Securing the corporate mailroom

Since letters containing anthrax spores were sent to several media outlets and the offices of two U.S. senators in 2001, implementing mailroom security procedures and technologies has been one of the biggest challenges for security directors.

Numerous so-called "white powder" scares are reported across the country every week and target a variety of sectors including government offices and corporate facilities. Industry experts say the costs of these scares on the bottom lines of businesses can be staggering, especially if they fail to invest money and resources in securing their mail facilities properly.

"There is an expense (to secure the mailroom), but when you compare that expense against the cost of an evacuation... it is negligible," said Rich Coakley, director of solutions development for Pitney Bowes Management Services, which provides mailroom screening services to large corporate entities in the U.S. and the UK. "

White powder scares resembling anthrax attacks are only the tip of the iceberg, however, when it comes to threats that can be sent via the mail. Potential explosive devices, as well as other chemical and biological agents, such as Ricin, also pose a threat.

Ronald Heil, assistant vice president and senior security consultant for TranSystems, an independent consulting and security systems design firm, said that one of the things his company advises clients to do to help mitigate mail threats, no matter what form they take, is to have their mailroom separated from the rest of the corporate campus. However, if a company has their offices in a high rise complex and the mailroom cannot be separated, Heil says it should be located on a ground floor, preferably on an outside wall.

Securing the heating and air conditioning system of a building must also be a key consideration when creating a mailroom security plan, as chemical and biological agents could quickly spread throughout the workplace if the proper safeguards are not in place.

"It doesn't even have to be a terror attack. It could be your basic shipping and receiving," Heil said. "You occasionally could get deliveries of certain volatiles or combustibles or in a lab environment, you could be getting pathogens of some sort, so you do not want the HVAC system to assist in spreading any of those (agents) throughout your facility."

Ideally, Heil said that mailrooms should have their own HVAC systems. If that is not possible, then an emergency shutdown or automation system may be good alternatives.

If an organization feels it may run the risk of receiving a bomb through the mail, Heil recommends that companies take steps to harden their mailrooms against blasts by reinforcing interior walls and building blow out walls so that an explosion will not create such a powerful upward force.

On a basic level, nearly everyone agrees that companies should conduct an exterior inspection of their mail for threats, which includes closely examining the letter or package for things such as a lack of postage, improper address and exposed wiring or grease on the package. Click here for more mail screening tips from the Baltimore Police Department.

If you feel that your organization is at an increased risk of receiving a mail threat then experts say having some form of X-ray screening system is paramount.

One company that offers a myriad of screening technologies for the mailroom is Smiths Detection. Jim Viscardi, director of critical infrastructure for Smiths Detection, says that the type of screening solution deployed really depends upon the perceived threat by the organization implementing the technology.

"For the most part, the perceived threat in our client base starts with explosives. They are also looking for weapons, including knives and guns. In the case of correctional facilities, they are looking for contraband such as drugs and cell phones," he said.

Typically, Viscardi says businesses start out with X-ray equipment and then upgrade to explosives detection solutions which may be used in conjunction with one another considering the threat level of the business.

"There are a number of different iterations (of X-ray machines). We have large X-ray machines that not only screen mail, but anything that would come through your loading dock to smaller checkpoint-size solutions that you would typically find in an airport. We also have very small X-ray machines that are portable and that you can move from sight-to-sight... to do specific forms of screening," he said.

Viscardi added that they also have desktop and portable versions of explosives and narcotics detectors. Though they do offer chemical and radiological screening products, Viscardi said that they have not been implemented to screen mail at companies; rather they have been used to safeguard employees' breathing space.

"A lot of it depends on the customer's priority list of threats," he said. "We tend to find that as our customers get bigger, especially with federal agencies, the more threats they can afford to protect against. As they get smaller, they tend to focus on the top two or three priorities."

Coakley said that Pitney Bowes will sometimes take screening for threats even further in some instances.

"In some circumstances, we will recommend canine screening of a shipment of mail or express items or courier items as they are being brought to a client's facility," he said. "We will do biohazard screening in some circumstances."

According to Coakley, biohazard screening consists of taking ambient air samples, as well as air samples from the interior of a letter or package and then testing them onsite for any chemical or biological agents. Mail imaging services are also popular among many Pitney Bowes clients.

"It creates a virtual firewall, the paper does not actually go into their facility," Coakley said. "An image goes onto their network, so it is in their electronic mail file."

Mail screening experts say, however, that having all of this state-of-the-art screening technology means nothing if a company and its employees do not follow a strict set of policies and procedures when it comes to handling the mail.

"A mail center for a large corporation is not really just about number 10 envelopes. There are packages, physical goods like discs or CDs, laptops and flat screen monitors," Coakley said.

To ensure that companies can receive these goods without much delay, Coakley advises his clients to discourage their employees from receiving personal items in the mail so that they only deal with business mail. He also works with businesses in cutting down on the amount of mail coming into a facility by eliminating solicitations and converting things such as magazine subscriptions into electronic formats.

Ideally, Heil said that all mail, be it from the postal service or a courier, should come through the mailroom first. However, that can be easier said than done.

"You have trouble convincing people of that many times. There is an added expense to it," he said. "You are going to need someone to operate in that mailroom as opposed to letting the courier service come right in the building, get on the elevator and go right to whatever floor it is and drop something off. You need that procedure that everything has to come through (the mailroom). Everything that you exclude from that ruling ends up increasing your risk."

Even such things as flower and candy deliveries need to be considered a part of that policy, according to Heil. If you choose to let some items go, Heil said you then need to work on mitigating the risk that you have let in by training employees how to recognize suspicious packages.

Ted Lotti, who oversees security at the 47-story Hearst Tower in downtown New York City, said that employee training and following proper procedures are key ingredients in mitigating mail threats.

"We train everybody in the mailroom to look for suspicious packages, anything odd. There are tell tale signs, how (the package) is labeled, what kind of postage is on it, who it is addressed to, how much it weighs," he said. "That's basically what you depend on, common sense and basic training to be aware."

The Hearst Tower also has a policy that all deliveries go through the mailroom and though they do have an X-ray machine, Lotti said he encourages workers that encounter a suspicious package to leave it alone and notify the authorities.

There are also other threats that can enter the workplace through the mail, even though there may be no malicious intent behind them. Coakley said that employees will sometimes have knives or weapons for sporting use sent to their offices and while they were not intended to cause harm, they can disrupt a company's operations.

"The real threat that most organizations have to be prepared for is one that is to cause disruption, to force an organization to evacuate," he said.

Once a potential threat has been detected, even though it may be benign, it has to be treated as if it were real.

Besides the obvious response of notifying the authorities, Heil says isolation of the package or letter in question is important in the initial response to the threat. Even taking the most basic precautions is a big key. Heil said he is familiar with one facility that had an empty 20 gallon bin in their mailroom that workers could use once they realized that they had touched something that was potentially hazardous. Mailroom workers should also wear rubber gloves throughout the course of the day to keep hazardous materials from coming in direct contact with the skin.

Communication within an organization can also play a vital role in warding off potential threats, especially if you know that some of your company's braches or subsidiaries have been recently targeted.

"When one (branch or office) receives (a mail threat), the best coarse is to communicate it more broadly with others that you know and trust because very rarely do these things travel as a single envelope," Coakley said.