Implementing an Effective Mail Screening Process

By Anthony Luongo
Director of Security
The Millennium Group

INTRODUCTION: Implementing an effective mail security program for your organization may be easier than you think. In an increasingly digital world, it is easy to overlook the security risks associated with hard copy mail; however, physical mail and packages can still pose significant threats to individuals and organizations. This White Paper explores the various threats and vulnerabilities associated with U.S. Mail and 3rd party courier packages and provides best practices and strategies to enhance mail security and mitigate risk.

This overview covers topics such as mail handling procedures, secure mailing practices, and the use of technology to enhance mail security. Many organization devote much time and effort in developing a comprehensive physical security plan, however the mailroom is often overlooked when companies assess their overall security.

The U.S. Department of Homeland Security and the Interagency Security Committee identify some of the risk factors for mail borne threats such as:

• Public posture: About a dozen industries, including banking, legal and transportation, are more likely to receive threats.
• Symbolism: Is the organization well known and controversial? High profile social media companies, financial institutions and public news organizations , for example, may be more likely targets than a lower-profile organization.
• Location: Organizations in large, multitenant facilities and urban centers are at higher risk.
• Organization size: Organizations with large employee counts are more likely to be targets.
• Volume of U.S Mail and 3rd party courier packages

CURRENT THREAT ENVIRONMENT:

The United States remains in a heightened threat environment particularly due to recent events in Iran in addition to ongoing conflicts in Ukraine and Israel. Lone wolf offenders and small groups motivated by a range of ideological beliefs and personal grievances continue to pose a persistent and lethal threat to the Homeland.

Both domestic violent extremists (DVEs) and those associated with foreign terrorist organizations continue to attempt to motivate supporters to conduct attacks in the United States, including through violent extremist messaging and online calls for violence. In the coming months, factors that could mobilize individuals to commit violence include their perceptions of the 2024 general election cycle and legislative or judicial decisions pertaining to sociopolitical issues.

The past few years have been especially difficult with a continued domestic political discord, civil unrest and international conflicts. The current political climate, and conflicts in the Ukraine and Middle East could motivate international and domestic operators to initiate an attack via the mailroom. The need to effectively screen incoming mail and packages takes on greater importance in keeping employees and their families safe.

As indicated above, mail threats can occur at any time, for any type of organization. They may come from disgruntled current/ former employees, terrorist actions, homegrown extremists, or individuals with a grievance against a particular company. Mail screening is an essential part of an overall security plan that includes physical security and cyber security strategies.

Recent victims of mail related incidents have been:

• Financial institutions
• Government agencies and military installations
• Pharmaceutical and healthcare companies
• Hotels
• Universities
• Media companies
• Social Media companies
• Elected officials, Courthouses and high profile supporters
• Religious institutions

A comprehensive physical security plan should not overlook the mailroom. An effective mail screening strategy begins with a comprehensive threat and vulnerability assessment. An effective risk management plan is a systematic approach to assess and respond to risk. It means, identifying, assessing, understanding, acting on and communicating risk issues within the organization. In general, the following questions should be addressed:

1. Is the company in a high profile industry?
2. Is the company a multinational corporation with offices in high threat countries?
3. Has the company received any threats?
4. Is your company located in a high risk facility or area?
5. Are the company’s products or services controversial?
6. Have there been recent layoffs?
7. Does executive leadership maintain a high public or political profile?

If the answer to any of the above questions is “yes”, your organization may want to consider a more robust posture regarding mailroom security. Mail screening can range from basic visual inspection, incorporating x-ray screening , and through more advanced on or off site screening for Chemical, Biological, Radiological, Nuclear and explosives (CBRNE).

Three Critical Reasons to Consider Mail Screening:

1. Employee Safety: First and foremost your frontline mailroom employees and any employee who receives mail or deliveries could be at risk. Ensuring their safety and workplace security is always of first priority.
2. Facilities and Assets: Business disruption is expensive. Even a hoax letter can cripple operations for hours. A hazardous one could shut down your office for days or longer, at great cost to your business. Damaged facilities or assets can be very costly and repair can take valuable time. Protecting your business continuity is important.
3. Organizational Reputation: The goal of a mail terrorist is to disrupt, generate publicity and cause fear. In a matter of minutes, a mail threat could force your employees to be evacuated. Staff scrubbed down by a hazmat crew, their images broadcast on national television. Prevention is key.

While many organizations utilize x-ray technology to screen mail and parcels for explosives, this approach proves to be risky for two reasons: on premise x-ray screening affords facility penetration, and it does not address the ominous threat of chemical and biological agents. When contaminants are not discovered before delivery, adverse media reports can cause panic about safety and can also negatively impact corporate reputation.

Prescreening mail for these contaminants, including hoax substances, provides companies with the opportunity to determine if or when you will inform the public that an attempt was made to infect your personnel.

Mail threats are a low-cost, accessible form of terrorism. For the price of a stamp, your organization is at risk for disruption or real harm.

