and different people see things differently. 

X4 morphs back into X1. 

X1

And whatever solution you come with, there are gonna be those who are prepared to go to extremes to tell you that you’re wrong. 

X1 merges into the crowd and disappears. The various camera perspectives fail to pick her out.

2 INT. SHOPPING CENTRE - DAY 

We then cut to a shopping mall where X sits on a bench looking around. We see a series of cuts to the things she observes; the security camera, a security guard, the main entrance, a fire exit, a bottleneck of people. 

X

I don’t expect you to understand, but if you want things to change you need to really get people’s attention. It’s nothing personal. Just the way it is. 

As X says this she becomes quite impersonal, as if trying to detach emotionally. 

3 INT. CORRIDOR. SHOPPING CENTRE - DAY 3 

X walks down a corridor towards the toilets, looking around to see if she’s in camera range. 

X

Don’t worry. Nothing’s going to go down today. Just here to check things out, that’s all. I mean, you don’t think we turn up unprepared do you? 

CAROL (Mid 40s), a member of the public, emerges from around a corner, causing X to turn and walk away. Carol is curious and watches for a moment before X disappears from view. 

2. 

4 EXT. SPORT / EVENTS ARENA - DAY 

X stands looking at the stadium / arena from afar, then looks to camera. 

X

The bigger the event, the more 

planning you need to do. And it’s my job to gather information. 

X starts walking away from the stadium / arena. ---

MODULE TWO 

5 INT. FLAT - DAY 5 

X enters the flat and sits down at a table and plugs a mobile phone into a laptop to begin downloading location photos. Pinned to a board on the wall there are various pieces of research, connected by stick-on lines as if it was a criminal investigation. There’s also a detailed notebook with visible notes saying things like “Pro – no-one challenges/speaks to you or pays any attention; con – security/staff really vigilant – too risky”. X then studies the website of the sports arena. 

X

Information’s everything for people like me, but it’s incredible how much of it companies share on their websites. Building layouts, maps and access points, photos, names and addresses. It’s like a goldmine. 

X then does a search on a professional social media site (like Linkedin but faked) for the sports arena and finds people who work there. 

X (CONT'D)

The more detailed stuff takes a bit of work, but if you fish around enough it’s amazing what people will tell you without realising it. 

As X talks we see her using a false profile and asking to connect with those listed. Within seconds the connection is made and X searches the profile. X then goes on a social media site and looks at the public profile of that same person. We see that they openly share all of their information and photos, including work info. 

3. 

X (CONT'D)

It’s crazy. Why would anyone share this kind of stuff with total strangers? You might as well just give them the keys to the door. 

X makes notes of the info found online. 

6  EXT / INT. SPORT / EVENTS ARENA 6 

We see that there is an event on (library footage) in the arena / stadium. 

7  INT. WALKWAY. SPORT / EVENTS ARENA 7 

X rounds a corner and comes into view in the bowels of the arena. In the background we hear the crowd noise from inside the main arena. 

X

There are some things you can’t find online, so you need to come and have a look around. Get a feel for the place. 

X observes a couple of security staff as they chat to one another. 

X (CONT'D)

You want to find out about the security set up and whether their systems work. 

X places a bag on the ground and then moves away from it. She then looks up at the cameras. 

X (CONT'D)

You want to know where the cameras are and if they’re switched on... 

8  INT. SECURITY ROOM. SPORT / EVENTS ARENA.  

We see X on the screen, looking at the camera. A security guard is relaxing in a chair looking at his phone and writing a message. (CPNI security control room guidance up in the background or on the desk, but subtly placed) 

9  INT. WALKWAY. SPORT / EVENTS ARENA 9 

X observes the staff, who seem oblivious to her as she retrieves the bag. 

X

You want to know how many staff there are and if they’re switched on? 

X sees a group of people arriving, chatting to each other. 

X (CONT'D)

Maybe find out when and how people get in and out. 

She looks at her watch and writes a note on her phone. We see that she has already written some notes about the number of security guards, stewards and cameras, she adds that there is a shift change at 8.00pm. She then reaches into her jacket pocket and pulls out a high-vis vest, which she puts on. 

X (CONT'D)

But more than anything, you’re looking for vulnerabilities, and believe me, there are always vulnerabilities. 

She then tags on along behind the people who are entering the staff area using a keycard and smiles at the last person through, who holds the door open for X to get through. 

10  INSIDE 10 X enters and is now backstage where the offices are. 

X

The thing is, getting access to the most useful information means that sometimes you have to take more of a risk. But if you look like you know where you’re going, people will even go out of their way to help you. 

We see a man, MICK (50S) walk out of an office and along a corridor. 

X (CONT'D)

And there are some people who make things really easy for me. 

X looks into the office where Mick has come from and sees a computer logged on and a lanyard lying on the desk. X looks along the corridor and sees Mick stop to talk to someone, but his body language shows that he’s going to continue along the corridor. X then looks to camera, smiles and enters the office, closing the door. 

11  INSIDE THE OFFICE 11 

X sits at the desk, unhooks the phone and begins quickly scanning things on the computer. 

