a

GAO

United States Government Accountability Office

Report to the Ranking Minority Member, 

Committee on Homeland Security and 

Governmental Affairs, U.S. Senate

July 2005 U.S. POSTAL 

SERVICE

Guidance on 

Suspicious Mail Needs 

Further Refinement

GAO-05-716
What GAO Found

United States Government Accountability Office

Why GAO Did This Study

Highlights

Accountability Integrity Reliability

www.gao.gov/cgi-bin/getrpt?GAO-05-716.

To view the full product, including the scope 

and methodology, click on the link above. 

For more information, contact Katherine 

Siggerud at (202) 512-2834 or 

siggerudk@gao.gov. 

Highlights of GAO-05-716, a report to the 

Ranking Minority Member, Committee on 

Homeland Security and Governmental 

Affairs, U.S. Senate 

July 2005

U.S. POSTAL SERVICE

Guidance on Suspicious Mail Needs 

Further Refinement 

Postal Service personnel identified the envelope in question as suspect and 

took some initial actions in response, such as moving it to a room away from 

employees. However, personnel did not speak with postal inspectors or 

emergency responders about the envelope until 12 hours after its discovery. 

Subsequently, a multiagency response took place. Key efforts included 

testing of the envelope and its contents, monitoring the health of employees 

and the public, sampling the facility for contamination, and communicating 

information to employees and unions. 

At the time of the 2003 incident, the Postal Service had in place several 

guidelines on identifying and responding to suspicious mail—which 

emphasized steps to take, such as not moving an identified envelope or 

package, to protect employees. However, during the response, postal 

personnel did not fully follow this guidance, and a lack of consistency and 

clarity in the guidance may have been a contributing factor. For example, 

the instructions in the suspicious mail guidelines were not consistent, and it 

was not clear whether one guideline applied to nonanthrax scenarios. In 

addition, the Postal Service had some guidance on communicating with 

employees and unions regarding suspicious mail incidents, and its efforts to 

inform them about this incident generally followed this guidance. However, 

a lack of specific instructions on who should provide and receive 

information and when may have contributed to some communications issues 

that arose. 

Since the incident, the Postal Service has made a number of changes in its 

guidance that have improved its consistency and clarity. For example, it 

issued new, simpler uniform guidelines on identifying and responding to 

suspicious mail and has emphasized these guidelines in monthly talks to 

employees. However, current guidance does not fully address issues raised 

by the incident because some key elements are lacking. For example, 

training for managers does not present all the guidance they may need to 

decide whether a piece of mail is indeed suspicious and response actions are 

warranted. Also, the Postal Service has not provided managers with explicit 

guidance on communicating with employees and unions regarding 

suspicious mail incidents. Such guidance is important to ensure that 

employees and unions are kept informed, particularly when a mail piece is 

suspected of posing a biological or chemical threat and is sent for testing. 

Message on envelope and vial found inside 

Sources: GAO (left graphic) and FBI (right photograph).

caution RICIN POISON

Enclosed in sealed container

Do not open without proper protection

The envelope had a warning message typed on the outside. Inside was a sealed vial containing a 

substance that tested positive for ricin.

In October 2003, an envelope 

marked “Caution: Ricin Poison” 

was discovered at an airmail 

facility in Greenville, South 

Carolina. Ricin is a poison that, in 

certain forms, can cause death. 

The U.S. Postal Service has 

emphasized to its employees to be 

on the alert for “suspicious mail” 

that may pose a threat and has 

developed guidance for them on 

how to identify and respond to 

such mail, in order to protect them 

from harm. Postal inspectors and 

emergency responders help in the 

responses to suspicious mail by 

performing an initial assessment of 

the threat it poses. 

This report describes (1) actions 

taken by various agencies, in 

responding to the incident, to 

protect the health of postal 

employees and the public; (2) 

Postal Service guidance related to 

suspicious mail in place in October 

2003 and the extent to which it was 

followed during the incident; and 

(3) subsequent changes made in 

this guidance and the extent to 

which current guidance addresses 

issues raised by the incident. 

What GAO Recommends

GAO is making recommendations 

to further improve the Postal 

Service’s guidance related to 

suspicious mail, to help ensure that 

postal personnel are prepared to 

respond to future incidents. The 

Postal Service indicated that it 

generally agreed with these 

recommendations and will take 

action on them. 
Page i GAO-05-716 U.S. Postal Service

Contents

Letter 1

Results in Brief 3

Background 6

USPS, the State Health Department, and CDC Took Actions to 

Protect the Health of Employees and the Public 8

USPS Guidance Was Inconsistent and Unclear, and Response Did 

Not Fully Follow This Guidance 18

USPS Has Made a Number of Improvements in its Suspicious Mail 

Guidance, but Some Key Elements Are Lacking 32

Conclusions 47

Recommendations for Executive Action 48

Agency Comments and Our Evaluation 49

Appendixes

Appendix I: Scope and Methodology 52

Appendix II: Comments from the U.S. Postal Service 55

Appendix III: Contact and Staff Acknowledgments 58

Related GAO Products 59

Tables Table 1: USPS Facilities 6

Table 2: Key USPS Guidance in Place on October 15, 2003 on 

Identifying and Initially Responding to Suspicious Mail 19

Table 3: Extent to Which Initial Response Actions Were in 

Accordance with Suspicious Mail Guidance and 

Procedures for Handling Mail Containing Hazardous 

Materials 26

Table 4: Key USPS Guidance on Identifying and Responding to 

Suspicious Mail Developed or Issued After October 2003 

Incident 34

Figures Figure 1: October 2003 Timeline of Greenville Incident 10

Figure 2: Message on the Envelope 11

Figure 3: Photo of the Sealed Vial Found Inside the Envelope 14

Figure 4: Comparison of Instructions in Suspicious Mail 

Guidance 22

Figure 5: USPS Three Ps Poster 36
Contents

Page ii GAO-05-716 U.S. Postal Service

Abbreviations

Three Ps Package, People, and Plan

CDC Centers for Disease Control and Prevention

DHS Department of Homeland Security

FBI Federal Bureau of Investigation

IEMP Integrated Emergency Management Plan

JTTF Joint Terrorism Task Force

SLAP Shape, Look, Address, and Packaging

USPS United States Postal Service

This is a work of the U.S. government and is not subject to copyright protection in the 

United States. It may be reproduced and distributed in its entirety without further 

permission from GAO. However, because this work may contain copyrighted images or 

other material, permission from the copyright holder may be necessary if you wish to 

reproduce this material separately.
Page 1 GAO-05-716 U.S. Postal Service

United States Government Accountability Office

Washington, D.C. 20548

A

July 19, 2005 Letr

The Honorable Joseph I. Lieberman

Ranking Minority Member

Committee on Homeland Security and Governmental Affairs

United States Senate

Dear Senator Lieberman:

In fall 2001, five persons died from inhalation anthrax contracted from 

contaminated letters delivered through the U.S. mail system.1

 After the 

anthrax attacks, the frequency of incidents involving suspicious packages 

or powder spills increased dramatically, due partly to anthrax hoaxes as 

well as concerns over leakages from mail that had previously been handled 

routinely. Since October 2001, over 16,000 such incidents have occurred at 

postal facilities. These incidents have posed a challenge to the U. S. Postal 

Service (USPS) as well as to law enforcement and public health agencies at 

all levels of government. The Postal Service has emphasized to its 

employees to be on the alert for “suspicious mail” that may pose a threat 

and has developed guidance for them on how to identify and respond to 

such mail, in order to protect them and the public from potential harm. 

Suspicious mail consists of envelopes or packages that have characteristics 

that indicate they may have dangerous contents, such as a bomb, a 

radiological substance, or a biological or chemical agent.2

 The Postal 

Service has made a commitment to continuously improve its processes 

related to anthrax and other biohazards, including its guidance for 

identifying and responding to suspicious mail. 

In October 2003, an envelope marked “Caution: Ricin Poison” was 

discovered at an airmail facility in Greenville, South Carolina. Ricin is a 

biotoxin derived from castor beans that, in certain forms, can cause death 

1

We have issued a number of reports on the response to these incidents. See, for example, 

GAO,U.S. Postal Service: Better Guidance Is Needed to Ensure an Appropriate Response to 

Anthrax Contamination, GAO-04-239 (Washington, D.C.: Sept. 9, 2004); U.S. Postal Service: 

Better Guidance Is Needed to Improve Communication Should Anthrax Contamination 

Occur in the Future, GAO-03-316 (Washington, D.C.: Apr. 7, 2003); and Bioterrorism: Public 

Health Response to Anthrax Incidents of 2001, GAO-04-152 (Washington, D.C.: Oct. 15, 

2003).

2

Biological agents are microorganisms capable of causing disease or toxins derived from a 

living organism. Chemical agents are poisonous vapors, aerosols, liquids, or solids that have 

toxic effects. 
Page 2 GAO-05-716 U.S. Postal Service

within 36 to 72 hours after exposure. Agencies involved in responding to 

the October 2003 incident included the Postal Service, the South Carolina 

Department of Health and Environmental Control, the Centers for Disease 

Control and Prevention (CDC), the Department of Homeland Security 

(DHS), and the Federal Bureau of Investigation (FBI). In November 2003, 

an envelope containing a substance initially suspected of being ricin was 

discovered at a White House mail processing facility.3

Citing concerns about the responses to the October and November 2003 

incidents, particularly the timing of response actions, you asked us to 

examine these responses. As agreed with your staff, we plan to issue a 

separate report on the November 2003 incident later this year. To provide 

you with information on the response to the October 2003 incident, we 

focused on the following questions:

• In responding to the incident, what actions did the Postal Service, CDC, 

and other agencies take to protect the health of postal employees and 

the public, and when did they take these actions?

• During the incident, what Postal Service guidance for identifying and 

responding to suspicious mail was in place, and to what extent were 

actions by postal personnel in accordance with this guidance? 

• What changes has the Postal Service made in this guidance since the 

incident, and to what extent does current guidance address issues raised 

by the incident?

To address these questions, we interviewed federal and state officials 

involved in the response to this incident and obtained and reviewed agency 

documents to determine the roles and response actions of the agencies 

involved. We also analyzed Postal Service guidance in place at the time that 

was related to suspicious mail, including guidance on identifying 

suspicious mail and taking initial response actions; procedures for 

identifying, handling, and responding to hazardous materials in the mail; 

and Postal Service guidance on communicating with employees and unions 

that could pertain to suspicious mail incidents. We compared actions taken 

by postal personnel during the incident with this guidance. We also 

interviewed union officials representing workers at the Greenville airmail 

3

In addition, in February 2004, a powder identified as ricin was discovered in a Senate office 

building mailroom. 
Page 3 GAO-05-716 U.S. Postal Service

facility to obtain their perspective on response actions by postal personnel. 

In analyzing whether actions taken by postal personnel were in accordance 

with existing guidance, we focused on actions taken from the initial 

discovery of the envelope until its removal from the facility, except for 

communications with employees and unions, which we covered until final 

testing results on the envelope and its contents were available. We 

reviewed current and planned Postal Service guidance related to 

suspicious mail and compared it with guidance in place during the incident 

to identify changes and the extent to which current guidance addresses 

issues raised by the incident. To assist in this analysis, we reviewed 

previous GAO work regarding the anthrax incidents, pertinent literature 

and previous GAO work on risk management and risk communications, 

and guidance produced by CDC, the General Services Administration, and 

others on mail security and responding to biological threats in the mail. We 

performed our work from June 2004 through May 2005 in accordance with 

generally accepted government auditing standards. Further details about 

our scope and methodology appear in appendix I. 

Results in Brief The Postal Service and other agencies took a number of actions to protect 

the health of postal employees and the public after the envelope in question 

was discovered at the airmail facility in Greenville on October 15, 2003. 

Postal personnel identified the envelope as suspect shortly after midnight 

and took some initial actions in response, including moving it to a room 

away from employees and double-bagging it. The manager of the facility 

called postal inspectors, who are responsible for initially assessing the 

threat posed by suspicious mail, after arriving at work the following 

morning, but did not speak with an inspector until about 12 hours after the 

envelope had been discovered. The manager called emergency responders 

shortly thereafter based on the inspector’s advice. Law enforcement 

officers conducted a threat assessment, and then immediately transported 

the bagged envelope to a law enforcement laboratory for further 

assessment. This assessment revealed that a metal vial was inside the 

envelope. On the morning of October 16, a laboratory of the South Carolina 

health department received the envelope and vial for testing. This 

laboratory determined that the risk of exposure was low because the vial 

was well-sealed, and it conducted some initial tests of the substance inside 

the vial. However, the laboratory did not have the capability to test for ricin 

at that time and agreed with CDC to send a sample to CDC for testing on 

the following Monday, October 20, so that the sample would not arrive 

during the weekend. CDC received the sample on October 21 and, on that 

same day, performed tests for ricin and determined that ricin was present 
Page 4 GAO-05-716 U.S. Postal Service

in the substance. Subsequently, various federal and state agencies 

cooperated in developing and implementing the response, which included 

monitoring the health of employees and the public, sampling the facility, 

and communicating information to employees and unions. Samples taken 

at the facility tested negative for ricin, and the public health response 

ended on October 29, with no confirmed cases of ricin exposure. 