Basic steps for Mailroom Safety include:

1. Perform a thorough physical assessment of the mail center and delivery point (loading dock):
   a. Does the mail room have a dedicated receiving area ?
   b. Is the receiving area physically separated from general office space to limit exposure in the event of a threat?
   c. Is access to the receiving area controlled (e.g., via keycard, security personnel, or intercom)?
   d. Are security cameras installed to monitor inbound deliveries and visitor interactions?
   e. Are delivery personnel required to check in or present ID before gaining access?
2. Is there an HVAC shutoff within the mail center to contain any potential threats?
   i. Is the shutoff switch easily accessible and clearly labeled for emergency use?
   ii. Are mailroom personnel trained on when and how to activate HVAC isolation?
   iii. Has a risk assessment been conducted to determine whether the HVAC system connects with other parts of the facility, potentially enabling cross-contamination?
   iv. Are negative air pressure systems or HEPA filters in place to mitigate airborne threats?
3. Are visual aids relating to suspicious mail and package indicators posted in sorting and x-ray screening areas?
   i. Are posters or quick-reference guides prominently displayed for easy access by all mail handlers?
   ii. Do visual aids include photos of actual suspicious items and detailed descriptions (e.g., excessive postage, oil stains, misspellings, protruding wires)?
4. Additional Considerations:
   a. Is the mail center equipped with emergency response kits, including PPE, plastic bags, tape, and gloves for isolating suspicious items?
   b. Is there a designated safe isolation area or containment room for quarantining suspect mail?
   c. Is there a designated safe isolation area or containment room for quarantining suspect mail?
   d. Have staff undergone periodic training and drills on mail threat recognition, response, and evacuation procedures?
   e. Are communication protocols in place to alert internal security teams or first responders in the event of a suspicious item?
5. Put a plan in writing – develop written policy and contingency planning should an incident occur.
6. Install correct screening equipment aligned to the security risk assessment
7. Conduct practice drills
   With advanced technologies, mail can be screened for “CBRNE” agents – Chemical, Biological, Radiological, Nuclear and Explosive materials.

The following threats are targeted during a full CBRNE mail screening process:

Chemical: Chemical warfare agents, such as blister, blood, and nerve agents, and toxic industrial chemicals, such as chlorine and phosphorus.

Biological: Bio-targets consisting of plague, tularemia, botulinum toxin, anthrax, ricin, and smallpox; this target list follows the Centers for Disease Control (CDC) Bioterrorism Agent guidelines and falls within the CDC’s Category A or Category B groupings.

Radiological: Radiation sources that are potentially hazardous, such as gamma and neutron radiation.
Nuclear: Radiation sources associated with special nuclear material.

Explosive: Conventional explosives and improvised explosive devices.

Narcotics: Advanced screening for narcotics have identified that dangerous opioids—including fentanyl and xylazine—are being trafficked into the United States via the postal system as well as through international border entries.

BUILDING THE MAIL SECURITY SOLUTION

Mailroom screening can be organized into different levels of security, depending on the threat profile of the organization, available resources, and the volume of mail handled. Below is a summary of the common levels of mailroom screening, progressing from basic to advanced:

Level 1- Low threat environment due to low volume or low threat organizations

• Staff trained per USPIS/DHS standards
• Identifies suspicious signs: no return address, stains, wires, etc.
• Mailroom display of USPS Poster 84; semi-annual refresher training
• Deploy a biological containment cabinet to isolate suspicious items
• Staff trained on suspicious package indicators and protocols annually

Level 2 – Image Screening (x-ray/wave millimeter) – Moderate threat environment due to higher mail volume or increased exposure

• Full visual screening as noted above plus implantation of x-ray / image screening.
• Dedicated x-ray/ imaging equipment
• Staff trained on x-ray interpretation at assignment and annually thereafter
• Staff trained on suspicious package indicators and protocols annually
• Detects firearms, knives, dangerous instruments, explosives, powders and liquids
• Advanced screening aids such as command centers with trained bomb technicians and advanced AI software imaging

Level 3 – CBRN – High-threat environments – targets of ideological, chemical, or terror threats

• Level 1 and 2 plus CBRN screening
• Detection for biological and chemical threats, radiation, nuclear material
• Advanced training for high-threat environments
• Annual specialized training and emergency operations protocols

On Site or Off Site Screening:

Once an organization has decided to implement advanced mail screening, they will need to decide if they want to perform the screening on-site, or at an off-site location. On-site and off-site screening both come with their pros and cons. It is ultimately the organization’s decision to select the method that best suits their needs.

On-site Screening allows for instant access to cleared mail. This reduces any delays that might be experienced when introducing screening into the normal mailroom flow. While the elimination of any delay is ideal, for many organizations the risk of performing on-site screening outweigh the benefits. When performing screening on-site, a detected threat could still shut down your organization for hours, possibly days. if operations are shut down due to a legitimate threat entering the screening facility, all the time saved by performing the screening process on-site will quickly vanish.

Off-site Screening keeps threats from ever entering your facility. All mail is screened prior to delivery, ensuring only clean mail arrives at your facility. Off-site mail screening provides a highly efficient and cost-effective solution for ensuring the security of your mail. Any minimal delay in delivery—typically just a few hours to the next business day—is far outweighed by the benefits.

Dedicated off-site facilities keep delays to an absolute minimum, and even multi-customer facilities offer substantial cost savings by eliminating the need to purchase and maintain expensive screening equipment on-site. Additionally, off-site technicians receive advanced, specialized training, ensuring that mail is handled with the highest level of safety and professionalism, while operational continuity is fully protected.

The reality is simple: one unexpected threat in the mailroom can disrupt operations, endanger people, and cost a business far more than anyone anticipates. Protecting your mail is no longer optional—it’s a critical part of keeping your organization safe and running smoothly. This report highlights how a combination of vigilance, advanced screening technology, and trained personnel can turn the mailroom from a potential risk into a powerful line of defense.

To contact the author email: aluongo@tmgofficeservices.com