12  IN THE CORRIDOR 12 

Mick comes back and returns along the corridor. He opens the office door and sees X standing up from the desk, replacing the phone receiver. X is a little nervous. (Think before you link booklet on the desk? Or a CPNI security culture booklet. Or maybe a sticker on the phone with the number of the security control room) 

MICK Oh. Hello. 

X

Hi there. You’re obviously not Pam. 

MICK Sorry? 

X

The woman who emailed about her phone not working. 

MICK

Oh, right. No. Not me. 

X

Yeah, this one’s fine. You don’t know where I can find her do you? 

MICK

Pam.... Did you get her surname? 

X Not sure. 

X makes her way past Mick and towards the door. 

X (CONT'D)

No worries. I’ll ring the office and get more details. Sorry to bother you. 

Mick sits back at his desk. Then thinks for a moment as he watches X leave and close the door.

--- 

MODULE THREE 

13  INT. BACKSTAGE CORRIDOR. SPORT / EVENTS ARENA. 13 

X exits the office and walks along the corridor, taking Mick’s lanyard out of her pocket and putting it around her neck, but turning it rear side out so that the photo is not visible. 

X

I suppose it’s ironic me wanting to draw attention to a cause, but doing everything I can not to draw attention to myself. 

We see X walking backstage, where staff mill around but no one seems to pay any attention to X’s presence. X then reaches the exit, where there is a time recorder / punch clock with cards in slots showing employee names. X takes a photo of it on her phone before slipping away. As the door closes, we see that there is one member of staff, KEVIN (early 30s), who seems to have noticed and thinks over what he has seen. 

14  INT. WALKWAY. SPORT / EVENTS ARENA 14 

X is now back out in the public area, without the high-vis on. She takes out a coloured baseball hat with a logo on the front and puts it on her head and a football scarf around her neck. 

X

While most people spend their lives trying to stand out, I do what I can to blend in, which isn’t hard because most people are so wrapped up in what they’re doing that they miss what’s going on around them. 

A few people wearing different coloured hats and scarves are milling around, going to the toilets, visiting the kiosks, perhaps getting early drinks before the main interval rush. 

X emerges from around a corner and talks to camera. (She has a different hat and scarf on) 

X (CONT'D)

You won’t always see what’s going on because the brain filters out everything other than that which needs attention. Problem is, how do you know what needs attention and what doesn’t? 

I mean, if you don’t notice something as obvious as me changing my sporting allegiance... 

She pulls the other cap and scarf out of her jacket pocket. 

15  FLASHBACK - INT. SHOPPING CENTRE - DAY 15 

We cut to the shopping mall scene, where X sits on a bench, observing the cameras. 

X

...you’re not really likely to notice me if I’m just sitting there minding my own business... 

16  FLASHBACK - INT. BACKSTAGE CORRIDOR. SPORT / EVENTS ARENA.16 

X smiles at the person who holds the door open for X to get through. 

X

And only someone who’s switched on is gonna notice that person without an I.D Pass. 

17  FLASHBACK - INT. BACKSTAGE CORRIDOR. SPORT / EVENTS ARENA.17 

As X slips away, we see a flashback of Kevin, who seems to have noticed X taking the photo of the time recorder and thinks over what he has seen. 

--- 

MODULE FOUR 

18  INT. STATION. DAY. 18 X is wandering around, observing, making notes, trying doors. 

19  INT. CONTROL ROOM. STATION. DAY. 19 

We see GERRY (Mid 40s) stand to swap positions with another member of staff monitoring the CCTV in the control room. As he is about to leave they spot X on screen trying a door then moving off. 

20  INT. STATION. DAY. 20 

X is walking along in the distance. GERRY comes into frame and sets off in the same direction. 

21  INT. WALKWAY. STATION. DAY 21 

GERRY, dressed in railway uniform and orange hivis, sees X blending in with a group of other people. He catches up alongside. 

GERRY Hey, you. 

As the person turns, we see that it’s not X but SIMONA (Mid 30s), a woman dressed similarly to X. 

SIMONA What’s up? 

GERRY

What were you doing back there? 

SIMONA

Back where? What are you talking about? 

GERRY

I saw you on the camera. What have you got in your pockets? 

SIMONA

I haven’t got anything. What’s your problem? 

The people with the member of the public jump to her defence (ad-libbed), telling GERRY to leave her alone. One of them films the episode. We cut to see X observing the scene from nearby. 

X

That’s a PR disaster right there. 

And the good thing is she’ll think twice about approaching people in future, which makes my life a lot easier. 

X smirks and walks away. 

22 EXT. WALKWAY BY COFFEE SHOP RAIL STATION - DAY 22 

X sits at a table outside a coffee shop studying a space near the staff entrance to a station. 

X

These kind of places are great. 

You’re not on the premises, so not everyone knows who’s responsible for security, so they leave it to someone else. 

X watches a member of staff from the transport company leave by a side door that provides access to the staff area. X watches for a moment and spots another member of staff walking towards the door. X gets up and walks nearer, then turns and pretends to take a selfie when, in reality, she is video recording the person opening a door with a keypad, unaware that they’re being recorded. 

As the person enters and the door closes, X watches the video back and is able to see the keycode. Meantime, a member of staff from the coffee shop is bemused to find the nearly full cup of coffee with uneaten croissant. 