In October 2003, the Postal Service had in place several guidelines on

identifying and responding to suspicious mail, but postal personnel did not 

fully follow this guidance during the initial response to the discovery of the 

envelope. A lack of consistency and clarity in this guidance, as well as a 

lack of clarity in some related procedures, may have been a contributing 

factor for their actions. For example, the instructions in the suspicious mail 

guidelines were not consistent, and the types of situations they applied to 

may not have been clear to employees. In addition, the Postal Service had 

related procedures for identifying and handling routine mail containing 

hazardous materials that cited some characteristics to identify this type of 

mail that were similar to characteristics of suspicious mail. During the 

incident, although the envelope had some characteristics of suspicious 

mail, personnel initially followed the procedures for handling mail 

containing hazardous material because such mail typically has warning 

labels and the message on the envelope appeared to constitute such a 

warning label. However, these hazardous material procedures do not 

instruct postal personnel to take some precautions, such as not handling 

the mail piece and calling postal inspectors first in all instances, which are 

recommended in the suspicious mail guidance and are designed to protect 

employees. In October 2003, the Postal Service also had some guidance in 

place on communicating with employees and unions regarding suspicious 

mail incidents and its efforts to inform them about this incident generally 

followed this guidance. However, a lack of specific instructions in this 

guidance—on who should provide and receive information and when 

information should be provided—may have contributed to some 

communications issues that arose. For example, union officials cited 

concerns that local unions were not notified until 7 days after the discovery 

of the envelope, after testing results were available. 

Since the incident in Greenville in October 2003, USPS has made a number 

of changes in its guidance on identifying and responding to suspicious mail 

that have improved its consistency and clarity, therefore addressing some 

of the issues raised by the incident. For example, the Postal Service has 

sought to clarify the process for identifying and responding to suspicious 

mail and raise employee awareness of this process by developing and 
Page 5 GAO-05-716 U.S. Postal Service

issuing new simpler and standardized guidance. A main goal of this effort 

has been to ensure that employees are protected from possible biological 

and chemical threats in the mail. However, current guidance does not fully 

address issues raised by the incident because some key elements are 

lacking. In particular, the Postal Service has not provided guidance to 

employees on actions to take if a mail piece has characteristics of both 

suspicious mail and mail containing hazardous material. It has also not 

provided training for managers and supervisors on suspicious mail that 

presents all the guidance they may need to make appropriate decisions. 

Without this additional guidance, postal personnel may have difficulty in 

some cases, as occurred in the Greenville incident, in deciding whether a 

mail piece is suspicious and whether response actions, such as shutting 

down equipment and calling postal inspectors, are warranted. 

Furthermore, the Postal Service has not provided explicit guidance to its 

managers on communicating with employees and unions regarding 

suspicious mail incidents. Such communications are particularly important 

in instances in which mail suspected of containing a biological or chemical 

agent is sent for testing. Without such guidance, employees and unions may 

not receive timely information regarding the situation and may not feel 

confident that they have been adequately informed. 

We are making several recommendations to further improve the Postal 

Service’s guidance related to suspicious mail, to help ensure that postal 

personnel are prepared to respond to future incidents involving mail that 

may contain biological or chemical agents. Specifically, we are 

recommending that the Postal Service (1) provide guidance to employees 

on the response actions to take in the event a mail piece has characteristics 

of both suspicious mail and mail containing hazardous material, (2) expand 

its training for managers and supervisors on suspicious mail, and (3) 

provide more explicit guidance to managers on communicating with 

employees and unions regarding incidents in which a mail piece is sent for 

testing.

We requested comments on a draft of this report from the Postal Service, 

CDC, DHS, the FBI, and the two postal unions that represent employees of 

the Greenville airmail facility (the American Postal Workers Union and the 

National Postal Mail Handlers Union). The Postal Service provided written 

comments generally agreeing with our recommendations and said that, in 

response, it intends to implement a number of improvements in its 

suspicious mail guidance, including expanded training for employees. 

These comments are reprinted in appendix II. The Postal Service also 

provided some technical comments, which we incorporated. The FBI 
Page 6 GAO-05-716 U.S. Postal Service

provided technical comments, which we incorporated. DHS, CDC, and the 

postal unions did not provide comments on the draft. 

Background Ricin is a poison derived from the beans of the castor plant.4

 Exposure to 

ricin in high enough doses can cause organ failure and death. Initial 

symptoms may develop within 8 hours of exposure. There is currently no 

approved treatment or cure, such as an antidote, for ricin exposure in 

humans. However, the symptoms can be managed with medical 

intervention, such as respiratory support, if they are recognized early and 

the dose is not lethal.

The Greenville, South Carolina-airmail facility where the envelope marked 

“ricin” was discovered in October 2003 is part of the national postal 

network of USPS. This network includes thousands of facilities across the 

United States that process and distribute mail, as shown in table 1. USPS 

processes and distributes over 200 billion pieces of mail annually.

Table 1: USPS Facilities

Source: USPS.

4

Ricin is considered to be a biological agent because it is derived from a plant, but also a 

chemical agent because it is a toxin that causes cell death and symptoms similar to those 

caused by chemical agents. Ricin appears on CDC's select agent list. CDC worked with 

representatives of several countries, U.S. intelligence officials, and safety professionals to 

establish this list of 42 viruses, bacteria, toxins, and other agents considered to have the 

potential to pose a severe threat to public health and safety.

Facility type Number Description

Processing and 

Distribution Centers and 

Facilities

348 Process and dispatch incoming and outgoing mail 

for a designated service area

Airmail Centers and 

Facilities

78 Receive, distribute, and dispatch mail transported 

principally by air

Bulk Mail Centers 21 Process and distribute bulk standard mail and 

parcels 

Priority Mail Processing 

Centers

12 Process priority mail

Post Offices, Stations, 

and Branches

37,159 Collect, distribute, and deliver mail
Page 7 GAO-05-716 U.S. Postal Service

The Postal Inspection Service (Inspection Service) provides for the 

security of the mail and the enforcement of federal postal laws. The service 

employs approximately 1,900 fact-finding and investigative postal 

inspectors and 950 uniformed postal police officers. In the years since the 

anthrax attacks, the service—along with USPS as a whole—has faced the 

challenge of responding to a large increase in suspicious mail incidents that 

have caused disruptions of postal operations. In fiscal year 2002, when the 

Inspection Service began systematically collecting statistics on suspicious 

mail incidents, about 13,500 such incidents occurred at postal facilities. 

Subsequently, the number of such incidents significantly declined, to about 

800 in fiscal year 2003 and 1,500 in fiscal year 2004. According to postal 

officials, these incidents have often involved leakages of routine 

substances, such as sand or talcum powder, from mail pieces.

Since the anthrax attacks in the fall of 2001, the Postal Service has made a 

number of efforts to manage risks posed to the mail system by biological 

and chemical agents, such as anthrax and ricin.5

 A main effort has been 

developing additional guidelines for employees on identifying and 

responding to suspicious mail, including mail that may pose a biological or 

chemical threat. Other main efforts include 

• developing an “all-hazards” emergency response plan for managing 

natural and man-made emergencies;

• installing biohazard detection systems at some processing facilities and 

developing and implementing related procedures and training of 

personnel;6

 and

• creating an Emergency Preparedness Office and deploying emergency 

managers at some USPS facilities.

When an incident involving suspicious mail occurs at a USPS postal facility, 

personnel at the affected facility may contact postal inspectors, local 

police, and local fire department hazardous materials units for assistance. 

5

GAO has designated risk management as an emerging challenge for the federal government. 

See GAO, High-Risk Series: An Update, GAO-05-207 (Washington, D.C.: January 2005) and 

21st Century Challenges: Reexamining the Base of the Federal Government, GAO-05-325SP

(Washington, D.C.: February 2005).

6

Biohazard detection systems are automated detection systems that analyze air samples 

collected as mail moves through processing machines.
Page 8 GAO-05-716 U.S. Postal Service

In addition, depending on the circumstances and severity of the incident, 

state and local health authorities, the FBI, and CDC might become 

involved. These local, state, and federal entities each conduct activities 

according to their function, such as threat assessments and criminal 

investigations, testing to identify unknown biological substances, and 

health surveillance of potentially exposed persons. In certain 

circumstances, such as when more than one federal agency is involved in 

the response, DHS becomes involved and coordinates the federal response.

USPS, the State Health 

Department, and CDC 

Took Actions to 

Protect the Health of 

Employees and the 

Public

Following the discovery at the Greenville airmail facility of the envelope 

marked “Caution: Ricin Poison” shortly after midnight on October 15, 2003, 

the Postal Service and other agencies took a number of response actions to 

protect the health of postal employees and the public. (See fig. 1.) Postal 

personnel took some initial actions, including isolating the envelope in a 

room away from employees, double-bagging it, and calling the Inspection 

Service. However, the facility manager did not speak with an inspector until 

about noon on that day, and called emergency responders shortly after, 

based on the inspector’s advice. Local law enforcement and fire 

department personnel responded, along with members of an FBI joint 

terrorism task force (JTTF) and a postal inspector.7

 A threat assessment 

was conducted and the bagged envelope was then immediately transported 

to a law enforcement laboratory for further assessment. This assessment 

revealed that a metal vial was inside the envelope. On the morning of 

October 16, a laboratory of the South Carolina health department received 

the envelope and vial for testing. This laboratory determined that the risk 

of exposure was low, because the vial was well-sealed, and conducted 

some initial tests of the substance inside the vial. However, the laboratory 

did not have the capability to test for ricin at that time and agreed with 

CDC to send a sample to them for testing on Monday, October 20, so that 

the sample would not arrive during the weekend. CDC received the sample 

on October 21 and, on that day, confirmed that ricin was present in the 

substance. Subsequently, various federal agencies, as well as the state 

health department, coordinated in developing and implementing the 

response. CDC conducted sampling at the facility and found no evidence of 

ricin contamination. The state health department and CDC monitored the 

health of employees and the public and found no cases of ricin exposure. 

7

Joint terrorism task forces, under the leadership of the FBI, are comprised of local, state, 

and federal officers and agents, and are responsible for responding to suspected acts of 

terrorism.
Page 9 GAO-05-716 U.S. Postal Service

Finally, the facility manager briefed employees on the incident on October 

15 and Postal Service headquarters prepared talks on the testing results, 

which were delivered to employees and unions on October 22 and 23. 
Page 10 GAO-05-716 U.S. Postal Service

Figure 1: October 2003 Timeline of Greenville Incident 

a

The envelope had previously been double-bagged by postal personnel.

Sunday

12 13 14 15 16 17 18

19 20 21 22 23 24 25

26 27 28 29 30 31

Monday Tuesday Wednesday Thursday Friday Saturday

State lab finishes its 

testing and sends 

sample of the 

substance to CDC.

Afternoon:

Conference calls held 

among CDC, DHS, FBI, 

and USPS. Mail 

processing stops. State 

health officials talk to 

employees to check for 

symptoms and answer 

questions. USPS gives 

a talk to Greenville 

employees with CDC, 

FBI, Inspection Service, 

and state health officials 

present.

Evening:

USPS issues 

information to all 

employees on the 

incident.

Early Morning:

CDC collects

samples from the 

facility.

Afternoon:

CDC reports that all 

samples tested 

negative for ricin.

Evening:

USPS announces to 

employees that the 

sampling of the facility 

is negative for ricin.

Midnight:

Employee finds 

envelope at the facility.

Noon:

Manager speaks with 

postal inspector about 

the envelope and then 

calls emergency 

responders. 

Early Afternoon:

Local police and fire 

department arrives along 

with FBI JTTF and a 

postal inspector. 

Envelope is immediately 

taken to a law 

enforcement lab.a

 

Employees are informed 

about the incident as 

they report to work.

Morning:

State health department 

lab receives the 

envelope for testing and 

determines that there is 

a low risk of exposure 

because the vial inside 

of the envelope is wellsealed. Lab could not 

test for ricin at that time 

but begins testing of 

substance inside the 

vial for a number of 

other agents. 

Preliminary test results 

are shared with CDC.

