KIDNAP RESPONSE RUNBOOK
[DETAIL IDENTIFIER - ENGAGEMENT REF]
The KIDNAP RESPONSE RUNBOOK is the process standard for a confirmed or suspected abduction of the principal or a family member. It takes over the instant the Crisis Actions Playbook’s (EP-025) Missing Principal drill (EP-025 Section 3.7) reaches its hostile-indicators branch - “treat as abduction, LE notified per matrix, all movement stops, scene preserved” - and carries the case from confirmation through resolution and reintegration. It also covers activation where the first indicator is a ransom contact or a family member’s abduction away from a live detail movement, with no preceding Missing Principal drill. This runbook governs process, roles, and decision authority; it does not negotiate, does not value or facilitate a ransom payment, and does not direct recovery action. Negotiation is the function of the retained K&R response consultant; ransom decisions rest with the client, the K&R insurer, and counsel. All engagement-specific values are bracketed placeholders. Do not assert fictional incidents or invent data.
Document Control
| Field | Value |
|---|---|
| Report Reference | [REF-YYYY-###] |
| Date of Report | [YYYY-MM-DD] |
| Classification / Handling | [internal / CONFIDENTIAL] |
| Client | [CLIENT NAME] |
| Requesting Party | [REQUESTER NAME / ID] |
| Prepared By | [ANALYST NAME / ID] |
| Reviewed By | [REVIEWER NAME / ID] |
| Approving Officer | [APPROVER NAME / ID] |
| Version | [0.1.0] |
| Distribution | [NAMED RECIPIENTS - CMT roster only] |
Handling & Legal Caveat
Handling: [internal / CONFIDENTIAL]. Disseminate to the Crisis Management Team (CMT) roster and named detail leadership only. This document may be referenced in litigation, insurance, or law-enforcement proceedings following an incident; treat as work-product where counsel directs.
Nature of this product: This is an operational process standard, not an analytic report and not legal, insurance, or negotiation advice. All actions render to lawful effects only: lockdown, preserve, notify, log, liaise, and hand off to law enforcement and the retained response consultant. The firm does not negotiate with kidnappers, does not value a human life against a payment, does not advise on or facilitate the payment of any ransom, and does not direct or conduct a self-organized recovery. Ransom payments may be unlawful where the recipient is a sanctioned or designated entity (e.g., an OFAC-designated person/SDN or a proscribed terrorist organization) or where payment would breach counter-terrorism-financing, material-support, or anti-ransom law in the client’s or the firm’s jurisdiction; any payment decision and its legality rest exclusively with the client, the K&R insurer, and counsel, never with the detail. The detail’s posture throughout is unarmed protective support (lockdown, liaison, log-keeping, site security) unless local law and the region package legal annex state otherwise; recovery is law-enforcement-led.
Case Snapshot
| Field | Value |
|---|---|
| Engagement Reference | [ENGAGEMENT REF] |
| Governing K&R Risk Assessment | [OSINT-034 report ref, baseline date] |
| Governing Region Package | [RGN-00# ref] |
| Current Activation Level (Section 3) | [0 / 1 / 2 - see confirmation ladder] |
| CMT Stand-Up Location | [LOCATION] |
| Retained K&R Response Consultant | [FIRM / CONTACT - from policy file] |
| K&R Insurer / Policy Reference | [INSURER - POLICY #] |
| Rehearsal Currency (EP-029) | [Last full CMT stand-up drill date] |
Table of Contents
- Purpose and Runbook Scope
- Reference Products
- Phase 1 - Activation and Confirmation Ladder
- Phase 2 - Immediate Actions
- Phase 3 - Crisis Management Team Stand-Up
- Decision Authority Matrix
- Phase 4 - Notifications
- Phase 5 - Response-Consultant Integration
- Phase 6 - Proof-of-Life Protocol
- Phase 7 - Family Communication Discipline
- Phase 8 - Intelligence Support
- Phase 9 - Resolution and Reintegration
- Phase Gate Summary
- Preparedness Annex (Pre-Engagement Requirement)
1. Purpose and Runbook Scope
- This runbook answers one question only: once an abduction is suspected or confirmed, who does what, in what order, and who decides. It does not repeat EP-025’s search and lockdown drill (Section 3.7); it begins where that drill’s hostile-indicators branch ends.
- Two activation paths: (a) escalation from EP-025’s Missing Principal drill when the drill’s unfound-timer or a hostile indicator is reached; (b) direct activation on a standalone indicator - a ransom or proof-of-control contact, or the confirmed abduction of a family member away from a live detail movement - with no preceding drill.