JASMINE (Early 40s), a member of staff from the station, has seen and approaches X. 

JASMINE

Hi there. Can I help you? 

X seems a little flustered. 

X Sorry? 

JASMINE

This is the staff entrance. Do you work here? 

X

Er, no. I’m just waiting for a friend. She works here. 

JASMINE

Oh right, who’s that? 

X Deborah. Debbie. 

JASMINE

Okay. What’s her surname? 

X

It’s fine. Don’t worry. 

JASMINE

If you tell me your name I’ll see if I can track her down for you and let her know you’re here. 

X

It’s okay, I’ll shoot her a text. 

Thanks.

X smiles a mouth only smile and walks away. 

JASMINE

It’s no problem...we’re always happy to help ....

 

Jasmine watches as X disappears round a corner. 

23  AROUND THE CORNER 23 X is walking away, very annoyed. 

X

I really hate people like that. I can never tell if they’re genuinely being helpful or letting me know they’ve clocked me. 

X gives an angry shake of the head and takes out a mobile phone to make a call, disappearing off into the crowd. 

--- 

24  MODULE FIVE 24 

25  INT. FLAT - DAY 25 

X sits, collating the information gathered. As we see all of the photos and details coming together, we intercut the following scenes. 

26  INT. OFFICES. SPORT / EVENTS ARENA 26 

Mick is dialing the security number from a leaflet/phone sticker some kind of internal comms re security. 

MICK

Hi there, I want to report an incident. (a beat) Yes, I just came back into my office and there was a woman here and I think she’s taken my security pass. (a beat) Just a few moments ago. She was wearing a high vis vest and said she was responding to an email about a faulty phone... 

27  INT. OFFICES. SPORT / EVENTS ARENA 27 Kevin is talking to his LINE MANAGER (Mid 40s F). 

KEVIN

It was not long after I’d started my shift so about eight o’clock. She was taking a photo of the time recorder. 

LINE MANAGER

Okay, thanks for coming to me. Can you tell me exactly what you saw? 

KEVIN

Yeah, so this woman was taking a photo on her phone of the time recorder. I’m not sure exactly but there was something about it that didn’t feel right. 

28  INT. FLAT - DAY 28 

X draws a ring around a particular location on a site map she has printed off. 

29  INT. OFFICES. RAIL STATION 29 Jasmineis speaking on the phone. 

JASMINE

I know we’re supposed to report things like this, just in case..... Well, yeah, I’m pretty sure she was videoing the keycode. 

(MORE) 

JASMINE (CONT'D)

I mean, it was an odd place to be taking a selfie.... I did, yes, I asked if I could help and she said she was waiting for a friend called Debbie, but there aren’t any Debbies here...It just didn’t feel right, you know what I mean? 

30 INT. SHOPPING CENTRE - DAY 30 

Carol is talking to RICHARD (Mid 30s), a shopping centre security guard. 

CAROL

It might be nothing but it looked like she was trying to open a door to the back of the centre. When she saw me she disappeared quickly. 

RICHARD

You’ve done the right thing, so thanks for reporting it. I’m going to look into it, so can you describe the person you saw for me?

CAROL

Yes, she was (describes X according to casting /wardrobe). 

30a INT. OFFICES. RAIL STATION Jasmine is speaking on the phone. 

JASMINE

(Describes X based on casting and wardrobe). 

30b INT. OFFICES. SPORT / EVENTS ARENA 30b Kevin is talking to his line manager. 

KEVIN

(Gives more descriptive detail based on casting and wardrobe) 

31 EXT. PARK - DAY 31 

X sits, on a bench, collating notes and transferring bits of information on her phone. She then looks to camera. 

30a 

X

Look, I can feel you judging me, but I don’t care what you think. Like I said, it’s just numbers, okay? Nothing personal. 

We see X from different perspectives as she puts her things in a bag; from across the park, through a group of parents and toddlers playing at the swings, through the telephoto lens of a camera. 

POLICE OFFICER #1 (v.o. Through police radio) 

Got a positive ID on an IC2 female, fitting the description given. Looks like she’s getting ready to move. 

We cut back to X, who stands up and looks to camera. 

X

Oh, and by the way, if anyone asks, you haven’t seen me. Right? 

X walks away. 

POLICE OFFICER #2 (v.o. Through police radio) 

Stand by all units. Fade to black. 

32.DELETED RECAP 

33 FLASHBACK - VARIOUS. 33 

To a musical accompaniment, we see various shots of X observing, taken from different viewpoints and in different locations. 

Captions appear sequentially on screen. 

CAPTION

The term ‘hostile’ refers to anyone who wants to attack or disrupt an organisation. 

CAPTION (CONT'D) Hostile reconnaissance is the gathering of information for the purpose of planning a hostile act against a target. 

CAPTION (CONT'D) Hostile reconnaissance relies on 3 main sources of information: 

34 FLASHBACK - FLAT. 34 

We a montage of see X looking online and compiling information. 

ONLINE 

35 FLASHBACK - VARIOUS. 

CAPTION 

X observes on site at the different locations, makes notes, tries a door handle. 

CAPTION ON SITE. 

36 FLASHBACK - VARIOUS. 

X is let in to the backstage area at the sport / events arena by the person holding the door open. 

