When a company executive receives a threatening letter, the organization’s response during the first 24 hours can influence both personal safety and the effectiveness of any subsequent investigation.
The immediate challenge is not simply determining whether the threat is credible. Companies must preserve potential evidence, contact the appropriate authorities, evaluate the circumstances, and consider whether temporary protective measures are necessary.
For general counsel, corporate security teams, and executive assistants, having a clear response procedure can prevent important details from being overlooked during an already stressful situation.
The First Hour: Preserve the Letter and Protect the Evidence
The first priority is to preserve the threatening communication and its envelope.
Once the letter has been identified as threatening, unnecessary handling should stop. Both the letter and envelope may contain information valuable to investigators, including fingerprints, postmarks, and other physical evidence.
Anyone who has already handled the materials should be identified. This may include mailroom personnel, receptionists, executive assistants, and other employees who encountered the correspondence before its contents became known.
The company should also avoid responding to the sender. Direct communication could complicate the investigation or encourage further contact.
Information about the incident should initially remain within a limited group of employees responsible for managing the response.
If a letter or package contains suspicious substances or presents an immediate physical hazard, staff should avoid further contact, isolate the item, and follow emergency guidance rather than attempt to preserve it themselves.
Notify the Appropriate Authorities Without Delay
A threatening letter should be reported promptly to law enforcement, even if its seriousness is initially uncertain.
Local police are generally the first point of contact. They can document the incident, evaluate potential criminal violations, and determine whether immediate intervention is necessary.
When threats arrive through the postal system, the U.S. Postal Inspection Service should also be notified. Federal law addresses certain threats transmitted through the mail, including threats involving kidnapping or physical injury.
If threatening communications also arrive through electronic channels, such as email or social media, the FBI may have jurisdiction depending on the circumstances.
These reports serve different purposes, and contacting one agency does not necessarily replace notifying another.
Companies should also recognize that filing a police report does not resolve every immediate security concern. Investigators focus on identifying potential offenders and establishing whether crimes have occurred. Corporate leadership must still consider the executive’s immediate safety, particularly during travel and other routine activities.
Assess the Threat Before Determining Security Measures
A threatening message does not automatically mean that an executive requires armed protection. Conversely, dismissing a letter because its language appears vague or exaggerated can be equally problematic.
The appropriate response depends on the circumstances surrounding the communication.
Security professionals evaluate factors such as repeated grievances, fixation on the executive, attempts to obtain personal information, knowledge of family members or routines, and previous efforts to approach the individual.
These behavioral indicators can provide important context beyond the words contained in the letter.
An initial needs assessment typically involves conversations with the executive and relevant people around them, including an assistant, general counsel, corporate security personnel, and potentially household members.
The purpose is to determine the level of exposure and identify immediate protective requirements.
This initial review is different from a comprehensive security assessment, which may involve a more extensive examination of residential security, travel patterns, organizational vulnerabilities, and other factors.
A proportionate response avoids two common mistakes: implementing unnecessarily disruptive security arrangements and failing to act because a threat initially appears unlikely to materialize.
Review Immediate Security Arrangements Before the End of the Day
Following the initial assessment, companies should consider practical measures that can reduce exposure while more detailed evaluations continue.
Several areas deserve particular attention:
- Residential security: Determine whether the executive’s home requires an immediate security review or additional precautions.
- Daily transportation: Review commuting arrangements, travel timing, and predictable movement patterns.
- Public schedules: Identify upcoming appearances, conference participation, and publicly accessible travel information.
- Family and household: Ensure relevant household members understand the situation and know whom to contact.
- Reception and mail handling: Establish procedures for identifying and reporting additional suspicious correspondence.
- Personal information exposure: Examine publicly available information concerning the executive’s residence, relatives, and movements.
These adjustments do not necessarily require a permanent protection team. The appropriate measures depend on the findings of the assessment.
If professional close protection is warranted, qualified and properly licensed personnel should be engaged.
In Texas, personal protection officers and the security companies employing them are regulated under Chapter 1702 of the Texas Occupations Code. Businesses arranging such services should verify the relevant licenses and organizational responsibilities.
Maintain a Written Record of Every Significant Decision
Documentation is another important element of the first-day response.
A decision log should record when the company became aware of the threat, who was notified, what information was available, and why particular actions were taken.
For example, an organization might record the time the letter was secured, when law enforcement received a report, and when temporary travel arrangements were approved.
The record should identify who made each decision and any outstanding actions requiring follow-up.
General counsel or another designated individual can maintain this information in a shared document with controlled access.
Beyond supporting internal coordination, the log creates a contemporaneous account of how the organization responded. That documentation may become important during subsequent legal proceedings, insurance reviews, or corporate governance discussions.
What Happens After the First 24 Hours?
The first day should conclude with a transition from immediate protective measures to a more structured assessment of the executive’s ongoing exposure.
The company should assign responsibility for monitoring developments, coordinating with investigators, and determining when existing precautions should be reviewed.
Some threats prove isolated. Others may develop into repeated communications or more concerning behavior.
A documented reassessment process allows protective arrangements to change as new information becomes available, rather than remaining indefinitely in place or being discontinued without evaluation.
As emphasized in the published guidance of Blue Goose Security Transportation, a Texas-based executive protection provider, the first 24 hours are particularly important for preserving evidence, assessing risk, and establishing a reliable record of corporate decisions.
Organizations considering executive protection services following a credible threat should base the extent of those arrangements on a professional assessment rather than the threatening message alone.
Ultimately, an effective response combines timely reporting, proportionate security measures, and clear accountability. The objective is not to eliminate every possible risk immediately, but to ensure that the organization makes informed decisions and can demonstrate how those decisions were reached.
This article is intended for general informational purposes and does not constitute legal or security advice for a specific incident.