- This is a process standard, not a negotiation manual and not a substitute for the retained K&R response consultant, counsel, or the K&R insurer. It states firm process, roles, notification obligations, and decision authority; it defers negotiation content, payment decisions, and legal determinations to the parties who hold that authority (Section 6).
- Rehearsal is mandatory before reliance: this runbook is exercised per the EP-029 Training and Readiness Program cadence, and the Section 14 preparedness checklist must be satisfied before any engagement in an AO the OSINT-034 K&R Risk Assessment rates ELEVATED or above.
2. Reference Products
Every product this runbook consumes or hands off to, cited by DID. An operator with this runbook and these referenced products should be able to execute the case cold.
| DID | Title | Role in this runbook |
|---|---|---|
| EP-025 | Crisis Actions Playbook | Upstream input; the Missing Principal drill (Section 3.7) hands off to Phase 1 here |
| OSINT-034 (ART-kr-risk-assessment) | Kidnap & Ransom (K&R) Risk Assessment | Required; threat-actor landscape, ransom/negotiation environment, and law-enforcement/response capability baseline for the AO |
| ART-region-package (RGN-00#) | Region Package | Required; Annex D (law enforcement liaison structure) and Annex H (legal and regulatory) govern notification, liaison, and firearms/use-of-force posture |
| EP-001 | Principal Profile | Proof-of-life question bank is pre-staged here (Section 9) |
| EP-011 | Communications Plan (PACE) | Duress signal definition and net discipline apply to any comms during the case |
| EP-017 | After-Action Report | Resolution debrief and AAR format (Section 12) |
| EP-029 | Training and Readiness Program | Rehearsal cadence for this runbook (Section 14) |
| EP-030 | Protective Medicine Plan | Post-release medical evaluation (Section 12) |
3. Phase 1 - Activation and Confirmation Ladder
Entry/exit criteria per rung. The ladder exists so that no single person’s guess, and no delay waiting for certainty, holds up lockdown and notification.
| Level | State | Indicators | Who Declares |
|---|---|---|---|
| 0 | Unaccounted | EP-025 Section 3.7 Missing Principal drill running; no hostile indicator yet | Team Leader (drill call already made) |
| 1 | Suspected abduction | Any one of: forced-entry or struggle evidence; weapon displayed per witness account; vehicle or phone abandoned with signs of violence; witness report of forced removal; principal fails to reach [T+X min] unfound threshold with no benign explanation | Team Leader, immediately, no concurrence required |
| 2 | Confirmed abduction | Law enforcement confirms evidence of abduction, and/or a ransom or proof-of-control contact is received and assessed credible | [CLIENT FAMILY OFFICE LEAD] and CMT Team Lead (RF), jointly, on the record with timestamp |
- Entry criteria (Level 1): EP-025 3.7 has reached its hostile-indicators branch, or a standalone indicator under Section 1(b) is reported.
- Exit criteria (Level 1 to Level 2 or stand-down): Level 2 declared and Phase 2 activates immediately; or the principal/family member is recovered and accounted, in which case this runbook stands down and EP-025 Section 8 (Post-Incident Actions) governs.
- The incident clock starts at Level 1 declaration, not Level 2; every subsequent phase’s notification deadlines (Section 7) run from Level 1 unless the specific obligation states otherwise.
4. Phase 2 - Immediate Actions
Entry criteria: Level 1 declared. These actions run in parallel, not in sequence, and do not wait for Level 2 confirmation.
- Detail lockdown of remaining family members. Consolidate all remaining principal-party family members to [SAFE HAVEN / RESIDENCE]; increase static posture to [POSTURE LEVEL]; no member of the remaining party moves location until the CMT (Section 5) has assessed the threat picture and cleared movement.
- Evidence preservation. The scene from the EP-025 3.7 end state is left undisturbed: no items moved, no vehicles cleaned or repositioned, no devices wiped or reset. Photograph only where lawful and safe to do so. A chain-of-custody log opens at this point and runs through Section 12 handoff.
- Comms discipline. No media statement from any family member, household staff, or detail personnel without CMT and counsel clearance. No social media posts referencing the principal, the family, or the incident by any household member or staff; lock down posting capability on shared/managed devices where technically and legally possible. Household and office staff are briefed a single control message: “No comment - all inquiries to [SPOKESPERSON].”
- Controlled phone answering protocol. Every inbound call to household, office, and detail numbers is treated as a possible ransom or proof-of-control contact until screened. One designated line/handset answers (Section 8 single-spokesperson rule governs who); the answerer does not hang up, does not negotiate, does not confirm or deny the principal’s identity, location, wealth, or insurance status, and activates recording where lawful. The answerer signals the CMT Intelligence/Log-Keeper (CS) immediately and keeps the caller engaged only to the extent the response consultant’s standing guidance (once engaged) directs.