Mick leaves his computer logged on and his lanyard unattended on the desk 

CAPTION INSIDER. 

CAPTION (CONT'D) Insiders might be complicit or unaware that they’re assisting 

hostile activity. 

37 FLASHBACK - VARIOUS. 37 X observes the cameras and security staff. 

CAPTION

Hostiles want information about the security of a target. 

38  FLASHBACK - EXT RAIL STATION. 38 X takes a photo of the keypad. 

CAPTION

And they’re on the lookout for vulnerabilities. 

39  FLASHBACK - RAIL STATION CONCOURSE. 39 X observes commuters. 

CAPTION

They want to identify the best place and method of attack. 

40  FLASHBACK - VARIOUS. 40 

We see the various people noticing / observing X taking an interest in different things such as the time recorder info. 

CAPTION

SEE - Be on the lookout for any suspicious activity. 

CAPTION (CONT'D)

It might not always be obvious. 

CAPTION (CONT'D)

Be aware of what others are taking an interest in. 

CAPTION (CONT'D)

And trust your instincts. If it doesn’t feel right, it probably isn’t. 

41  FLASHBACK - EXT RAIL STATION. 41 We see Jasmine approaching X after he takes the photo. 

CAPTION

CHECK - You can make a real difference through vigilance and good customer service. 

41AA INT. RAIL STATION DAY 41AA 

We see a couple of general eye contact, smiles and good customer service interactions. 

CAPTION

Eye contact and friendly engagement make life difficult for hostiles, and improve the customer experience for everyone else. 

41A INT. RAIL STATION - DAY 41A 

We see a station staff member observe someone (extra) looking into a doorway. The staff member makes eye contact and approaches, saying ‘Hello, can I help you?’ The person responds by saying they’re looking for the toilets. 

CAPTION

Don’t underestimate the power of ‘Hello’. 

CAPTION (CONT'D) But if you think there’s an immediate threat, dial 999. 

42 FLASHBACK - VARIOUS. 42 We see various people notifying. 

CAPTION

NOTIFY - Your intervention may save lives. 

CAPTION (CONT'D) Find out and learn your site’s security procedures. 

CAPTION (CONT'D)

If you don’t know how to report suspicious activity, ask your supervisor.

CAPTION (CONT'D)

If possible make notes about... What you saw. Location. Time of incident. Description of the person or people. 

And make sure you report it immediately. Your information may be a key piece of the puzzle. 

43 FLASHBACK - SHOPPING CENTRE. 43 

We see Carol see X acting suspiciously and then disappearing. We then see Carol talking to a security guard. 

CAPTION

If members of the public report anything suspicious, you need to take it seriously and act on it. 

CAPTION (CONT'D) Remember to ask for their name and contact details, thank them for the information and tell them what you will do about it. 

We close on a final montage of images of the film’s most salient moments. 

CAPTION (CONT'D) Be vigilant Be aware of your environment - You know what looks normal and what doesn’t. 

Don’t leave it for someone else. YOU need to act. 

Don’t put yourself at risk and always dial 999 in an emergency. 

SEE CHECK and NOTIFY 

The caption then animates into the SCaN logo. 

NPSA website

. A

MODULE ONE 

1 INT. RAIL STATION CONCOURSE - DAY 1 

We open inside a busy rail station where commuters go their various ways and station staff and vendors serve and observe. Watching this everyday scene from the upper level we see X1 (mid 30s white female). As she watches, we see her from a number of different perspectives; through a crowd of people, on a security camera, from a distance and then quite near. She then sees an advertising board displaying the ‘See it, Say it, Sorted’ message about being vigilant about suspicious activity. She furtively looks around, then walks away. She looks towards the camera and does a double take, as if suddenly realising she is being watched. She seems a little jumpy as she fixes the camera with a stare. 

X1

You don’t see what I see. You see a busy station, I see an opportunity. You see people, I see numbers. 

She makes an explosion with her hands. 

Boom! 

X1 (CONT'D) 

Impact. Disruption. Chaos. 

She turns and sets off on her way. We track with her and she talks to camera. 

X1 (CONT'D)

What? Not what you were expecting? 

As she speaks, we see her morph into different people of different races, cultures and genders. Firstly, she morphs into X2, a man of Middle Eastern origin (20s). 

X2

What about now? Does this fit with 

your stereotype?

X2 morphs into X3 a black female in a suit(40s). 

X3

How about now? Whatever image you have in your head, things are never as simple as they might seem. 

X3 morphs into X4, middle aged white male. 

X5

The world’s a messed up place, and different people see things differently. 

X4 morphs back into X1. 

X1

And whatever solution you come with, there are gonna be those who are prepared to go to extremes to tell you that you’re wrong. 

X1 merges into the crowd and disappears. The various camera perspectives fail to pick her out.

2 INT. SHOPPING CENTRE - DAY 

We then cut to a shopping mall where X sits on a bench looking around. We see a series of cuts to the things she observes; the security camera, a security guard, the main entrance, a fire exit, a bottleneck of people. 

X

I don’t expect you to understand, but if you want things to change you need to really get people’s attention. It’s nothing personal. Just the way it is. 

As X says this she becomes quite impersonal, as if trying to detach emotionally. 

