Counterterrorism and National Security Training Course

Participants can assess counterterrorism actions against legal authority, necessity, proportionality and accountability requirements.

• Counterterrorism legal authorities: arrest, search, surveillance, detention and disclosure
• Legality, necessity, proportionality and accountability tests for intrusive measures
• Human rights safeguards under ICCPR and relevant regional instruments
• Rules governing intelligence sharing, retention, classification and oversight
• Chain-of-custody requirements for evidential integrity and disclosure decisions
• Ethical decision records capturing rationale, safeguards and approval authority

Participants can direct intelligence collection and produce decision-focused intelligence products.

• Intelligence cycle stages from direction through collection, analysis and dissemination
• PIRs framed as answerable intelligence questions with decision relevance
• Collection plans matching sources, access, legality, risk and timelines
• Source evaluation using reliability and information-credibility rating systems
• Analytic confidence statements separating facts, judgments, gaps and assumptions
• Dissemination formats matched to operational, strategic and ministerial audiences

Participants can produce a documented terrorism risk assessment and prioritised risk-treatment plan.

• ISO 31000 risk process applied to terrorist threat scenarios
• Threat assessments combining intent, capability, planning indicators and access
• Vulnerability assessment of people, places, systems and critical functions
• Consequence scoring covering casualties, service disruption, economic and societal effects
• Risk matrices calibrated with documented likelihood and impact criteria
• Risk treatment options linked to owners, controls, deadlines and residual risk

Participants can assess mobilisation indicators and design safeguarding-focused prevention responses.

• Actor typologies covering jihadist, ethnonationalist, far-right and single-issue violence
• Pathways to mobilisation distinguished from lawful belief, grievance and dissent
• Behavioural indicators assessed without demographic profiling or protected-characteristic bias
• Network mapping identifies facilitators, recruiters, financiers and operational nodes
• Structured professional judgement records indicators, alternatives and uncertainty
• Prevention referrals designed with safeguarding, consent and multi-agency thresholds

Participants can collect, verify and document open-source information for lawful intelligence use.

• OSINT collection plans specify questions, platforms, timeframes and legal boundaries
• Digital trace preservation records URLs, timestamps, metadata and collection method
• Social-media analysis distinguishes identity claims, influence, intent and capability
• Geolocation and chronolocation techniques corroborate imagery, video and event claims
• Source triangulation tests authenticity, provenance, corroboration and deception indicators
• Online research logs support reproducibility, disclosure and supervisory review

Participants can test competing explanations and communicate analytical judgments with appropriate confidence.

• Analysis of competing hypotheses tests alternative explanations against available evidence
• Key assumptions check surfaces premises driving threat judgments
• Indicators-and-warning matrices connect observable changes to escalation hypotheses
• Red-team challenge identifies mirror-imaging, confirmation bias and groupthink
• Scenario analysis develops plausible attack pathways and decision triggers
• Intelligence estimates state judgments, confidence, evidence and collection gaps

Participants can develop a threat-led operational plan with clear command arrangements and controls.

• Threat-led operational objectives aligned with legal authority and command intent
• Operational plans define tasks, roles, decision points and contingency actions
• Information requirements drive surveillance, disruption, protection and investigative activity
• Command structures assign strategic, tactical and operational responsibilities
• Operational risk assessments address officer safety, public harm and mission failure
• Decision logs record authorities, intelligence basis, actions and review points

Participants can plan a terrorism investigation that preserves evidence and supports prosecution decisions.

• Case theories link suspected offences, actors, evidence and investigative priorities
• Investigation plans sequence interviews, searches, digital forensics and financial enquiries
• Interview strategies apply PEACE principles, rapport, disclosure and challenge
• Evidence schedules identify provenance, relevance, admissibility and disclosure obligations
• Digital evidence handling preserves integrity through hashing, audit trails and access control
• Prosecutor engagement tests charging thresholds, evidential gaps and trial risks

Participants can identify terrorist-financing indicators and plan proportionate financial disruption measures.

• FATF risk-based approach applied to terrorist-financing typologies and controls
• Financial intelligence traces fundraising, movement, conversion and expenditure patterns
• Suspicious transaction indicators distinguish legitimate activity from potential facilitation
• Beneficial ownership, trade finance and virtual assets assessed for concealment
• Asset-freezing actions coordinated with due process and financial institutions
• Financial disruption plans specify targets, legal routes, evidence and measures

Participants can assess site vulnerabilities and specify protective security measures against credible attack methods.

• Target hardening balances deterrence, detection, delay, response and recovery
• Layered security design addresses perimeter, access, screening and internal zones
• Security surveys identify exploitable weaknesses at crowded places and critical sites
• Insider-threat assessments consider access, grievance, coercion and anomalous behaviour
• Protective security measures tested against realistic attack methodologies
• Security posture recommendations prioritise controls by risk reduction and feasibility

Participants can plan protective and recovery measures for essential services exposed to terrorist threats.