- Exit criteria: lockdown holding, evidence log opened, comms discipline briefed to all remaining party and staff, and answering protocol live on all numbers - all four complete before Phase 3 stand-up is reported complete.
5. Phase 3 - Crisis Management Team Stand-Up
Entry criteria: Level 1 declared. Exit criteria: full roster staffed, roles acknowledged in the log, Section 6 decision authority matrix read into the log by every CMT member.
| Role | Initials / Party | Function |
|---|---|---|
| Client Family Office Lead | [CFO-INITIALS] | Client-side decision authority; family liaison; sole authority (with insurer and counsel) on ransom decisions |
| CMT Team Lead | RF | Overall coordination; liaises law enforcement and the response consultant; does not decide ransom questions |
| Operations | BR | Detail lockdown execution, site security, evidence preservation custody |
| Intelligence / Log-Keeper | CS | Runs Section 10 collection; maintains the single authoritative case log and timeline |
| Retained K&R Response Consultant | [CONSULTANT FIRM / CONTACT] | Negotiation function once engaged (Section 8) |
| Counsel | [COUNSEL INITIALS] | Legal determinations, including ransom-payment legality |
| K&R Insurer Contact | [INSURER CONTACT] | Policy authority, cost coverage, consultant deployment |
- Stand-up timeline: CMT activates within [X] minutes of Level 1 declaration; convenes at [CMT STAND-UP LOCATION]; meets on a [X]-hour cadence until resolution, with an immediate ad hoc convening on any proof-of-life contact.
- CS opens the case log at stand-up; every subsequent decision, contact, and notification is entered there with timestamp and initials (Section 8 log standard).
6. Decision Authority Matrix
States plainly, before any contact occurs, who decides what. This table is read into the log by every CMT member at stand-up so there is no ambiguity in the moment.
| Decision | Decision Authority | Detail’s Role |
|---|---|---|
| Whether, how much, or how to pay a ransom | Client, K&R insurer, and counsel, jointly | None. The detail never decides, recommends an amount, or facilitates payment. |
| Negotiation strategy and direct contact with the kidnappers | Retained K&R response consultant, as authorized by the client | None beyond the Phase 2 answering protocol and handoff (Section 8). |
| Ransom-payment legality (sanctions, material-support, anti-ransom statute exposure) | Counsel | None; flag any indicator of a sanctioned or designated actor to counsel immediately. |
| Law enforcement engagement posture (overt/covert, scope of disclosure) | Client and counsel, in consultation with law enforcement | RF liaises per the region package Annex D protocol; does not set posture unilaterally. |
| Detail security posture, lockdown, and movement of the remaining party | RF (CMT Team Lead), executed by BR (Operations) | Full authority within the detail’s own personnel and site. |
| Media or public statement | Client Family Office Lead and counsel | None; refer all inquiries per Section 4. |
| Family welfare and medical decisions | Client Family Office Lead, medical input per EP-030 | Support only. |
- This matrix is the answer to the single most consequential failure mode in a kidnap case: a detail or firm employee acting, or appearing to act, with ransom authority it does not have. It does not.
7. Phase 4 - Notifications
Entry criteria: Level 1 declared. Exit criteria: every applicable notification logged with timestamp, method, and recipient confirmation; no notification skipped without the CMT Team Lead’s rationale entered in the log.
| Notification | Trigger | Deadline | Authority / Channel | Voidance / Compliance Note |
|---|---|---|---|---|
| Law enforcement of jurisdiction | Level 1 | Immediate | Per region package Annex D liaison protocol; RF liaises through the designated local security advisor | Non-disclosure of tactics as LE directs |
| Embassy / consulate (foreign AOs) | Level 1, principal or family member is a foreign national | [Per region package Annex D/H, or within X hours] | Client Family Office Lead notifies the home-nation consular section; RF supports | Consular notification does not substitute for insurer/consultant notification |
| K&R insurer | Level 1 | [Per policy - typically 24-72 hours; read the actual clause from the policy on file, do not assume] | Client Family Office Lead or counsel, per policy notice provision | Late notification, or public disclosure that K&R coverage exists, risks policy voidance - never confirm coverage to media, LE beyond what is required, or the public |
| Insurer’s retained response consultant | Concurrent with insurer notice | [Consultant deployment window per policy] | Insurer activates; CMT Team Lead coordinates arrival | Consultant integration displaces no CMT role; see Section 8 |
| Client leadership / next of kin not on scene | Level 1 | Immediate | Client Family Office Lead | Per family communication discipline, Section 9 |
| Firm leadership and counsel | Level 1 | Immediate | RF | Work-product handling from this point |
| Licensing authority (if firm-reportable) | Per jurisdiction’s reporting rule | [Per licensing statute] | RF, with counsel | Region package Annex H governs |
- The specific policy notification deadline and disclosure-discipline clause are read verbatim from the K&R policy on file (Case Snapshot); this runbook does not restate or assume a figure where the policy states its own.