3 INT. CORRIDOR. SHOPPING CENTRE - DAY 3 

X walks down a corridor towards the toilets, looking around to see if she’s in camera range. 

X

Don’t worry. Nothing’s going to go down today. Just here to check things out, that’s all. I mean, you don’t think we turn up unprepared do you? 

CAROL (Mid 40s), a member of the public, emerges from around a corner, causing X to turn and walk away. Carol is curious and watches for a moment before X disappears from view. 

2. 

4 EXT. SPORT / EVENTS ARENA - DAY 

X stands looking at the stadium / arena from afar, then looks to camera. 

X

The bigger the event, the more 

planning you need to do. And it’s my job to gather information. 

X starts walking away from the stadium / arena. ---

MODULE TWO 

5 INT. FLAT - DAY 5 

X enters the flat and sits down at a table and plugs a mobile phone into a laptop to begin downloading location photos. Pinned to a board on the wall there are various pieces of research, connected by stick-on lines as if it was a criminal investigation. There’s also a detailed notebook with visible notes saying things like “Pro – no-one challenges/speaks to you or pays any attention; con – security/staff really vigilant – too risky”. X then studies the website of the sports arena. 

X

Information’s everything for people like me, but it’s incredible how much of it companies share on their websites. Building layouts, maps and access points, photos, names and addresses. It’s like a goldmine. 

X then does a search on a professional social media site (like Linkedin but faked) for the sports arena and finds people who work there. 

X (CONT'D)

The more detailed stuff takes a bit of work, but if you fish around enough it’s amazing what people will tell you without realising it. 

As X talks we see her using a false profile and asking to connect with those listed. Within seconds the connection is made and X searches the profile. X then goes on a social media site and looks at the public profile of that same person. We see that they openly share all of their information and photos, including work info. 

3. 

X (CONT'D)

It’s crazy. Why would anyone share this kind of stuff with total strangers? You might as well just give them the keys to the door. 

X makes notes of the info found online. 

6  EXT / INT. SPORT / EVENTS ARENA 6 

We see that there is an event on (library footage) in the arena / stadium. 

7  INT. WALKWAY. SPORT / EVENTS ARENA 7 

X rounds a corner and comes into view in the bowels of the arena. In the background we hear the crowd noise from inside the main arena. 

X

There are some things you can’t find online, so you need to come and have a look around. Get a feel for the place. 

X observes a couple of security staff as they chat to one another. 

X (CONT'D)

You want to find out about the security set up and whether their systems work. 

X places a bag on the ground and then moves away from it. She then looks up at the cameras. 

X (CONT'D)

You want to know where the cameras are and if they’re switched on... 

8  INT. SECURITY ROOM. SPORT / EVENTS ARENA.  

We see X on the screen, looking at the camera. A security guard is relaxing in a chair looking at his phone and writing a message. (NPSA security control room guidance up in the background or on the desk, but subtly placed) 

9  INT. WALKWAY. SPORT / EVENTS ARENA 9 

X observes the staff, who seem oblivious to her as she retrieves the bag. 

X

You want to know how many staff there are and if they’re switched on? 

X sees a group of people arriving, chatting to each other. 

X (CONT'D)

Maybe find out when and how people get in and out. 

She looks at her watch and writes a note on her phone. We see that she has already written some notes about the number of security guards, stewards and cameras, she adds that there is a shift change at 8.00pm. She then reaches into her jacket pocket and pulls out a high-vis vest, which she puts on. 

X (CONT'D)

But more than anything, you’re looking for vulnerabilities, and believe me, there are always vulnerabilities. 

She then tags on along behind the people who are entering the staff area using a keycard and smiles at the last person through, who holds the door open for X to get through. 

10  INSIDE 10 X enters and is now backstage where the offices are. 

X

The thing is, getting access to the most useful information means that sometimes you have to take more of a risk. But if you look like you know where you’re going, people will even go out of their way to help you. 

We see a man, MICK (50S) walk out of an office and along a corridor. 

X (CONT'D)

And there are some people who make things really easy for me. 

X looks into the office where Mick has come from and sees a computer logged on and a lanyard lying on the desk. X looks along the corridor and sees Mick stop to talk to someone, but his body language shows that he’s going to continue along the corridor. X then looks to camera, smiles and enters the office, closing the door. 

11  INSIDE THE OFFICE 11 

X sits at the desk, unhooks the phone and begins quickly scanning things on the computer. 

12  IN THE CORRIDOR 12 

Mick comes back and returns along the corridor. He opens the office door and sees X standing up from the desk, replacing the phone receiver. X is a little nervous. (Think before you link booklet on the desk? Or a NPSA security culture booklet. Or maybe a sticker on the phone with the number of the security control room) 

MICK Oh. Hello. 

X

Hi there. You’re obviously not Pam. 

MICK Sorry? 

X

The woman who emailed about her phone not working. 

MICK

Oh, right. No. Not me. 

X

Yeah, this one’s fine. You don’t know where I can find her do you? 

MICK

Pam.... Did you get her surname? 

X Not sure. 

X makes her way past Mick and towards the door. 

X (CONT'D)

No worries. I’ll ring the office and get more details. Sorry to bother you. 

Mick sits back at his desk. Then thinks for a moment as he watches X leave and close the door.