State lab agrees with 

CDC to send a sample 

of the substance to CDC 

for ricin testing on 

Monday.

October

Afternoon:

Facility returns to 

normal operations. 

State and local public 

health officials continue 

active surveillance of 

local hospitals for 

symptoms of ricin 

exposure, with 

assistance from CDC.

Public health response 

ends with no reported 

cases of ricin 

poisoning.

2003

Morning:

CDC receives sample 

of the substance and 

conducts tests for ricin.

Afternoon:

Results of the test 

indicate the presence of 

ricin toxin.

Late Afternoon: 

Conference calls held 

among CDC, DHS, FBI, 

the state lab, and 

USPS. State public 

health officials alerted 

area hospitals to be on 

the lookout for potential 

ricin exposures.

Source: GAO analysis of USPS, Inspection Service, FBI, South Carolina Department of Health and Environmental Control, CDC,

and DHS data.
Page 11 GAO-05-716 U.S. Postal Service

USPS Personnel Discovered 

and Initially Responded to 

the Suspicious Envelope on 

October 15 

About 12:15 a.m., on October 15, 2003, an employee at a postal airmail 

facility in Greenville, South Carolina, discovered a standard business size 

envelope, measuring 4 inches by 9 inches, on a mail processing machine. 

The employee noticed that the envelope bore only a written warning on the 

outside of the envelope and had no postage, addressee or zip code, or 

return address. (See fig. 2.)

Figure 2: Message on the Envelope 

Note: GAO re-created the original photo provided by the FBI in order to optimize the appearance of the 

image.

The employee removed the envelope from the mail processing machine, set 

the envelope aside on a tray and finished processing the bundle of mail that 

had accompanied the envelope. Within 10 minutes after discovering the 

envelope, the employee took the tray containing the envelope to the shift 

supervisor who was at the supervisory console, which was situated 

between 30 and 40 feet away from the employee’s workstation. 

Being cautious and a bit uncertain, the supervisor had the area cordoned 

off with orange cones and tape, and decided to evacuate the facility. At 

12:30 a.m., he instructed the 20 employees in the building to evacuate the 

facility and called the facility manager at home around 12:40 a.m. During 

the phone call, the facility manager asked the shift supervisor if the 

envelope was damaged, showed visible signs of leakage, and whether 

suspicious odors were present. The shift supervisor told the manager that 

the envelope did not exhibit any of these characteristics. According to the 

facility manager, the supervisor instructed the employee who had 

discovered the envelope to wash her hands. 

The facility manager told us that, at the outset, nobody knew exactly what 

ricin was and, during the telephone conversation, the shift supervisor 

suggested that it might be rat poison. At the instruction of the facility 

manager, the tray containing the envelope was removed from the 

workroom and put into the conference room next to the facility manager’s 

office. Shortly thereafter, the evacuation was called off and employees 

Source: GAO graphic based on an FBI photo.

caution RICIN POISON

Enclosed in sealed container

Do not open without proper protection
Page 12 GAO-05-716 U.S. Postal Service

returned to work until the shift ended at approximately 4:30 a.m. that 

morning. 

The Inspection Service and 

Emergency Responders 

Became Involved 12 Hours 

after the Discovery

About 7 hours after the envelope was first discovered, at around 7:30 a.m., 

the facility manager arrived at the facility. He inspected the envelope about 

8:00 a.m. At around 8:10 a.m., he called the local safety officer, who advised 

him to contact the Inspection Service.8

 The safety officer also called the 

postal service team responsible for responding to spills and leaks from a 

nearby larger facility and asked them to report to the facility. At 

approximately 9:00 a.m., this team arrived at the facility. Wearing protective 

gear, the team retrieved the envelope from the conference room, doublebagged it, and moved it to a secure room across the hall. The team then 

locked the door and placed “Do Not Enter” signs on the front. 

Between 9:00 a.m. and noon, the facility manager placed a total of three 

calls to the Inspection Service, including two calls to the office in 

Greenville and one to the office in Charlotte, North Carolina. The facility 

manager made the first call about 9:00 a.m. to the Inspection Service office 

in Greenville. The inspector at the time was out responding to a robbery 

investigation, so the facility manager left a message. Later that morning, at 

11:00 a.m., the facility manager placed another call to the Inspection 

Service, this time to the Charlotte office. Again, he was not able to reach an 

inspector, but instead left a message that a suspicious mail piece had been 

discovered in Greenville. According to the inspectors from Charlotte and 

Greenville, neither of these two messages indicated that the situation was 

urgent. According to the facility manager, he stated in his messages what 

was written on the envelope but probably mispronounced the word “ricin.” 

At noon, about 12 hours after the envelope had been first discovered, the 

facility manager made another call to the Inspection Service office in 

Greenville. This time he spoke with an inspector, who advised him to call 

emergency responders. He did so, and at approximately 1:00 p.m., these 

responders, members of local law enforcement and the hazardous 

materials unit of the fire department, arrived at the facility. At 1:20 p.m. the 

fire department evacuated the building. 

8

USPS safety officers are responsible for monitoring and assessing safety hazards and 

potentially unsafe conditions, among other things.
Page 13 GAO-05-716 U.S. Postal Service

At 1:50 p.m., an FBI agent and a county law enforcement officer, members 

of the FBI’s Joint Terrorism Task Force in the Greenville area, responded to 

the incident.9

 An inspector from the Greenville Inspection Service office 

arrived at about the same time. Law enforcement officials conducted a 

threat assessment, removed the bagged envelope from the facility, and 

immediately transported it to a law enforcement laboratory for further 

assessment. This assessment revealed that the envelope contained a metal 

vial and a threatening letter addressed to the Department of 

Transportation.10 (See fig. 3.)

9

According to FBI officials, they were notified about the envelope by the U.S. Coast Guard’s 

National Response Center. This center has agreements with various federal entities to make 

notifications regarding incidents meeting established criteria. 

10The letter made reference to an April 2003 Department of Transportation regulation that 

increased the required number of hours that commercial truck drivers had to rest in 

between shifts from 8 to 10 hours, starting in January 2004. (68 Fed. Reg. 22456, Apr. 28, 

2003)
Page 14 GAO-05-716 U.S. Postal Service

Figure 3: Photo of the Sealed Vial Found Inside the Envelope

According to the Inspection Service, the following morning inspectors 

began tracking the path that the envelope may have taken before it was 

discovered in the facility. This was done to determine how the envelope 

arrived at the facility, whether it had possibly passed through another 

facility, and whether it had potentially exposed other postal employees or 

the public. However, the Inspection Service concluded that the envelope 

had been discovered before it entered the mail stream because it was not 

postmarked at the time of discovery. 

According to USPS officials in Greenville, the facility manager and shift 

supervisor informed employees of the situation as they reported for the 

next work shift that afternoon. The facility manager told us that this 

information was communicated in a talk that supervisors deliver daily to 

employees and that normally consists of announcements regarding 

Source: FBI.
Page 15 GAO-05-716 U.S. Postal Service

operations. Also, according to the manager, he told employees to let him 

know if they showed any signs of illness, based on the advice of the FBI. 

The manager also told us that, sometime between October 15 and 21, he 

found information on ricin on CDC’s Web site, printed copies of this 

information, and made them available to employees and union 

representatives. He told us that he also shared this information verbally 

with employees. 

Public Health Officials 

Performed Tests from 

October 16 to 21

At approximately 10:00 a.m. on October 16, 2003, South Carolina 

Department of Health and Environmental Control’s public health 

laboratory, part of the CDC’s Laboratory Response Network, received the 

envelope, letter, vial and substance for testing.11 Using a standard “all 

agents” testing approach, the laboratory tested for a number of agents, 

including anthrax, but did not have the capability at that time to perform 

tests for ricin. At this point of the response, CDC was serving as an advisory 

agency to the lab. On Friday, October 17, the state laboratory agreed with 

CDC to send a portion of the substance to CDC in Atlanta to test for ricin 

on the following Monday, October 20, 2003. The state lab completed its 

testing on October 20 and sent a sample of the substance to CDC on that 

date via overnight mail. 

State laboratory officials told us that they did not send a sample of the 

substance to CDC for ricin testing earlier because they believed the risk of 

exposure was low, since the substance was contained in a well-sealed 

metal vial that would prevent any amount of the substance from escaping. 

The sealed nature of this vial led laboratory officials to assume that there 

was time to work with the substance and make a thorough and definitive 

assessment of what it was. The substance itself appeared to be in a form 

that could not easily be dispersed and there had been no reported 

symptoms of exposure to date. Also, CDC had asked the laboratory 

officials to send the sample to them via overnight mail on Monday rather 

than Friday, to ensure that it would be promptly received and tested upon 

arrival. CDC officials explained to us that had the public health threat been 

higher that they would have called up their staff to be present during the 

weekend to receive and test the sample. 

11The Laboratory Response Network is a national network of labs coordinated by CDC to 

respond to biological and chemical terrorism and other public health emergencies. 
Page 16 GAO-05-716 U.S. Postal Service

On October 21, at about 10:20 a.m., about 6 days after the envelope had first 

been discovered, CDC received the sample and began testing. Around 3:45 

p.m., the CDC lab confirmed the presence of ricin toxin in the sample. CDC 

officials explained to us that, although the substance had tested positive for 

ricin, they believed that it posed a low public health risk because it was in a 

form that would be unlikely to affect employees who might have come in 

contact with the envelope. Also, it had been securely contained inside the 

metal vial and there was no sign of leakage. 

Multiple Agencies 

Responded from October 21 

to 29

Following CDC’s testing, various federal and state agencies held 

discussions, through teleconferences, to determine the appropriate 

response. The participants in these interagency teleconferences included 

officials of the Postal Service, the Inspection Service, CDC, DHS, FBI, and 

the South Carolina health department, as well as other South Carolina 

officials.12 The first teleconference was held on October 21, 2003, at about 

5:00 p.m. During this teleconference, USPS told participants that no 

illnesses among employees had been reported. In this teleconference and 

in subsequent ones later that evening and the following day, the 

participants discussed and agreed upon response actions to protect the 

health of postal employees and the public, including monitoring the health 

of facility employees and the public in the area to check for illnesses that 

could indicate ricin poisoning, sampling the facility to determine whether it 

had been contaminated, and communicating with postal employees about 

the situation. CDC officials explained to us that, although they believed that 

the substance that had been in the envelope did not pose a serious public 

health threat, the decisions to monitor the health of postal employees and 

the public and to sample the facility had been made in order to be prudent. 

Mid-afternoon on October 22, the state and local health departments began 

interviewing employees at the Greenville airmail facility to check for 

symptoms of ricin exposure and to answer questions. CDC personnel were 

on hand to assist in this effort. At 3:00 p.m., mail processing at the facility 

stopped and no mail was allowed to leave the premises. At 6:00 p.m., a talk, 

prepared by USPS headquarters with the advice of CDC and the state 

health department, was given to Greenville postal employees informing 

them about the situation. This talk explained that the facility had been 

12The FBI, with assistance from the Inspection Service and South Carolina law enforcement, 

conducted the investigation of this incident. This investigation was outside the scope of our 

review. According to the FBI, this investigation is still ongoing. 
Page 17 GAO-05-716 U.S. Postal Service

closed for testing and that the envelope that had been discovered on 

October 15 had contained a vial with a substance that had tested positive 

for ricin at CDC. This talk also stated that the vial had been well-sealed and 

that there had been no indications of employee exposures connected to the 

incident. 

CDC, the state health department, the FBI, and the Inspection Service 

participated in the talk in Greenville and answered employee questions and 

concerns. Local union representatives were provided with the information 

in the talks prior to their delivery. The information in the Greenville talk 

was provided by USPS headquarters to all employees nationwide that 

evening and the following morning, in a news announcement and a talk for 

delivery to all employees. 

In the early morning hours of October 23, 2003, CDC personnel collected 

swab and vacuum samples from the facility, sending them to CDC for 

analysis at approximately 6:30 a.m. About 3:30 p.m., CDC reported that all 

samples taken from the facility had tested negative for ricin. At 6:00 p.m., a 

talk, prepared by USPS headquarters, was provided to Greenville 

employees informing them of these results and that the facility would 

reopen on Friday, October 24, 2003. This talk emphasized appropriate steps 

to follow when encountering a suspicious package. USPS headquarters 

also provided this information to all employees nationwide in a news 

announcement issued about the same time. On October 24, 2003, the 

facility reopened for operations. 