8. Phase 5 - Response-Consultant Integration
Entry criteria: insurer and retained response consultant notified (Section 7). Exit criteria: consultant on the case log as the single point of negotiation contact; firm role converted to support and acknowledged by all CMT members.
- On consultant activation, the firm’s function converts to support: log-keeping and intelligence (CS), family liaison support (Client Family Office Lead with RF), and site security (BR, Operations). The negotiation itself - contact strategy, message content, timing, and any discussion of terms - belongs to the retained specialist, never to the firm.
- Communications log standard. Every contact with the kidnappers (call, message, proof-of-life exchange) is logged by CS with timestamp, participants, verbatim content or recording reference, and the decision point it triggered. This log is the single source of truth for the case and is what transfers to law enforcement and counsel at resolution (Section 12).
- Single-spokesperson rule. Exactly one person speaks to the kidnappers at any given time: the retained response consultant once engaged, or the pre-designated interim contact identified in the Section 14 preparedness checklist before the consultant’s arrival. Detail personnel executing the Phase 2 answering protocol never depart from it into negotiation content; their function is to receive, log, and hand off, not to speak for the client.
- Handoff sequence: Phase 2 answering protocol (any detail/household member on the designated line) → interim contact (if staged) → retained response consultant (on arrival, permanently for the duration of the case).
9. Phase 6 - Proof-of-Life Protocol
Entry criteria: any contact claiming custody of the principal or family member. Exit criteria: custody claim verified or explicitly assessed unverified, and logged.
- Question preparation. Proof-of-life questions are pre-staged in EP-001 (Principal Profile) before any engagement, with answers known only to the principal and not publicly discoverable. The question bank is held on a need-to-know basis by CS and the response consultant only, and is refreshed on the cadence set in Section 14.
- Verification discipline. No assertion of custody or wellness is accepted on its own; every proof-of-life claim is tested against a pre-staged question the caller could not have obtained by other means. Voice-sample comparison, where used, is treated as corroborating, not conclusive, given spoofing risk. Verification is repeated at each subsequent contact; continuity is never assumed from a prior verified contact.
- Recording. All proof-of-life exchanges are recorded where lawful, entered into the Section 8 communications log, and retained as evidence for law enforcement and counsel.
10. Phase 7 - Family Communication Discipline
Entry criteria: CMT stood up. Exit criteria: briefing cadence running from Level 1 through resolution; discipline maintained without exception.
- Briefing cadence. The CMT briefs the remaining family on a [X]-hour cadence regardless of whether there is new information; a “no news” briefing on schedule prevents the family from filling an information vacuum on its own. One briefer only: the Client Family Office Lead, or RF where the family requests firm-side briefing.
- What is never promised. No recovery timeline, no assurance that a payment will occur or will succeed, no guarantee of media silence beyond the firm’s control, and no assurance of a particular law-enforcement outcome. Every briefing states what is known, what is being done, and what is not yet known.
- Psychological support referral. Licensed crisis/trauma counseling is offered to the family at case start, not deferred until resolution; the referral and the family’s response are logged.
11. Phase 8 - Intelligence Support
Entry criteria: CMT stood up. Exit criteria: continuous through resolution; the case timeline is complete and handed off at Section 12.
- CS runs collection against the case: open-source monitoring for leaks or claims of responsibility, social-media chatter referencing the incident, and pattern-matching any contact or demand against the threat-actor landscape and ransom/negotiation environment already characterized in OSINT-034 (Sections 6 and 10 of that assessment).