--- 

MODULE THREE 

13  INT. BACKSTAGE CORRIDOR. SPORT / EVENTS ARENA. 13 

X exits the office and walks along the corridor, taking Mick’s lanyard out of her pocket and putting it around her neck, but turning it rear side out so that the photo is not visible. 

X

I suppose it’s ironic me wanting to draw attention to a cause, but doing everything I can not to draw attention to myself. 

We see X walking backstage, where staff mill around but no one seems to pay any attention to X’s presence. X then reaches the exit, where there is a time recorder / punch clock with cards in slots showing employee names. X takes a photo of it on her phone before slipping away. As the door closes, we see that there is one member of staff, KEVIN (early 30s), who seems to have noticed and thinks over what he has seen. 

14  INT. WALKWAY. SPORT / EVENTS ARENA 14 

X is now back out in the public area, without the high-vis on. She takes out a coloured baseball hat with a logo on the front and puts it on her head and a football scarf around her neck. 

X

While most people spend their lives trying to stand out, I do what I can to blend in, which isn’t hard because most people are so wrapped up in what they’re doing that they miss what’s going on around them. 

A few people wearing different coloured hats and scarves are milling around, going to the toilets, visiting the kiosks, perhaps getting early drinks before the main interval rush. 

X emerges from around a corner and talks to camera. (She has a different hat and scarf on) 

X (CONT'D)

You won’t always see what’s going on because the brain filters out everything other than that which needs attention. Problem is, how do you know what needs attention and what doesn’t? 

I mean, if you don’t notice something as obvious as me changing my sporting allegiance... 

She pulls the other cap and scarf out of her jacket pocket. 

15  FLASHBACK - INT. SHOPPING CENTRE - DAY 15 

We cut to the shopping mall scene, where X sits on a bench, observing the cameras. 

X

...you’re not really likely to notice me if I’m just sitting there minding my own business... 

16  FLASHBACK - INT. BACKSTAGE CORRIDOR. SPORT / EVENTS ARENA.16 

X smiles at the person who holds the door open for X to get through. 

X

And only someone who’s switched on is gonna notice that person without an I.D Pass. 

17  FLASHBACK - INT. BACKSTAGE CORRIDOR. SPORT / EVENTS ARENA.17 

As X slips away, we see a flashback of Kevin, who seems to have noticed X taking the photo of the time recorder and thinks over what he has seen. 

--- 

MODULE FOUR 

18  INT. STATION. DAY. 18 X is wandering around, observing, making notes, trying doors. 

19  INT. CONTROL ROOM. STATION. DAY. 19 

We see GERRY (Mid 40s) stand to swap positions with another member of staff monitoring the CCTV in the control room. As he is about to leave they spot X on screen trying a door then moving off. 

20  INT. STATION. DAY. 20 

X is walking along in the distance. GERRY comes into frame and sets off in the same direction. 

21  INT. WALKWAY. STATION. DAY 21 

GERRY, dressed in railway uniform and orange hivis, sees X blending in with a group of other people. He catches up alongside. 

GERRY Hey, you. 

As the person turns, we see that it’s not X but SIMONA (Mid 30s), a woman dressed similarly to X. 

SIMONA What’s up? 

GERRY

What were you doing back there? 

SIMONA

Back where? What are you talking about? 

GERRY

I saw you on the camera. What have you got in your pockets? 

SIMONA

I haven’t got anything. What’s your problem? 

The people with the member of the public jump to her defence (ad-libbed), telling GERRY to leave her alone. One of them films the episode. We cut to see X observing the scene from nearby. 

X

That’s a PR disaster right there. 

And the good thing is she’ll think twice about approaching people in future, which makes my life a lot easier. 

X smirks and walks away. 

22 EXT. WALKWAY BY COFFEE SHOP RAIL STATION - DAY 22 

X sits at a table outside a coffee shop studying a space near the staff entrance to a station. 

X

These kind of places are great. 

You’re not on the premises, so not everyone knows who’s responsible for security, so they leave it to someone else. 

X watches a member of staff from the transport company leave by a side door that provides access to the staff area. X watches for a moment and spots another member of staff walking towards the door. X gets up and walks nearer, then turns and pretends to take a selfie when, in reality, she is video recording the person opening a door with a keypad, unaware that they’re being recorded. 

As the person enters and the door closes, X watches the video back and is able to see the keycode. Meantime, a member of staff from the coffee shop is bemused to find the nearly full cup of coffee with uneaten croissant. 

JASMINE (Early 40s), a member of staff from the station, has seen and approaches X. 

JASMINE

Hi there. Can I help you? 

X seems a little flustered. 

X Sorry? 

JASMINE

This is the staff entrance. Do you work here? 

X

Er, no. I’m just waiting for a friend. She works here. 

JASMINE

Oh right, who’s that? 

X Deborah. Debbie. 

JASMINE

Okay. What’s her surname? 

X

It’s fine. Don’t worry. 

JASMINE

If you tell me your name I’ll see if I can track her down for you and let her know you’re here. 

X

It’s okay, I’ll shoot her a text. 

Thanks.

X smiles a mouth only smile and walks away. 

JASMINE

It’s no problem...we’re always happy to help ....