On October 21, after CDC reported its testing results, state public health 

officials alerted area hospitals, private practice physicians, and the state 

poison control center to be on the lookout for symptoms associated with 

ricin exposure. CDC also checked poison control center records to see if 

any cases that could indicate ricin poisoning had been reported. On 

October 22, state and local health officials, with assistance from CDC, 

interviewed all employees at the Greenville airmail facility to check for 

symptoms of ricin exposure. At that time, they determined that no 

employees had any health complaints that could be reasonably related to 

ricin exposure. In addition, the state health department and CDC 

conducted statewide monitoring for illnesses that could indicate ricin 

exposure and distributed a written description of ricin poisoning to area 

hospitals, emergency rooms and other health-care providers. Medical 

surveillance continued until October 29, 2003, approximately 14 days after 

the envelope was first discovered, with no confirmed cases of ricin 

exposure.
Page 18 GAO-05-716 U.S. Postal Service

USPS Guidance Was 

Inconsistent and 

Unclear, and Response 

Did Not Fully Follow 

This Guidance 

In October 2003, the Postal Service had in place several guidelines on

identifying and responding to suspicious mail but these guidelines were not 

entirely consistent or clear. In addition, the Postal Service had procedures 

for identifying and handling routine mail containing hazardous materials 

that cited some characteristics to identify this type of mail that were similar 

to characteristics of suspicious mail. During the incident, postal personnel 

did not fully follow the suspicious mail guidelines and a contributing factor 

may have been the lack of consistency and clarity in these guidelines, as 

well as a lack of guidance on what to do if a mail piece has characteristics 

of both suspicious mail and mail containing hazardous material. For 

example, personnel initially followed the procedures for handling mail 

containing hazardous material because this type of mail typically has 

warning labels and the message on the envelope appeared to constitute 

such a warning label. However, these procedures do not instruct postal 

personnel to take some precautions, such as not handling the mail piece 

and calling postal inspectors first in all instances, which are recommended 

in the suspicious mail guidance. These precautions are designed to protect 

employees from exposure to possible biological or chemical threats and to 

obtain the early involvement of those with expertise who can assess the 

threat posed by a suspicious mail piece. Finally, the Postal Service had 

guidance on communicating with employees and unions regarding 

suspicious mail incidents. While efforts by the Postal Service to 

communicate with employees and unions about this incident generally 

followed this guidance, a lack of explicit instructions in the guidance on 

providing information to employees and unions may have contributed to 

some communications issues that arose.

USPS Had a Number of 

Guidelines for Identifying 

and Responding to Suspect 

Mail but They Were not 

Consistent or Clear

The Postal Service’s suspicious mail guidelines in October 2003 had been 

developed or updated following the fall 2001 anthrax incidents to ensure 

that postal personnel took appropriate precautions upon discovering a 

suspicious package or envelope. However, these guidelines contained 

instructions that were not entirely consistent. Also, the types of scenarios 

they applied to may not have been entirely clear to employees and some 

appeared to apply only to incidents involving suspicious powders. 

Furthermore, some related procedures for identifying and segregating mail 

containing or that could contain hazardous materials did not clearly specify 

what employees should do if a mail piece identified as possibly containing a 

hazardous material also had characteristics of suspicious mail. Finally, 

USPS had general guidelines regarding communicating with employees and 

unions, but these guidelines did not clearly specify who should provide and 
Page 19 GAO-05-716 U.S. Postal Service

receive information on suspicious mail incidents or when information 

should be provided. According to GAO’s internal control standards, 

appropriate policies and procedures should exist with respect to each 

agency activity. 

Guidelines for Identifying and 

Initially Responding to 

Suspicious Mail

At the time of the incident in Greenville, key Postal Service guidance on 

suspicious mail included two documents— “decision trees” and a poster—

as well as a training exercise. (See table 2.) The decision trees guideline 

and the training exercise were mainly aimed at managers and supervisors, 

while the poster was aimed at all postal employees as well as the public. 

Both the facility manager and shift supervisor had undergone the training 

exercise, which focused on handling incidents involving a questionable 

substance leaking from a mail piece. 

Table 2: Key USPS Guidance in Place on October 15, 2003 on Identifying and Initially Responding to Suspicious Mail 

Source: GAO analysis of USPS suspicious mail guidance.

Note: In addition, in November 2001, USPS issued interim guidelines for responding to an anthrax 

release that covered a range of response activities—including sampling, analysis, and 

decontamination—and also included guidance on the initial response to a suspected incident. 

a

According to USPS officials, its Mail Security Task Force, which includes representatives of employee 

unions and management associations, reviewed these guidelines during their development. 

The guidance documents and training exercise described characteristics 

for employees to look for to detect “suspicious” packages and envelopes 

Type of 

guidance

Intended 

audience

Date issued or 

updated Description 

Guidance documents

Decision trees Managers and 

supervisors

October 2001

Updated in 

March 2003

Presented separate sets of actions to take, in a flowchart format, in incidents 

involving a suspicious unopened/sealed mail piece and in incidents involving an 

open mail piece leaking a suspicious powder. a Also, included different actions for 

small and large facilities to take during either type of incident. Developed based on 

CDC advisories. 

Suspicious mail 

poster

All employees 

and the public

October 2001

Updated in 

March 2003

Portrayed, in a one-page poster with a photo, how to identify a suspicious mail 

piece and key actions to take upon discovery. Also, presented additional separate 

guidance for situations involving a suspected bomb, radiological threat, or 

biological or chemical threat. 

Training

Suspicious 

powder tabletop 

exercise

Managers, 

supervisors, and 

support staff

April 2003 Presented actions to take in incidents involving a suspicious powder leaking from 

a mail piece. Consisted of a series of scenarios portraying phases of a 

hypothetical incident and active exercises in responding to these scenarios. 

Included the decision trees.
Page 20 GAO-05-716 U.S. Postal Service

that could potentially pose a threat, such as a bomb or a biological threat. 

These characteristics included the following:

• Lopsided or uneven.

• Powdery substance on the outside.

• Odors, discoloration, or oily stains.

• Excessive postage or tape.

• No return address.

• Handwritten or poorly typed address.

• Marked with restrictions, such as “Personal,” “Confidential,” or “Do Not 

X-Ray.”

• Threatening message.

However, the suspicious mail characteristics in these guidelines were not 

consistent and none of the guidelines had a complete list of suspicious mail 

characteristics. (See fig. 4.) Some characteristics were cited in only one or 

two of these guidelines. For example, only the decision trees cited 

“threatening message” as a characteristic of suspicious mail and only the 

poster cited excessive tape. Also, the poster and training exercise cited 

restrictive markings as a characteristic of suspicious mail while the 

decision tree did not. 

The guidance documents and training exercise also provided instructions 

on initial steps to take upon discovering a suspicious mail piece. (See fig. 

4.) In general, they advised isolating the mail piece and notifying others 

with expertise in assessing threats associated with mail pieces, such as 

postal inspectors and local law enforcement. Recommended initial steps 

were not consistent, however. The decision trees, intended for use by USPS 

managers and supervisors, advised not handling the mail piece and 

notifying the supervisor and Inspection Service before contacting the local 

police and hazardous materials unit. The poster, intended for use by the 

public as well as postal employees, recommended handling a suspicious 

package or letter with care and calling local law enforcement. The poster 

also advised more precautions if a biological or chemical threat was 

suspected, including not handling the mail piece and calling police, postal 
Page 21 GAO-05-716 U.S. Postal Service

inspectors, and the local hazardous materials unit. The training exercise, 

intended for USPS managers and supervisors, focused on suspicious 

powder incidents and recommended response steps similar to those in the 

decision trees. 
Page 22 GAO-05-716 U.S. Postal Service

Figure 4: Comparison of Instructions in Suspicious Mail Guidance

Note: Shaded boxes indicate that similar information was not found in identified guidance.

a

These are steps for small offices. USPS has separate training for large offices. Also, these represent 

key steps presented in the training that are similar to those in the other guidelines. The training also 

provided more detailed guidance on actions to take in response to a suspicious powder incident.

b

The subsequent steps are for small facilities, unless otherwise noted. The decision tree for large 

facilities included additional response actions for the supervisor.

c

According to a USPS official, the basic intent of the instruction to contact the postmaster is to contact 

the next level of management, which for the Greenville airmail facility would be the senior plant 

manager.

d

The safety office supports management by monitoring and assessing safety hazards and potentially 

unsafe conditions and providing support to spill and leak teams, among other things.

Decision tree for a suspicious Suspicious mail poster

unopened/sealed envelope or

parcel General suspicious mail Mail with a suspected

biological or chemical threat

Suspicious powder tabletop

exercise traininga

Number of suspicious

mail characteristics

9 12 Same 13

Characteristics that

appear only in 

identified guidance

● Loose sifting material

● Threatening message

● Rigid or bulky 

● Excessive tape

● Sealed with tape

Same Postmark does not match

sender’s address

Do not handle further Handle with care

Do not shake or bump

Do not disturb powder

in any way

Do not shake or empty contents Do not open, smell,

touch, or taste

Isolate the package without

further contact

Isolate it immediately Isolate

Don’t handle

Evacuate immediate area Prevent others from entering

Wash hands with soap and water Wash hands with soap

and warm water

Wash hands with soap

and water

Initial response actions

Treat it as suspect

Contact supervisor if availableb Contact supervisor as soon

as possible

Notification of others

Supervisor or employee contacts

in order:

● Inspection Service 

● Local police and hazardous 

material contacts

● Postmasterc

 (who contacts 

district manager)

● Safety officed

Call local law enforcement

authorities

● Call police 

● Contact postal inspectors

● Call local fire department

hazardous materials unit

Supervisor contacts in order:

● Inspection Service

● Local police and hazardous 

material contacts

● Postmaster (who contacts

district manager)

● Safety office

Other response actions Building occupants should remain

in a place of refuge away from

the mail piece and await

emergency responders.

In large facilities, the spill and leak

team examines the scene, attempts

to determine if an emergency exists

and takes defensive actions (tape

off area, shutdown ventilation, etc.).

If facility manager has called

the local responders, then

maintain isolation around the

spill site and place all building

occupants in a place of refuge

away from the spill.

Source: GAO analysis of USPS suspicious mail guidance.

Leave area and prevent others

from entering
Page 23 GAO-05-716 U.S. Postal Service

The types of scenarios these guidelines applied to may not have been 

entirely clear to employees. While the decision trees provided the most 

complete guidance on responding to suspicious mail incidents involving 

nonleaking as well as leaking mail, at the time of the incident the 

circumstances under which they were intended to be used may have been 

unclear. The manager of the Greenville airmail facility told us that, at the 

time of the incident, he thought the decision trees were for anthrax-related 

emergencies only. When the Postal Service first issued this guideline in 

October 2001, it noted that it applied to scenarios involving the potential 

release of anthrax spores as well as “similar bioterrorist incidents.” 

However, the March 2003 version of this guideline was titled “Updated 

Decision Trees for Suspicious Mail Pieces and a Powder Release from a 

Mail Piece” and Postal Service management indicated that it could be used 

in various situations involving a suspicious mail piece.13 Furthermore, 

while the poster recommended more precautionary steps in instances in 

which a biological or chemical threat was suspected, postal officials have 

acknowledged that it could be difficult for employees to determine if a mail 

piece potentially posed such a threat if it was not leaking a substance. 

Finally, the training focused on scenarios involving the discovery of a 

suspicious powder and therefore its applicability to other types of 

scenarios may not have been clear. 

Procedures for Identifying, 

Handling, and Responding to 

Hazardous Materials in the Mail

In addition to the guidelines described above, which were aimed at taking 

precautions against possible threats in the mail, USPS had “hazardous 

material handling” procedures that instructed employees to identify routine 

mail containing hazardous material that is properly packaged and labeled, 

as well as mail that may contain hazardous material and that is not properly 

packaged and labeled, and separate such mail from other mail by moving 

itto another area.14 Among the characteristics that employees are trained to 

look for, to detect mail containing or that may contain hazardous material, 

are warning labels and stains, leakage, or an unusual odor. These 

characteristics are similar to ones employees are told to look for in 

13The version in the April 2003 training exercise was titled “Decision Trees for Anthraxrelated Emergencies.” 

14A hazardous material is any article or substance designated by the U.S. Department of 

Transportation as being capable of posing a risk to health, safety, and property during 

transportation. Most hazardous materials are nonmailable. However, USPS does accept for 

mailing some specified hazardous materials, if properly packaged and labeled according to 

Postal Service requirements and in quantities not large enough to present a serious hazard 

to safety or human health. Examples of such materials are medical samples, pesticides and 

herbicides, propane, and paint. 
Page 24 GAO-05-716 U.S. Postal Service

detecting suspicious mail. However, these hazardous material handling 

procedures do not instruct employees on what to do if an envelope or 

package has characteristics of both suspicious mail and mail containing or 

that may contain hazardous material. 