• Criticality analysis identifies essential services, dependencies and single points of failure
• Interdependency mapping traces cascading effects across energy, transport, communications and health
• Business continuity priorities define minimum service levels and recovery time objectives
• Protective partnerships establish information-sharing protocols with infrastructure operators
• Resilience measures address redundancy, alternate sites, stockpiles and mutual aid
• Recovery priorities balance public confidence, essential services and evidential needs

Participants can establish command priorities and coordinate a multi-agency response to a terrorist incident.

• Incident Command System functions organise command, operations, planning, logistics and finance
• First operational period objectives use life safety, incident stabilisation and property protection
• Common operating pictures integrate verified intelligence, resource status and incident actions
• Multi-agency coordination resolves authority, interoperability and resource-priority conflicts
• Incident action plans specify objectives, assignments, communications and safety controls
• Decision-making under uncertainty applies thresholds, contingencies and escalation criteria

Participants can prepare coordinated, accurate and accountable communications during terrorist incidents.

• Risk communication messages state known facts, protective actions and uncertainty
• Joint information arrangements coordinate police, government, responders and site operators
• Media monitoring detects misinformation, harmful rumours and adversarial amplification
• Spokesperson briefings prepare factual lines, empathy, legal constraints and updates
• Community engagement prevents stigmatisation while supporting reporting and reassurance
• Communication approval workflows preserve speed, accuracy, accessibility and accountability

Participants can identify CBRNE response requirements and coordinate protective actions during hazardous incidents.

• CBRNE threat assessment differentiates chemical, biological, radiological, nuclear and explosive hazards
• Initial indicators trigger isolation, notification, specialist advice and protective actions
• Hot, warm and cold zones support responder control and contamination management
• CBRNE evidence protocols protect forensic value, safety and chain of custody
• Public protective-action guidance covers evacuation, sheltering, decontamination and medical triage
• Specialist capabilities requests follow local plans and mutual-aid arrangements

Participants can assess cyber-enabled terrorist threats and coordinate cyber-physical response priorities.

• Cyberterrorism scenarios assess disruptive effects on essential services and public confidence
• Attack-surface mapping identifies exposed systems, suppliers, identities and data flows
• Cyber incident triage separates nuisance activity, crime, espionage and terrorist intent
• Indicators of compromise inform containment, preservation, attribution and intelligence sharing
• Joint cyber-physical response coordinates technical recovery, public safety and investigation
• Critical service restoration plans define priorities, dependencies and communications

Participants can apply risk-based border measures while meeting data governance and non-discrimination requirements.

• Risk-based border targeting combines travel data, watchlists, intelligence and legal thresholds
• Watchlist governance addresses identity resolution, data quality, review and redress
• Travel-pattern analysis identifies facilitation routes, suspicious itineraries and document fraud
• Passenger screening decisions balance security concerns, non-discrimination and proportionality
• Cross-border information exchange establishes purpose, safeguards, retention and handling rules
• Port and aviation security measures integrate screening, access control and reporting

Participants can establish practical multi-agency arrangements for tasking, deconfliction and information sharing.

• Memoranda of understanding define mandates, information-sharing purposes and accountability
• Fusion-centre workflows triage leads, assign ownership and track outcomes
• Deconfliction procedures prevent duplicate operations, source compromise and operational interference
• Joint tasking boards prioritise cases using threat, harm and feasibility
• Community reporting channels establish referral criteria, safeguarding and feedback loops
• Partnership performance reviews assess timeliness, quality, outcomes and unresolved risks

Participants can evaluate counterterrorism performance and convert lessons into accountable improvement actions.

• After-action reviews compare objectives, decisions, outcomes and unintended consequences
• Performance measures distinguish activity counts from disruption, protection and resilience outcomes
• Lessons-management registers assign corrective actions, owners, deadlines and assurance
• Strategy reviews test assumptions against threat change, capability gaps and resources
• Audit trails demonstrate legality, oversight compliance and responsible information management
• Professional wellbeing measures address trauma exposure, fatigue and decision quality

Participants can build, peer-review and present a complete counterterrorism and national security plan for a defined threat scenario.

• National threat assessment defines scope, actors, scenarios, confidence and priorities
• Risk register ranks vulnerabilities, consequences, controls, owners and residual exposure
• Integrated counterterrorism plan combines intelligence, prevention, protection, disruption and response
• Legal and ethical assurance records authorities, safeguards, oversight and disclosure
• Incident coordination and public communication arrangements address a defined attack scenario
• Executive briefing presents recommendations, resource implications, metrics and review triggers