 

Jasmine watches as X disappears round a corner. 

23  AROUND THE CORNER 23 X is walking away, very annoyed. 

X

I really hate people like that. I can never tell if they’re genuinely being helpful or letting me know they’ve clocked me. 

X gives an angry shake of the head and takes out a mobile phone to make a call, disappearing off into the crowd. 

--- 

24  MODULE FIVE 24 

25  INT. FLAT - DAY 25 

X sits, collating the information gathered. As we see all of the photos and details coming together, we intercut the following scenes. 

26  INT. OFFICES. SPORT / EVENTS ARENA 26 

Mick is dialing the security number from a leaflet/phone sticker some kind of internal comms re security. 

MICK

Hi there, I want to report an incident. (a beat) Yes, I just came back into my office and there was a woman here and I think she’s taken my security pass. (a beat) Just a few moments ago. She was wearing a high vis vest and said she was responding to an email about a faulty phone... 

27  INT. OFFICES. SPORT / EVENTS ARENA 27 Kevin is talking to his LINE MANAGER (Mid 40s F). 

KEVIN

It was not long after I’d started my shift so about eight o’clock. She was taking a photo of the time recorder. 

LINE MANAGER

Okay, thanks for coming to me. Can you tell me exactly what you saw? 

KEVIN

Yeah, so this woman was taking a photo on her phone of the time recorder. I’m not sure exactly but there was something about it that didn’t feel right. 

28  INT. FLAT - DAY 28 

X draws a ring around a particular location on a site map she has printed off. 

29  INT. OFFICES. RAIL STATION 29 Jasmineis speaking on the phone. 

JASMINE

I know we’re supposed to report things like this, just in case..... Well, yeah, I’m pretty sure she was videoing the keycode. 

(MORE) 

JASMINE (CONT'D)

I mean, it was an odd place to be taking a selfie.... I did, yes, I asked if I could help and she said she was waiting for a friend called Debbie, but there aren’t any Debbies here...It just didn’t feel right, you know what I mean? 

30 INT. SHOPPING CENTRE - DAY 30 

Carol is talking to RICHARD (Mid 30s), a shopping centre security guard. 

CAROL

It might be nothing but it looked like she was trying to open a door to the back of the centre. When she saw me she disappeared quickly. 

RICHARD

You’ve done the right thing, so thanks for reporting it. I’m going to look into it, so can you describe the person you saw for me?

CAROL

Yes, she was (describes X according to casting /wardrobe). 

30a INT. OFFICES. RAIL STATION Jasmine is speaking on the phone. 

JASMINE

(Describes X based on casting and wardrobe). 

30b INT. OFFICES. SPORT / EVENTS ARENA 30b Kevin is talking to his line manager. 

KEVIN

(Gives more descriptive detail based on casting and wardrobe) 

31 EXT. PARK - DAY 31 

X sits, on a bench, collating notes and transferring bits of information on her phone. She then looks to camera. 

30a 

X

Look, I can feel you judging me, but I don’t care what you think. Like I said, it’s just numbers, okay? Nothing personal. 

We see X from different perspectives as she puts her things in a bag; from across the park, through a group of parents and toddlers playing at the swings, through the telephoto lens of a camera. 

POLICE OFFICER #1 (v.o. Through police radio) 

Got a positive ID on an IC2 female, fitting the description given. Looks like she’s getting ready to move. 

We cut back to X, who stands up and looks to camera. 

X

Oh, and by the way, if anyone asks, you haven’t seen me. Right? 

X walks away. 

POLICE OFFICER #2 (v.o. Through police radio) 

Stand by all units. Fade to black. 

32.DELETED RECAP 

33 FLASHBACK - VARIOUS. 33 

To a musical accompaniment, we see various shots of X observing, taken from different viewpoints and in different locations. 

Captions appear sequentially on screen. 

CAPTION

The term ‘hostile’ refers to anyone who wants to attack or disrupt an organisation. 

CAPTION (CONT'D) Hostile reconnaissance is the gathering of information for the purpose of planning a hostile act against a target. 

CAPTION (CONT'D) Hostile reconnaissance relies on 3 main sources of information: 

34 FLASHBACK - FLAT. 34 

We a montage of see X looking online and compiling information. 

ONLINE 

35 FLASHBACK - VARIOUS. 

CAPTION 

X observes on site at the different locations, makes notes, tries a door handle. 

CAPTION ON SITE. 

36 FLASHBACK - VARIOUS. 

X is let in to the backstage area at the sport / events arena by the person holding the door open. 

Mick leaves his computer logged on and his lanyard unattended on the desk 

CAPTION INSIDER. 

CAPTION (CONT'D) Insiders might be complicit or unaware that they’re assisting 

hostile activity. 

37 FLASHBACK - VARIOUS. 37 X observes the cameras and security staff. 

CAPTION

Hostiles want information about the security of a target. 

38  FLASHBACK - EXT RAIL STATION. 38 X takes a photo of the keypad. 

CAPTION

And they’re on the lookout for vulnerabilities. 

39  FLASHBACK - RAIL STATION CONCOURSE. 39 X observes commuters. 

CAPTION

They want to identify the best place and method of attack. 