USPS also had procedures and related guidelines, generally issued prior to 

the anthrax incidents, on responding to the release of hazardous materials, 

including releases of powders or other substances from mail pieces. These 

documents described the role of spill and leak teams, generally located in 

large postal facilities, which are trained to respond to releases and to 

determine whether an emergency exists. The decision trees also indicated 

that, in large facilities, these teams could respond to suspicious mail 

incidents without spills or leaks. The Greenville airmail facility is 

considered to be a small facility, with about 35 employees, but did use the 

spill and leak team from a nearby large plant in this incident. 

In emergency situations, USPS facilities were expected to follow their 

“emergency action plans,” which outline actions to take, such as evacuating 

employees and calling local first responders, in a variety of emergency 

situations. The Greenville emergency action plan included initial actions to 

take in response to a hazardous material release and a suspected anthrax 

release, but not for other types of suspicious mail situations. In a bulletin to 

Postal Service management following the incident, USPS stated that these 

plans must include instructions for responding to suspicious mail pieces, 

including guidance on initial action, isolation, evacuation, and 

notifications.

Guidance on Communicating 

with Employees and Unions 

At the time of the incident, the Postal Service’s suspicious mail guidance 

contained some recommendations regarding communications with 

employees and unions. In an e-mail message accompanying the March 2003 

decision trees, USPS headquarters stated that communications are a vital 

part of the process for responding to suspicious mail and that “employees 

and their representatives must be kept informed at all stages, including the 

final results and resolution of the incident.” Also, the suspicious powder 

training exercise recommended that, in suspicious powder incidents in 

which emergency responders have become involved, management should 

provide unions and employees with current information on the situation on
Page 25 GAO-05-716 U.S. Postal Service

a regular frequency.15 However, this guidance did not specify who is 

authorized to provide information, when information should be provided 

and to whom, and what types of information should be shared. 

In addition, since the late 1990s, postal managers in USPS’s Eastern area, 

which includes South Carolina, have been encouraged to hold brief 

discussions with employees at the beginning of each workday regarding 

workplace performance and business updates. The purpose of this practice 

is to increase communication with employees and, according to postal 

officials, such discussions could include providing information on 

suspicious mail incidents. 

Suspicious Mail Guidance 

Was Not Always Followed 

During the incident, personnel at the Greenville airmail facility followed 

some, but not all, of the steps in the suspicious mail guidance. In particular, 

the envelope was moved several times, employees returned to the work 

area where the envelope had been, and notifications of the Inspection 

Service and emergency responders were not made in the order 

recommended and were delayed. Because the envelope had some 

characteristics of mail containing hazardous material and the personnel did 

not know what ricin was, they also followed hazardous material handling 

procedures. (See table 3.) Greenville postal management explained that, 

since the envelope also had some characteristics of suspicious mail, they 

were uncertain how to respond and were trying to determine the best 

course of action to take. Lack of clarity and consistency in the suspicious 

mail guidance as well as a lack of guidance on what to do if a mail piece has 

characteristics of both suspicious mail and mail containing hazardous 

materials may have contributed to this uncertainty and to the fact that 

some of the steps in the suspicious mail guidance were not followed. Since 

the suspicious mail guidelines take a precautionary approach to protect 

employees from possible threats, including biological and chemical agents, 

15In addition, according to postal officials, general provisions in the Postal Service’s 

collective bargaining agreements with employee unions required it to provide unions with 

information on workplace conditions, including information on suspicious mail incidents. 

These agreements require USPS to make available to the unions all relevant information 

necessary for collective bargaining or the enforcement, administration, or interpretation of 

the agreements, including information necessary to determine whether to file or continue 

the processing of a grievance under the agreement. Under the agreements, employees may 

file a grievance if they believe they are being required to work under unsafe conditions, 

among other reasons.
Page 26 GAO-05-716 U.S. Postal Service

if a mail piece contained such an agent, not following these guidelines 

could result in employees being exposed to the agent. 

Characteristics of the envelope that were consistent with indicators in the 

suspicious mail guidelines were no return address and a message that 

could be considered threatening or restrictive: “Caution: RICIN POISON. 

Enclosed in sealed container. Do not open without proper protection.” In 

addition, the facility manager told us that the lack of an addressee and 

postage raised concerns.16 Furthermore, it was likely that the envelope was 

lopsided, since it contained only the threat letter and a vial the size of a “C” 

battery. However, the message on the envelope, particularly the words 

caution and poison, could also be interpreted as characteristics of mail 

containing hazardous material since this type of mail typically has warning 

labels and poison is a type of hazardous material. 

Table 3: Extent to Which Initial Response Actions Were in Accordance with Suspicious Mail Guidance and Procedures for 

Handling Mail Containing Hazardous Materials

16The Postal Service defines a piece of mail as a single addressed article of mail. However, 

Postal Service officials told us that envelopes or packages without an address that appear 

suspicious should be handled according to suspicious mail guidance. 

Time period Actions taken

Were actions in accordance with 

suspicious mail guidelines?

Were actions in accordance 

with hazardous material 

handling procedures?

12:15 a.m.

to

1:00 a.m.

Employee separated envelope from other mail 

and brought it to her supervisor.

Yes – postera

No – decision treeb

Yes

Supervisor isolated envelope, cordoned off the 

area, and evacuated employees. 

Yesc N/A

Employee instructed to wash hands.d Yes N/A

Based on instructions from the facility manager, 

supervisor moved envelope to a conference 

room. 

No Yes

Based on instructions from the facility manager, 

supervisor allowed employees to return to work 

room. 

No Yes 
Page 27 GAO-05-716 U.S. Postal Service

Source: GAO analysis of actions taken during the response as well as USPS suspicious mail guidance and hazardous material handling 

procedures.

Note: N/A means that the action was not applicable to this type of guidance.

a

The poster indicates that suspicious mail should be handled with care, but that if a biological or 

chemical threat is suspected for the mail piece not to be handled. 

b

The decision tree calls for not handling suspicious mail further. Training is not applicable for this action 

because the training calls for not disturbing a suspicious powder and this incident did not have a 

powder.

c

 The suspicious mail guidelines recommend moving employees to a place of refuge, but do not call for 

evacuating the facility. Supervisor took this action as an extra precaution.

d

 According to the facility manager, the supervisor told the employee to wash her hands.

e

The facility manager contacted the senior plant manager at 11:00 a.m. Although suspicious mail 

guidelines indicate that the postmaster should be contacted, postal officials have told us that the basic 

intent of this instruction is to contact the next level of management, which, for the Greenville airmail 

facility, would be the senior plant manager.

f

However, spill and leak team members have stated that they were told to respond in spite of concerns. 

Also, moving the envelope was not in accordance with suspicious mail guidelines.

According to the facility manager, the employee who discovered the 

envelope perceived it to be mail containing hazardous material, based on 

the words “caution” and “poison” on the envelope. She then took steps that 

followed USPS procedures for handling this type of mail. She prevented the 

envelope from entering the mail stream by removing it from the machine 

she was working on and notified her supervisor of her discovery. The 

employee also segregated the envelope from other mail when she brought 

it to her supervisor, who was located 30 to 40 feet away. Notifying the 

supervisor was in accordance with guidance on responding to suspicious 

mail, but handling and moving the envelope was not in accordance with 

some of this guidance. (Although the decision tree advised not handling a 

suspicious mail piece, the poster stated that suspicious mail should be 

handled with care.) In addition, according to the facility manager, the 

8:00 a.m.

to

12:00 p.m.

Facility manager contacted:

• Safety officer at 8:10 a.m.

• Inspection Service at 9:00 a.m., 11:00 a.m. and 

12:00 p.m. (left two non-urgent messages but 

did not speak with inspector until noon)

• Postmastere

 at 11:00 a.m.

• Local police at 12:00 p.m. (contacted after 

speaking with inspector)

No (did not call in order 

recommended and calls delayed)

N/A

Spill and leak team examined scene at 9:00 

a.m., double-bagged the envelope, put it in a 

separate room, and put “Do Not Enter” signs on 

the doors. 

Yesf N/A

(Continued From Previous Page)

Time period Actions taken

Were actions in accordance with 

suspicious mail guidelines?

Were actions in accordance 

with hazardous material 

handling procedures?
Page 28 GAO-05-716 U.S. Postal Service

employee washed her hands on the advice of the supervisor. This was in 

accordance with suspicious mail guidelines.

The supervisor took actions that were in accordance with suspicious mail 

guidelines. Specifically, the supervisor isolated the envelope and prevented 

other employees from entering the area. He also evacuated the facility as 

an additional precaution. According to the USPS after action report for this 

incident, the supervisor was using knowledge learned during the 

suspicious powder training exercise. According to Greenville postal 

officials, the facility’s emergency action plan, which outlines evacuation 

procedures, was activated at this point. 

The facility manager took some actions that were in accordance with the 

hazardous material handling procedures as well as the suspicious mail 

guidance, but did not fully follow the steps in the suspicious mail guidance. 

While on the phone with the supervisor, the facility manager decided that 

since the envelope was not leaking, employees could be allowed back into 

the building. He explained that, at that point, he did not know what ricin 

was and thought that the envelope could contain hazardous material but 

was not properly labeled, so he had the envelope segregated from other 

mail. Also, because the envelope indicated that a poison was inside, he 

instructed that the envelope be moved to another room, rather than placed 

in the designated area for such mail, as an extra precaution. Once the 

envelope was moved to another room, the employees were allowed to 

return to the facility. These actions were in accordance with the hazardous 

material handling procedures, which included instructions for segregating 

hazardous material mail in an area away from work areas and traffic flows. 

However, suspicious mail guidelines indicated that if something is 

suspicious, employees should be kept in a place of refuge away from the 

mail piece until local emergency responders arrive. Also, moving the mail 

piece was not in accordance with suspicious mail guidelines. The 

suspicious mail procedures take a precautionary approach in order to 

protect employees from unknown threats, therefore, following hazardous 

material handling procedures could unintentionally expose employees to a 

harmful substance if a mail piece actually contained a threat and not 

routine hazardous material.

When the facility manager observed the envelope after he reported to work 

at about 7:30 a.m., he took an action that is not outlined in USPS guidance. 

Because he still did not know what ricin was he consulted a dictionary, 

which provided a brief description (a poisonous protein from the castor 

bean), and then he contacted the local safety officer for further 
Page 29 GAO-05-716 U.S. Postal Service

assistance.17 By doing so, the facility manager did not follow the order of 

notification outlined in the suspicious mail guidance. The guidance 

specifies that the Inspection Service should be notified first and then 

emergency responders. According to the facility manager, he did not want 

to call the Inspection Service or local emergency responders if the situation 

was something that could be handled by facility personnel. The procedures 

for handling mail containing hazardous materials state that the Inspection 

Service should be contacted only when considered necessary and do not 

mention contacting the safety officer.

The safety officer contacted the spill and leak team to respond to the 

situation, which was in accordance with suspicious mail guidelines. The 

spill and leak teams are USPS-facility based teams trained to respond to 

routine spills and leaks in the postal system. Although there was no spill or 

leak associated with this envelope, Greenville postal officials told us that 

they called the spill and leak team to respond as an extra precaution. 

According to Postal Service procedures for these teams, they must initiate 

the facility’s emergency action plan, which includes evacuation and calling 

emergency responders, if they encounter a material that is outwardly 

hazardous.18 One of the team members, who may have had some 

knowledge of ricin based on military training, voiced concerns to his 

supervisor about the appropriateness of the spill and leak team responding 

to the incident.19 The supervisor, acting on the team member’s concerns, 

contacted the safety officer to discuss the situation. According to the safety 

officer, she offered to respond instead, since she had the required training, 

but the supervisor of the team called back afterward indicating that he and 

17USPS has links on its internal Web site to Web pages maintained by CDC and the 

Occupational Safety and Health Administration that provide information on various 

bioterrorism and chemical agents, including ricin, and, according to postal headquarters 

officials, these links were available to postal employees at the time of the incident.

18According to these procedures an outwardly hazardous material or situation exists if a 

mail piece is smoking, irritating, odorous, labeled or marked as hazardous, if the material is 

in a gaseous or solid powder form and is migrating away from its container, if defensive 

measures have not worked, or if the situation appears to be getting worse. In a USPS-issued 

bulletin issued shortly after the incident, on October 30, 2003, spill and leak teams are 

instructed to retreat and call for outside expert assistance if they suspect or confirm an 

emergency.

19In addition, at the time of the incident, one of the three people responding as the spill and 

leak team did not have the required training to be part of this team. The supervisor 

explained that, at the time, he thought that the employee had received the required training.
Page 30 GAO-05-716 U.S. Postal Service

the team would respond. According to the team members, they were told to 

respond in spite of their concerns. 

