Playbook for Incident Response to Extortion or Blackmail

Action Steps for Action Steps

The Crisis Management Team within your organisation should:

• Consider advising the appropriate law enforcement agencies and regulators.
• Consider making a holding reply to gain.
• Obtain information on the person/ organization making the demand, if possible.
• Assess the credibility of the demand and the feasibility of the perpetrators being able to carry out their threats within any time scale set.

While making the assessment:

• Do not respond further to the initial approach
• Improve security/protection of the assets being threatened
• Prepare for further approaches
• Consider the following options:

Payment

• Full demand or negotiated settlement, but remember that you may have to violate regulatory and organisational policy, and there is a "punishment" or consequence when this step is taken.

Resist

• refuse to pay, leave the threatened assets/area, or allow the attack to take place and security reaction to take its course

Remove

• appear to negotiate while organizing an arrest operation with law enforcement agencies.

In extortion situations, tight security must be maintained in all aspects of planning and when deciding policy and intention.