40  FLASHBACK - VARIOUS. 40 

We see the various people noticing / observing X taking an interest in different things such as the time recorder info. 

CAPTION

SEE - Be on the lookout for any suspicious activity. 

CAPTION (CONT'D)

It might not always be obvious. 

CAPTION (CONT'D)

Be aware of what others are taking an interest in. 

CAPTION (CONT'D)

And trust your instincts. If it doesn’t feel right, it probably isn’t. 

41  FLASHBACK - EXT RAIL STATION. 41 We see Jasmine approaching X after he takes the photo. 

CAPTION

CHECK - You can make a real difference through vigilance and good customer service. 

41AA INT. RAIL STATION DAY 41AA 

We see a couple of general eye contact, smiles and good customer service interactions. 

CAPTION

Eye contact and friendly engagement make life difficult for hostiles, and improve the customer experience for everyone else. 

41A INT. RAIL STATION - DAY 41A 

We see a station staff member observe someone (extra) looking into a doorway. The staff member makes eye contact and approaches, saying ‘Hello, can I help you?’ The person responds by saying they’re looking for the toilets. 

CAPTION

Don’t underestimate the power of ‘Hello’. 

CAPTION (CONT'D) But if you think there’s an immediate threat, dial 999. 

42 FLASHBACK - VARIOUS. 42 We see various people notifying. 

CAPTION

NOTIFY - Your intervention may save lives. 

CAPTION (CONT'D) Find out and learn your site’s security procedures. 

CAPTION (CONT'D)

If you don’t know how to report suspicious activity, ask your supervisor.

CAPTION (CONT'D)

If possible make notes about... What you saw. Location. Time of incident. Description of the person or people. 

And make sure you report it immediately. Your information may be a key piece of the puzzle. 

43 FLASHBACK - SHOPPING CENTRE. 43 

We see Carol see X acting suspiciously and then disappearing. We then see Carol talking to a security guard. 

CAPTION

If members of the public report anything suspicious, you need to take it seriously and act on it. 

CAPTION (CONT'D) Remember to ask for their name and contact details, thank them for the information and tell them what you will do about it. 

We close on a final montage of images of the film’s most salient moments. 

CAPTION (CONT'D) Be vigilant Be aware of your environment - You know what looks normal and what doesn’t. 

Don’t leave it for someone else. YOU need to act. 

Don’t put yourself at risk and always dial 999 in an emergency. 

SEE CHECK and NOTIFY 

The caption then animates into the SCaN logo. 

subtitled version of the SCaN For All Staff Film

 is also available.

However, we strongly recommend that the awareness package is accessed through Highfield e-learning to make full use of the resources available (interactive knowledge check, facilitators notes and SCORM file). 

Below you will find posters that can be personalised and printed to publicise SCaN training in your organisation and remind your staff what SCaN stands for.

SCaN for Line Managers

The SCaN for Line Managers module is designed for members of staff in supervisory or management roles within organisations, to increase their awareness of the hostile reconnaissance that could be undertaken by someone within their organisation in preparation for an insider event. This module will help staff identify this activity and know how they can help to counter it. 

2 people having a conversation

 

SCaN for Line Managers logo

 

Man looking directly at camera

SCaN for Line Managers is designed as a 'bolt-on' SCaN module. We strongly recommend that learners undertake a 'core' SCaN Module (All Staff, Customer Facing, Communications Professionals and CCTV Operators) before SCaN for Line Managers. 

Much like the SCaN for All Staff module, we strongly recommend security managers from organisations, venues and events utilise the facilitator notes and knowledge check to run facilitated SCaN for Line Managers sessions with their staff, and not just ask staff to view this film on its own.

The module outlines the core components of SCaN, focussing on how they apply to insider threat:

  • See – Understanding what hostile reconnaissance could look like in a workplace and how to spot it. 

  • Check – Knowing what to do as a manager if you suspect hostile reconnaissance or identify suspicious activity from a colleague. 

  • Notify – who you should tell and what you should tell them. 

The SCaN for Line Managers film forms part of the wider SCaN programme. If you'd like to find out more about this programme, speak to your local Counter Terrorism Security Advisor (CTSA).

Note of username and password
2 people having a conversation across a table
Worried looking man
A man leaning against a wall, texting on phone. Bubble of text message in bottom right hand corner that reads "Good job. Try login and copy any security/personal info files on to HD. Meet me tomorrow at 13:15."

There are multiple ways to access the SCaN for Line Managers module: 

 

  • Online - as an individual learner you can watch the film and do our knowledge check through the Highfield e-learning website. Open the package and select the ‘Individual’ option. 

  • Facilitated session - Your organisation can run facilitated group sessions for themselves. If you’d like to run a group session for your colleagues, go to the Highfield e-learning website and select the ‘Facilitator’ option, then ‘Access online now’. This will give you access to the detailed facilitators notes to help you run an effective SCaN for Line Managers awareness session. 

  • Through your organisation’s own eLearning system - Your organisation can also embed the awareness session into their own eLearning system to allow individuals to complete the learning ‘offline’. If you wish to obtain a copy of the learning package for use internally, you can request a SCORM file for download by going to the Highfield e-learning website, selecting the ‘Facilitator’ option and then ‘Request SCORM download’. 

Did you find this page useful? Yes No