When the spill and leak team arrived at the facility, it double-bagged the 

envelope and moved it to a separate room, where they isolated it by closing 

the room and putting “Do Not Enter” signs on the doors. They did not 

initiate the facility’s emergency action plan. Some of these actions are in 

accordance with the suspicious mail guidelines, which call for the team to 

take defensive actions. However, moving the envelope was not in 

accordance with these guidelines and the information the one team 

member had about ricin should have been considered in determining 

whether an emergency existed. 

The facility manager did not attempt to contact the Inspection Service until 

approximately nine hours after initial discovery, after speaking with the 

safety officer, and made an additional attempt before actually speaking 

with an inspector about 12 hours after the discovery. He did not call the 

Inspection Service first, as recommended in the suspicious mail guidelines. 

Hazardous material handling procedures stated that the supervisor should 

call the Inspection Service “if necessary,” concerning a mail piece that may 

contain hazardous material but that is not properly labeled. Although the 

suspicious mail guidelines had no references to how quickly contact with 

the Inspection Service should occur after suspicious mail is discovered, a 

message to managers in 2002 on the identification and handling of 

suspicious mail included instructions that the Inspection Service should be 

called immediately after the identification of a suspicious mail piece. Upon 

receiving calls regarding suspicious mail, postal inspectors conduct an 

initial threat assessment and provide advice to facility managers regarding 

immediate actions to be taken, such as whether to call emergency 

responders.

USPS officials, at both the local and headquarters levels, acknowledge that 

not contacting the Inspection Service immediately was not an optimal way 

to handle the situation. Inspection Service officials told us that they would 

rather be called during an incident and have it turn out to be nothing then 

to not be called when they should have been. 

The facility manager notified the senior plant manager about the situation 

about 11 hours after the discovery of the envelope. Suspicious mail 

guidelines indicate that the postmaster should be contacted after 

contacting the Inspection Service and emergency responders. According to 

a USPS official, the basic intent of this instruction is to contact the next 
Page 31 GAO-05-716 U.S. Postal Service

level of management, which for the Greenville airmail facility would be the 

senior plant manager. 

The facility manager did not call local emergency responders until more 

than 12 hours after discovery. According to suspicious mail guidelines, 

such contact is to be made after contacting the Inspection Service. The 

facility manager did contact the local emergency responders after speaking 

with the Inspection Service, based on the advice of the inspector he spoke 

with. According to the facility manager, he did not call emergency 

responders earlier because he determined that the envelope was not an 

immediate threat to employees, since it was not leaking, and he was 

waiting to speak to the Inspection Service.

Communications with 

Employees and Unions 

Were Generally in 

Accordance with Existing 

Guidance

Actions by Greenville postal management and USPS headquarters to 

communicate with employees and unions regarding the incident were 

generally in accordance with guidance in place at the time. The facility 

manager told us that, after the envelope was removed from the facility on 

October 15, he and the supervisor informed employees of the situation as 

they reported to work. He explained that the information they provided 

included what was written on the suspicious envelope and that the 

envelope had been taken to the state health department to be tested. 

According to the manager, he gave employees, including union 

representatives working at the facility, all the information that was 

available for him to provide.20 Also, USPS provided talks and news releases 

to employees and notified local unions on October 22, after the results of 

CDC’s testing were available and after coordinating with CDC and the other 

involved federal and state agencies. These communication efforts were 

generally in accordance with recommendations in the suspicious mail 

guidance to keep employees and their representatives informed. 

However, according to officials from one union representing employees at 

the facility, the Postal Service did not provide any formal communication to 

local postal unions in the Greenville area about the incident until October 

22, 7 days after the discovery of the envelope.21 Union officials told us that, 

20He noted that he could not provide some details because he had been instructed not to do 

so due to the investigation of the incident.

21According to these union officials, USPS informed its national office about the incident by 

phone the day after it occurred, on October 16.
Page 32 GAO-05-716 U.S. Postal Service

prior to the testing results being presented by the Postal Service, rumors 

were circulating among employees about the incident. Some Greenville 

employees first learned about the test results from the media rather than 

USPS and, according to the facility manager, some of the information in 

these media reports was not accurate. The manager explained that he was 

told not to release any information on the situation until it had been 

approved by headquarters. He also explained that he could have kept 

employees better informed and prevented concerns if he had received 

information on the testing of the substance earlier. 

In addition, according to the manager, sometime between October 15 and 

21, he found information about ricin on CDC’s website, printed copies of 

this information, and made them available to employees and union 

representatives. He also told us that he shared this information verbally 

with employees. However, headquarters officials told us that they do not 

want facility managers to provide health-related information to employees 

and that such information should be provided by a health professional. 

CDC officials have told us that, considering the volume of incidents 

nationwide that lead to testing of suspicious mail pieces, particularly those 

involving unknown powders, they believe it is best to wait until the 

presence of a biological or chemical agent is confirmed to provide 

information to employees on symptoms of exposure. 

USPS Has Made a 

Number of 

Improvements in its 

Suspicious Mail 

Guidance, but Some 

Key Elements Are 

Lacking

Since the ricin incident in Greenville in October 2003, USPS has made a 

number of changes in its guidance on identifying and initially responding to 

suspicious mail that have improved its clarity and consistency, therefore 

addressing some issues raised by the incident. These improvements will 

enhance its ability to manage risks posed by potential biological and 

chemical threats in the mail. However, some key elements are lacking. 

Without these elements in its guidance, some issues that impaired the 

response to the Greenville incident could impair responses to future 

incidents. In particular, the Postal Service has not provided guidance for 

employees on actions to take if a mail piece has characteristics of both 

suspicious mail and mail containing hazardous material, or training for 

managers and supervisors on suspicious mail that presents all the guidance 

they may need to make appropriate decisions. The lack of these types of 

guidance could limit the ability of postal personnel to decide whether a 

mail piece is suspicious and whether initial response actions, such as 

shutting down equipment and calling postal inspectors, are warranted. In 

addition, the Postal Service has not provided explicit guidance on 

communicating with employees and unions regarding suspicious mail 
Page 33 GAO-05-716 U.S. Postal Service

incidents. Without this type of guidance in place, employees and unions 

may not receive timely information regarding mail suspected of containing 

a biological or chemical agent that is sent for testing. 

USPS Has Made 

Improvements in its 

Guidance on Identifying and 

Responding to Suspicious 

Mail 

According to headquarters postal officials, the ricin incident illustrated the 

need to ensure that all postal employees have the same understanding of 

steps to follow for identifying and responding to suspicious mail. Officials 

have emphasized that their suspicious mail guidance has evolved since 

2001 and acknowledged that different types and versions of guidance 

issued over time contained inconsistencies that could be confusing. 

Following the incident, USPS officials have sought to clarify the process for 

identifying and responding to suspicious mail and raise employee 

awareness of this process by developing and issuing new simpler and 

standardized guidance. (See table 4.) Main goals of these efforts include 

avoiding or minimizing employee exposure and rapidly assessing risk. 

In November 2003, USPS issued new guidelines for postal employees on 

characteristics to look for in identifying suspicious mail, using an easy to 

remember acronym—SLAP. This guidance categorizes indicators into the 

following four categories: 

• unusual Shape, such as an uneven or lopsided package,

• unusual Look and odor or sound, such as powder on the package or a 

ticking sound, 

• unusual Address features, such as no return address or suspicious or 

threatening language on the outside of the mail piece, and

• unusual Packaging, such as excessive tape or string.
Page 34 GAO-05-716 U.S. Postal Service

Table 4: Key USPS Guidance on Identifying and Responding to Suspicious Mail Developed or Issued After October 2003 

Incident 

Source: GAO analysis of USPS suspicious mail guidance.

a

In addition, in December 2003 and December 2004, USPS issued updated versions of its guidelines 

for responding to an anthrax release that it originally issued in November 2001. These guidelines cover 

a range of response activities—including sampling, analysis, and decontamination—and also include 

guidance on the initial response to a suspected incident. 

b

According to USPS officials, its Mail Security Task Force, which includes representatives of employee 

unions and management associations, reviewed these procedures during their development. 

These new categories provide greater clarity about how to identify a 

suspicious mail piece, in a uniform, easy to remember format. Also, unlike 

some previously issued guidance, they do not involve any determinations 

Type of 

guidance

Intended 

audience Date issued Description 

Guidance documentsa

Postal bulletin 

on handling 

suspicious mail 

pieces

Managers and 

supervisors 

October 2003 Cites the ricin incident and emphasizes key steps for responding to a 

suspicious mail piece. States that the suspicious powder exercise can be 

applied to many suspicious mail incidents.

“SLAP” 

guidance on 

identifying 

suspicious mail 

Managers and 

supervisors 

November 2003 Presents characteristics of suspicious mail in four “easy to remember” 

categories, based on the acronym SLAP: unusual Shape, Look, Address 

features, or Packaging. 

“Three Ps” 

guidance on 

responding to 

suspicious mail 

Managers and 

supervisors 

October 2003 Presents “three simple steps” for responding to a suspicious package: 

• Package – don’t handle it. Isolate the area.

• People – evacuate the area around the package and notify your 

supervisor.

• Plan – contact the Inspection Service, police and community first 

responders.

Suspicious mail 

poster

All employees February 2004 Presents the October 2003 Three Ps guidance in a poster for USPS 

employees.

Response 

checklist

Managers and 

supervisors 

USPS plans to issue 

in late July 2005

Presents a checklist of actions to take in response to suspicious mail and 

unknown powders or substances.b

Poster on 

immediate 

response 

actions

All employees USPS plans to issue 

in early August 2005

Presents the Three Ps guidance as well as more detailed instructions for 

employees, supervisors, and managers on initial actions to take in 

response to suspicious mail and unknown powders or substances.b

Training

Suspicious 

powder tabletop 

exercise

Managers, 

supervisors, and 

support staff

September 2004 Updated version of 2003 training. Discusses actions to take in incidents 

involving a suspicious powder leaking from a mail piece. Consists of a 

series of scenarios portraying phases of a hypothetical incident and active 

exercises in responding to these scenarios. 

Mandatory talks 

on handling 

suspicious mail

All

employees

November 2003 Monthly mandatory talks delivered by managers and supervisors to postal 

employees nationally. Focuses on the use of SLAP and the Three Ps, 

respectively, for identifying and responding to suspicious mail.
Page 35 GAO-05-716 U.S. Postal Service

of the type of threat, such as a biological or chemical threat, that a mail 

piece may pose. In addition, USPS added several new characteristics for 

employees to look for. One such characteristic—suspicious or threatening 

language on the outside of the mail piece—may have helped the Greenville 

airmail facility personnel to identify the envelope in the ricin incident as 

suspicious mail. (Previously, threatening language had only been cited in 

the decision tree guidelines, which were aimed at managers and 

supervisors.) USPS headquarters officials have emphasized that they want 

to make the initial decision about whether a mail piece is suspicious as 

simple as possible and that postal employees and managers generally have 

much experience to draw on, in addition to the SLAP indicators, in making 

these determinations. 

USPS has also produced new simplified guidance on responding once a 

mail piece has been identified as suspicious. In October 2003, USPS issued 

guidance on “three simple steps” to follow with easy to remember labels—

Package, People, and Plan—referred to as the “three Ps.” (See fig. 5.) It 

followed up with a new poster for employees on these steps in February 

2004. This new guidance places additional emphasis, in an easy to 

understand format aimed at all employees, on isolating and not handling 

suspicious mail pieces, keeping employees away, and notifying postal 

inspectors and emergency responders. It could help to prevent uncertainty 

about appropriate initial response actions to an envelope or package with 

characteristics of suspicious mail, as occurred in the Greenville incident. 
Page 36 GAO-05-716 U.S. Postal Service

Figure 5: USPS Three Ps Poster

Since 2003, in addition to producing new guidance for identifying and 

responding to suspicious mail, USPS has made efforts to make employees 

more aware of this guidance. In particular, since November 2003, it has 

delivered monthly talks to employees that reiterate the “SLAP” 

characteristics of suspicious mail pieces and the “Package, People, and 

Plan” steps for responding. USPS has also communicated its guidelines to 

Source: USPS.
Page 37 GAO-05-716 U.S. Postal Service

employees through other means, including its internal Web site and news 

publications. Finally, it has updated its suspicious powder tabletop 

exercise to include new instructions to consult with postal inspectors prior 

to evacuating the facility or contacting emergency responders, unless an 

emergency exists. According to postal officials, these efforts have been 

successful in making employees aware of the appropriate actions to take in 

response to suspicious mail. They cited as evidence the results of a recent 

survey regarding suspicious powder incidents that the Postal Service sent 

to a random sample of employees. Ninety one percent of employees who 

responded reported that they know the proper steps to take when 

discovering a suspicious powder.22 In a recent review of responses to 

suspicious mail incidents at selected postal facilities, the USPS Office of 

Inspector General found that postal personnel were generally aware of 

policies for handling suspicious mail. However, they also found that 

supervisors at some facilities did not follow established guidance when 

managing suspicious mail incidents.23

To provide further clarification for employees on how to respond to 

suspicious mail, USPS convened a working group in late 2004 to review 

existing guidelines and come up with consistent, easy to understand 

procedures for employees to follow. This working group developed new 

procedures for response actions to take after identifying a suspicious mail 

piece or an unknown powder or substance. These new procedures include 

a checklist of response steps for managers and supervisors as well as a 

poster for all employees. USPS plans to distribute the checklist to 

managers and supervisory employees in late July 2005. It also plans to 

distribute the poster to all facilities and the poster in brochure form to all 

employees in early August 2005. 