- CS feeds the response consultant and the CMT a continuously updated threat picture and maintains the master case timeline - the single authoritative chronology, timestamped, held inside the Section 8 communications log.
| PIR | Indicator | Status |
|---|---|---|
| PIR-1 - Threat-actor identity and consistency | Does the contact/demand pattern match a group or MO already profiled in OSINT-034? | [OPEN/ANSWERED] |
| PIR-2 - Principal/family member condition and location | Any indicator of physical condition, holding location, or movement | [OPEN/ANSWERED] |
| PIR-3 - Public disclosure or leak | Any media, social, or third-party disclosure of the incident or of insurance/negotiation status | [OPEN/ANSWERED] |
| PIR-4 - Law enforcement investigation status | LE findings, evidence developed, investigative posture | [OPEN/ANSWERED] |
| PIR-5 - Ransom demand consistency | Does the demand amount, method, and structure match the OSINT-034 ransom/negotiation environment baseline? | [OPEN/ANSWERED] |
| PIR-6 - Secondary/tertiary targeting indicators | Any indication other family members, principals, or sites are at elevated risk during the case | [OPEN/ANSWERED] |
12. Phase 9 - Resolution and Reintegration
Entry criteria: recovery, release, or law-enforcement resolution of the case. Exit criteria: medical clearance complete, evidence handoff receipted, AAR scheduled, reintegration support plan in place.
- Release logistics. Recovery or handover is coordinated with law enforcement; the detail does not self-recover. Secure transport moves the principal/family member directly to [MEDICAL FACILITY] per the region package medical annex.
- Medical check. Immediate physical and psychological evaluation per the EP-030 Protective Medicine Plan, before any debrief content is taken beyond what is medically necessary.
- Debrief. A factual, non-leading debrief of the principal and family, coordinated with counsel and law enforcement to preserve evidentiary value; content and timing follow counsel’s direction where the case remains under investigation.
- After-action report. A full incident AAR runs per EP-017 within [X] days: chronology, decision review against Section 6, and corrective actions fed back to this runbook, to EP-025, and to the EP-029 rehearsal cycle.
- Law-enforcement evidence handoff. The Section 4 evidence-preservation record and the Section 8 communications log transfer formally to law enforcement and counsel, with a signed receipt entered in the case log.
- Reintegration. Extended psychological support for the principal and family, and a security-posture reassessment (informed by an updated OSINT-034 re-verification) before any return to prior routine.
13. Phase Gate Summary
| Phase | Entry Criteria | Exit Criteria |
|---|---|---|
| 1 - Activation | EP-025 3.7 hostile-indicator branch, or standalone indicator | Level 2 declared and Phase 2 activated, or principal recovered and this runbook stands down |
| 2 - Immediate Actions | Level 1 declared | Lockdown, evidence log, comms discipline, and answering protocol all live |
| 3 - CMT Stand-Up | Level 1 declared | Full roster staffed; Section 6 matrix read into the log |
| 4 - Notifications | Level 1 declared | All applicable notifications logged with confirmation |
| 5 - Response-Consultant Integration | Insurer and consultant notified | Consultant is the sole negotiation point; firm role converted to support |
| 6 - Proof-of-Life | Any custody claim received | Claim verified or assessed unverified, and logged |
| 7 - Family Communication | CMT stood up | Briefing cadence running without exception |
| 8 - Intelligence Support | CMT stood up | Continuous; timeline complete for handoff |
| 9 - Resolution and Reintegration | Recovery, release, or LE resolution | Medical clearance, evidence handoff, AAR scheduled, reintegration plan in place |
14. Preparedness Annex (Pre-Engagement Requirement)
This section is not a phase of an active case; it is the gate that must be satisfied before any engagement in an AO the OSINT-034 K&R Risk Assessment rates ELEVATED or above. A runbook rehearsed for the first time during an actual case has already failed.
| Requirement | Status | Owner |
|---|---|---|
| Current OSINT-034 K&R Risk Assessment on file, re-verified within its stated perishability window | [CONFIRMED / GAP] | [OWNER] |
| K&R policy notification deadlines and disclosure clauses on file (Section 7 table populated with actual figures, not placeholders) | [CONFIRMED / GAP] | [OWNER] |
| Proof-of-life question bank staged in EP-001 and refreshed on [cadence] | [CONFIRMED / GAP] | [OWNER] |
| Interim single-spokesperson designated for the gap before consultant arrival | [CONFIRMED / GAP] | [OWNER] |
| This runbook rehearsed per EP-029 (minimum: tabletop; full CMT stand-up drill at [cadence]) | [CONFIRMED / GAP] | [OWNER] |
| CMT roster current with 24/7 reachability confirmed for RF, BR, CS, and named client-side and external roles | [CONFIRMED / GAP] | [OWNER] |
| Region package Annex D (law enforcement liaison) and Annex H (legal and regulatory) current within their review cadence | [CONFIRMED / GAP] | [OWNER] |
- Gate: engagement does not commence in an ELEVATED-or-above K&R AO until every row above reads CONFIRMED; any GAP is escalated to the client and the CMT Team Lead before mobilization.
END OF REPORT
Model wiring
Generated from cell frontmatter at publish time.