According to postal officials, these new procedures are based on CDC 

guidance on handling suspicious mail as well as other emergency 

22According to postal management, these results are based on responses to a questionnaire 

that was sent to the homes of a random sampling of employees. Ten thousand employees 

received the questionnaire and 2,921 responded.

23See USPS, Office of Inspector General, Management Advisory – Response to Incidents 

Involving Suspicious Mail and Unknown Powders and Substances, DA-MA-05-001 

(Washington, D.C.: May 27, 2005). In another recent review of a suspicious mail incident that 

occurred in Washington, D.C., in August 2004, the Inspector General found that Postal 

Service and Inspection Service personnel did not effectively respond. See USPS, Office of 

Inspector General, Postal Service Practices with Regard to Handling Suspicious Mail, SAOT-05-002 (Washington, D.C.: May 20, 2005). 
Page 38 GAO-05-716 U.S. Postal Service

management guidance. Officials have emphasized that the approach they 

have developed for responding to suspicious mail is conservative because 

it calls for taking immediate actions to protect employees when there is a 

suspicion that a mail piece could be harmful, but before this is confirmed. 

These new procedures clarify initial steps that should be taken upon the 

discovery of a suspicious mail piece. In particular:

• They are clearly applicable to all types of suspicious mail incidents. 

Some previously issued guidance appeared to apply only to incidents 

involving suspicious powders or suspected anthrax releases. 

• They highlight circumstances when emergency responders should be 

called immediately.

• They reflect the expanded role of postal inspectors. If no clear 

emergency exists but a mail piece is suspicious, inspectors should be 

called and will help determine subsequent actions.

• They provide some additional guidance on initial communications with 

employees and unions regarding suspicious mail incidents. 

• They clearly specify other initial actions to take to protect employees. 

Unlike some earlier guidance, postal officials are considering the new 

checklist and poster to be procedures representing required immediate 

steps to take in response to suspicious mail and not guidelines representing 

recommended steps. Also, USPS has announced that the new procedures 

supercede some previous guidance, including the decision trees.24

Since early 2003, the Inspection Service has worked closely with USPS to 

define an expanded role for postal inspectors in responding to suspicious 

mail incidents, including incidents involving mail leaking an unknown 

24In its recent report on the Postal Service’s responses to suspicious mail incidents, the 

Office of Inspector General recommended that the Postal Service remove all outdated 

references on its internal suspicious mail Web site. The Postal Service responded that it 

would place the new procedures on its Web site and that it is currently removing from the 

site all information and documents containing conflicting procedures to ensure consistency 

of policy. See USPS, Office of Inspector General, Management Advisory – Response to 

Incidents Involving Suspicious Mail and Unknown Powders and Substances, DA-MA-05-

001.
Page 39 GAO-05-716 U.S. Postal Service

powder as well as non-leaking suspicious mail.25 USPS procedures 

regarding the release of hazardous materials state that spill and leak teams 

are to be called in when there are leaks from mail pieces, and that, when 

they encounter an unknown substance, they should initiate emergency 

procedures. These procedures call for evacuating the facility and calling 

local emergency responders. However, after the anthrax incidents in fall 

2001, a large number of incidents involving unknown powders leaking from 

mail pieces occurred in the postal system, disrupting operations and 

placing a heavy burden on local emergency responders. To address this 

problem, inspectors now are expected to respond to incidents involving 

mail leaking unknown powder as well as other types of suspicious mail 

incidents. 

Once a suspicious mail incident is determined to be an emergency, such as 

when there are fumes or employees exhibit medical symptoms, USPS 

emergency procedures need to be followed. In January 2004, USPS 

established the Integrated Emergency Management Plan (IEMP) as the 

Postal Service’s “all-hazard” comprehensive plan for responding to all types 

of emergencies, including natural disasters and man-made hazards. A major 

goal of the IEMP is to establish a standardized emergency management 

process throughout the postal system. The IEMP provides instruction for 

individual facilities to follow in response to emergencies affecting their 

facility and is tailored to the risks at each facility. It is currently being 

implemented at facilities with biohazard detection systems and, for those 

facilities, includes response plans for system alerts.26 USPS is currently 

revising the IEMP to align it with guidance in DHS’s National Response 

Plan, including guidance on responding to biological threats.27 According to 

postal officials, the Postal Service plans to incorporate its new suspicious 

mail procedures into the IEMP and implement the plan at all USPS facilities 

by the end of fiscal year 2005. 

25To prepare for this new role, the Inspection Service has provided over 200 of its 1,877 

inspectors with training in responding to dangerous mail, including hazardous material 

releases from mail. It plans to have these inspectors become part of dangerous mail 

response teams located throughout the United States. The Inspection Service has also 

established a system for reporting on suspicious mail incidents and plans to provide 

inspectors with equipment that will assist in the assessment of suspicious substances.

26A system alert is a signal from a biohazard detection system when its internal test indicates 

the presence in the mail stream of the bacterium that causes the disease anthrax.

27DHS issued the National Response Plan, a comprehensive plan for addressing all hazards, 

in January 2005. 
Page 40 GAO-05-716 U.S. Postal Service

The IEMP includes procedures for notifying USPS managers, postal 

inspectors, and other internal and external stakeholders, including unions 

and employees, when various types of emergencies occur. For facilities 

with biohazard detection systems, it establishes responsibilities of 

managers and safety officers at the local level for providing initial talks to 

employees and for notifying local union representatives of system alerts 

and subsequent positive or negative testing results. It also establishes 

responsibilities of headquarters officials for informing national union 

representatives of such alerts and testing results. Also, in other cases of a 

suspected anthrax release, USPS’s current anthrax guidelines establish 

responsibilities of facility managers for notifying employees and union 

representatives of testing results and of headquarters officials for notifying 

national unions of such results. 

We have advocated a risk management approach as a framework to guide 

decision making in federal agencies.28 A risk management approach entails 

a continuous process of managing, through a series of mitigating actions, 

the likelihood of an adverse event happening with a negative impact. While 

risk management cannot eliminate risk, it can help reduce risk by 

enhancing protection from known or potential threats with a goal of 

providing reasonable assurance that an organization’s objectives will be 

achieved. In the case of the Postal Service, risk management can help it, 

among other things, to protect employees from possible threats in the mail 

while avoiding unnecessary disruption of operations. Managers at different 

levels within an agency can engage in risk management decision-making, 

although the manager of a facility may have more constraints than a higher 

level manager. Such decision-making can be adversely affected by, among 

other things, the potential for human errors in judgment and the potentially 

poor quality of information driving the decisions. 

28The risk management approach we have advocated includes fully linking strategic goals to 

plans and budgets, assessing values and risks of various courses of action as a tool for 

setting priorities and allocating resources, and using performance measures to assess 

outcomes. See, for example, GAO, Homeland Security: Agency Plans, Implementation, 

and Challenges Regarding the National Strategy for Homeland Security, GAO-05-33

(Washington, D.C.: Jan. 14, 2005); Homeland Security: Summary of Challenges Faced in 

Targeting Oceangoing Cargo Containers for Inspection, GAO-04-557T (Washington, D.C.: 

Mar. 31, 2004); Rail Security: Some Actions Taken to Enhance Passenger and Freight Rail 

Security, but Significant Challenges Remain, GAO-04-598T (Washington, D.C.: Mar. 23, 

2004); and Homeland Security: A Risk Management Approach Can Guide Preparedness 

Efforts, GAO-02-208T (Washington, D.C.: Oct. 31, 2001).
Page 41 GAO-05-716 U.S. Postal Service

Within the Postal Service, postal managers and supervisors at facilities play 

a key role in making an initial assessment of the risks posed by a mail 

piece, after an employee has identified it as suspicious. The new “SLAP” 

guidance on identifying suspicious mail, by providing a consistent set of 

characteristics to look for, will likely help them make these decisions. In 

addition, the new guidance on initially responding to suspicious mail—

including the “three Ps” guidance, related training, and the new response 

checklist and poster—provides clearer and more consistent instructions on 

initial steps to take to manage the risk posed by a suspicious mail piece, 

before postal inspectors or emergency responders become involved. 

Similarly, the expanded role of postal inspectors in responding to 

suspicious mail and the Postal Service’s efforts to develop and refine “allhazards” plans for responding to all types of emergencies will enhance its 

abilities to manage risk posed to the mail system by biological and 

chemical agents.

Some Key Elements in USPS 

Suspicious Mail Guidance 

Are Lacking 

Although USPS’s new guidance on identifying and responding to suspicious 

mail is clearer and more consistent than the guidance it had in place in 

October 2003, current guidance does not fully address issues raised by the 

incident because some key elements are lacking. Specifically, the Postal 

Service has not provided guidance for employees on response actions to 

take if a mail piece has characteristics of both suspicious mail and mail 

containing hazardous material, and the training for managers and 

supervisors on suspicious mail does not provide all the guidance they may 

need to make appropriate decisions. Without these elements in its 

guidance, postal personnel may have difficulty, in some cases, in deciding 

whether a mail piece is suspicious and whether initial response actions, 

which can disrupt postal operations, are warranted. Furthermore, the 

Postal Service has not provided explicit guidance on communicating with 

employees and unions regarding suspicious mail incidents, including 

guidance on when information should be provided and to whom and what 

types of information should be shared. Without such guidance, employees 

and unions may not receive timely information regarding suspicious mail 

that is sent for testing and may not feel confident that they have been 

adequately informed. 

USPS lacks guidance on what response actions to take in the event a mail 

piece has characteristics of both suspicious mail and mail containing 

hazardous material. The signs employees are trained to look for to 

identify these types of mail can overlap. For example, a warning label, one 

characteristic of mail containing or that may contain hazardous material, in 
Page 42 GAO-05-716 U.S. Postal Service

some cases could be considered to be a restrictive marking or a suspicious 

or threatening message, both characteristics of suspicious mail. The 

message on the envelope in the Greenville incident (Caution: RICIN 

POISON. Enclosed in sealed container. Do not open without proper 

protection.) could be considered to have all of these characteristics. 

However, neither the current procedures and training on handling mail 

containing hazardous material nor the procedures and training on 

suspicious mail clarify what employees should do in such cases.29

Furthermore, while the hazardous material handling procedures in place in 

October 2003 did indicate that supervisors should request further 

assistance from the Inspection Service, if necessary after discovering an 

improperly labeled mail piece suspected of containing hazardous material, 

the current version of these procedures do not mention calling the 

Inspection Service in these instances. Notifying the Inspection Service is a 

key step in the procedures for responding to suspicious mail.

The manager of the office that produces the hazardous material handling 

procedures and training told us that his office has preferred to focus on the 

routine handling of mail containing hazardous materials to avoid causing 

undue concern to employees about this type of mail. However, without 

clear guidance in these procedures and training that employees should 

follow suspicious mail procedures when a mail piece has characteristics of 

both mail containing hazardous material and suspicious mail, employees 

may be uncertain what to do and their ability to initially assess the risks 

posed by a mail piece may be impaired. As a consequence, their response 

actions taken may lack the precautions that are in the suspicious mail 

procedures. By not taking such precautions, including not handling the 

mail piece and calling postal inspectors to conduct a threat assessment, 

employees could unintentionally be exposed to a biological or chemical 

threat agent if a mail piece did contain one. 

USPS training for managers and supervisors on suspicious mail does 

not provide them with all the guidance they may need to make 

appropriate decisions. Managers and supervisors at postal facilities play a 

29In situations where a mail piece has stains, leakage, or an unusual odor, the hazardous 

material handling procedures do indicate that employees should follow USPS procedures 

for hazardous material releases. These characteristics are similar to the following 

characteristivs for suspicious mail: powder on the package or odors, discoloration, or oily 

stains. USPS’s new guidance on suspicious mail also applies to unknown powders or 

substances leaking from mail and the Postal Service plans to update its hazardous material 

release procedures to ensure consistency with this new guidance.
Page 43 GAO-05-716 U.S. Postal Service

key role in judging whether a mail piece is suspicious, after an employee 

has initially identified it as such, and whether the situation warrants taking 

the response actions outlined in the new USPS procedures. Such actions 

can significantly disrupt operations through shutdowns of part or all of a 

facility. Postal officials have emphasized that they have tried to make this 

decision process as simple as possible and that postal personnel are 

experienced in identifying suspicious mail. However, they acknowledge 

that leaking powder is the most obvious indicator of suspicious mail and 

that, in the absence of leaking powder, decisions about whether a mail 

piece is suspicious must be based on other characteristics and can be more 

difficult to make. While USPS’s new guidance on identifying and 

responding to suspicious mail does apply to scenarios in which a mail piece 

is leaking as well as to those in which it is not leaking, the training that 

USPS provides to managers and supervisors on dealing with suspicious 

mail—the suspicious powder tabletop exercise—does not cover scenarios 

in which a mail piece is suspicious but not leaking a powder. Suspicious 

powder incidents have posed a significant challenge to the Postal Service 

and the purpose of this training has been to ensure a consistent and 

protective response to these incidents while reducing unnecessary 

disruption of operations. The suspicious powder tabletop exercise lasts 

about one hour and USPS required managers and supervisors at facilities 

with more than 50 staff to complete it in 2003 and again in 2004.

While suspicious powder incidents have comprised the majority of 

suspicious mail incidents in the last several years, mail that is not leaking 

but that has other suspicious mail characteristics could also pose a 

biological threat. According to guidance for local responders issued by the 

FBI and DHS in November 2004, a “letter/container with a threat but no 

visible powder or substances present” could have “trace amounts of 

material present that could represent a health risk.”30 CDC officials told us 

that, while visible leakage of a powder from a mail piece is a very important 

factor in determining whether immediate response actions are warranted, a 

threatening message is also important.31

In scenarios in which a mail piece may have one or more characteristics of 

suspicious mail but does not appear to be leaking a powder, it may be 

30FBI-DHS-HHS/CDC, Guidance on Initial Responses to a Suspicious Letter/Container 

With a Potential Biological Threat (Washington, D.C.: November 2, 2004).

31CDC has issued guidance on how to recognize and handle a suspicious package or 

envelope. See http://www.bt.cdc.gov/agent/anthrax/mail/suspiciouspackages.asp. 
Page 44 GAO-05-716 U.S. Postal Service

difficult for managers to determine if the mail piece is suspicious and if 

they should disrupt operations and call the Inspection Service. For 

example, some of the SLAP characteristics of suspicious mail—such as no 

return address and excessive postage or tape—may not, by themselves or 

in combination, indicate potential danger. Also, it may be difficult to 

determine if a message on the outside of an envelope is suspicious or 

threatening—another characteristic of suspicious mail—as occurred in the 

Greenville incident. Judgments about whether a mail piece is indeed 

suspicious require managers and supervisors to make an initial assessment 

of the risk posed by a mail piece. In the Greenville incident, the manager 

decided to end the facility evacuation and to postpone further action until 

the morning based to a large extent on the fact that the envelope was not 

leaking. In situations in which a mail piece poses a potential biological 

threat, whether it is leaking or not, a quick response is important. 

According to CDC officials, since it is not clear what is inside of a 

suspicious mail piece, the earlier that response actions are taken, the 

better. 

Finally, although the new poster on responding to suspicious mail indicates 

that calling the Inspection Service is one of the immediate response actions 

that should be taken, USPS’s suspicious powder training exercise for 

managers and supervisors does not provide instructions on how soon 

inspectors should be called after the discovery of a non-leaking suspicious 

mail piece. As occurred in the Greenville incident, without training that 

reinforces other guidance about when to call inspectors, managers may 

wait to call them when in doubt about whether a mail piece is suspicious. 

Furthermore, in some areas, including Greenville and Charlotte, callers to 

the Inspection Service after regular business hours are directed to dial a 

number for live assistance in the event of an emergency. Facility managers 

may hesitate to do so if there is not clear evidence of an emergency.32

According to postal officials, most mail processing is done from 4:00 p.m. 

to 8:00 a.m. 

USPS lacks explicit guidance on communicating with employees and 

unions regarding suspicious mail incidents. Other than procedures 

related to biohazard detection system alerts and other cases of suspected 

32According to the Inspection Service, they are considering ways to increase the availability 

of inspectors by phone. For example, the service has a national 24-hour phone number for 

internal reporting of incidents within the Inspection Service and they are considering 

making this phone number available to postal facilities to call when they discover 

suspicious mail pieces. 
Page 45 GAO-05-716 U.S. Postal Service

anthrax releases, USPS lacks detailed guidance on communicating with 

employees and unions regarding suspicious mail incidents, including 

guidance on when information should be provided and to whom and what 

types of information should be shared. The Postal Service’s draft of its new 

procedures for responding to suspicious mail which it originally provided 

to us did not contain guidance on communications with employees and 

unions. The Postal Service added some guidance on this topic to these 

procedures after we discussed with them our preliminary findings that it 

had limited guidance in this area.33 The new procedures state that 

supervisors and managers should communicate with employees and local 

unions about suspicious mail incidents as soon as possible. It also states 

that information provided “must be limited to known facts,” to avoid 

disseminating unintended misinformation, and that local emergency 

responders can assist in providing information. While this guidance 

provides some additional instructions about initial communications, it does 

not specify how local union organizations should be notified, what types of 

information should be provided, or whether or when information should be 

provided after the initial occurrence of the incident, in cases in which mail 

pieces are sent for testing. Previous guidance, in an e-mail message 

accompanying the March 2003 decision trees, discussed the need to keep 

employees and unions informed “at all stages, including the final results 

and resolution of the incident.” However, this guidance has been replaced 

by the new procedures. 

Although Postal Service personnel made a number of efforts to provide 

information to employees and unions about the October 2003 incident, 

some issues did arise concerning the timing and method of local union 

notifications and whether the facility manager should have provided 

information on symptoms of ricin exposure to facility employees. 

Furthermore, the lack of formal communications and status updates for 

employees during the 7 day period from the discovery of the envelope until 

the results of the testing were shared may have led to rumors and employee 

concerns. Finally, in our related review of the November 2003 incident in 

which an envelope containing a substance initially suspected of being ricin 

was discovered at a White House mail processing facility, we have 

identified issues related to the Postal Service’s subsequent communication 

of information regarding this incident to employees and unions. We plan to 

report separately on this incident later this year. The Postal Service’s new 

33Postal officials have acknowledged that this new guidance on communications was added 

as a result of our discussions with them. 
Page 46 GAO-05-716 U.S. Postal Service

procedures for responding to suspicious mail do provide some additional 

guidance on initially communicating with employees and unions that may 

help to avoid some of these issues from arising in future incidents. 

However, these procedures do not provide explicit instructions that could 

help to avoid all of these types of issues, particularly in cases where a 

suspicious mail piece is sent for testing.

According to Inspection Service officials, once inspectors have been 

alerted about a suspicious mail piece, they often can determine that the 

item poses no risk through their initial threat assessment, which includes 

checking the package or envelope or leaking substance and contacting the 

mailer or addressee. In instances in which, after an initial threat 

assessment, mail is suspected of containing a biological or chemical agent 

or other hazardous substance or has a threatening message, such mail 

pieces are sent for testing to a state or local laboratory and possibly also to 

CDC.34 A series of tests may be performed to determine whether a threat 

agent is present. As demonstrated in the Greenville incident, it could take a 

number of days for testing results to become available. In such instances, 

employees and unions may become concerned if they are not kept 

informed on what has transpired and on the status of the testing.

The General Services Administration has issued guidelines for managing 

biological threats in federal mail facilities that emphasize the importance of 

communications with local union officials and employees in the event that 

a threat appears credible.35 Specifically, these guidelines state that all 

information relevant to such threats should be provided as quickly as 

possible, preferably without waiting for a request.36 While these guidelines 

are intended for use by mail centers located in federal agencies, in our 

view, their recommendations regarding communications with employees 

and unions are relevant to the Postal Service. In addition, risk 

communication experts have emphasized that risk information should be 

34In fiscal year 2004, according to data maintained by the Inspection Service, about 500 

suspicious mail pieces or substances discovered in U.S. Postal Service facilities were either 

field tested or sent to laboratories to be tested. 

35See General Services Administration, GSA Policy Advisory: National Guidelines for 

Assessing and Managing Biological Threats in Federal Mail Facilities (Washington, D.C.: 

December 29, 2003). 

36Occupational Safety and Health Administration standards require employers to disclose 

exposure-related test results to any employee who requests these results. See 29 CFR 

1910.1020 (e) (1) (i).
Page 47 GAO-05-716 U.S. Postal Service

accurate and clear and provided in a timely fashion to prevent unofficial 

sources, such as the media, from reporting information before official 

sources.37

In a previous report on communications issues related to the anthrax 

incidents, we identified the need for more explicit guidance on 

communicating facility sampling results to employees as a lessons learned 

to avoid concerns and maintain trust and credibility.38 We have also 

previously reported on the need to provide complete and timely healthrelated information to postal workers to maintain trust and credibility and 

to help ensure that workers have essential information for making 

informed health decisions.39 Without specific guidance on communications 

with employees and unions regarding incidents in which a suspicious mail 

piece is sent for testing, communications issues may arise in future 

incidents. Such guidance can clarify the responsibilities of managers at 

different levels for providing information to employees and unions 

regarding suspicious mail incidents and help to avoid situations in which 

efforts by management to communicate information do not meet 

expectations. 

Conclusions Improvements made by the Postal Service in its suspicious mail guidance 

since the October 2003 incident should help postal personnel determine 

whether mail is suspicious and should also help make them more aware of 

initial actions to take upon identifying suspicious mail. As a consequence, 

these improvements should enhance the ability of the Postal Service to 

manage risks posed by potential biological and chemical threats in the 

mail. However, the lack of additional guidance in some areas could limit the 

ability of postal personnel to make appropriate decisions in responding to 

future incidents involving mail that may contain biological or chemical 

agents. In particular, without guidance on actions to take in cases where a 

37GAO, Homeland Security: Communication Protocols and Risk Communication 

Principles Can Assist in Refining the Advisory System GAO-04-682

38

(Washington, D.C.:

June 25, 2004).

GAO-03-316.

39GAO, U.S. Postal Service: Issues Associated with Anthrax Testing at the Wallingford 

Facility, GAO-03-787T (Washington, D.C.: May 19, 2003); and U.S. Postal Service: Clear 

Communication with Employees Needed before Reopening the Brentwood Facility, GAO04-205T (Washington, D.C.: Oct. 23, 2003).
Page 48 GAO-05-716 U.S. Postal Service

mail piece has characteristics of both mail containing hazardous material 

and suspicious mail, employees may follow the procedures for mail 

containing hazardous material, which do not recommend some precautions 

in the suspicious mail guidance, such as not handling the mail piece. 

Furthermore, without training on handling suspicious mail incidents that 

covers different types of scenarios and how soon inspectors should be 

called, managers and supervisors may not have all the guidance they need 

to decide whether a mail piece is suspicious and initial response actions are 

warranted, and they may delay calling postal inspectors. If a mail piece 

actually contained a biological or chemical agent, not following the steps in 

the suspicious mail guidance could result in employees being exposed to 

the agent. 

 Finally, the lack of explicit guidance on communicating with employees 

and unions regarding incidents in which a suspicious mail piece is sent for 

testing could lead to situations in which employees and unions believe that 

they have not been adequately informed. Such situations can affect the 

Postal Service’s ability to maintain trust and credibility with employees and 

unions. In particular, explicit guidance on when information should be 

provided and to whom and what types of information should be shared 

would clarify the responsibilities of managers at different levels for 

providing information and help to avoid concerns by employees and 

unions.

Recommendations for 

Executive Action

To help prepare postal personnel to respond to future incidents involving 

mail that may contain biological or chemical agents, we recommend that 

the Postmaster General implement the following three recommendations. 

• The Postal Service should provide guidance to employees on the 

response actions to take in the event a mail piece has characteristics of 

both suspicious mail and mail containing hazardous material.

• The Postal Service should expand its suspicious mail training for 

managers and supervisors to include 

• exercises for responding to various scenarios involving suspicious 

mail pieces, including scenarios in which a mail piece is suspicious 

but is not leaking a powder, and

• instructions on how soon inspectors should be called after the 

discovery of a suspicious mail piece. 
Page 49 GAO-05-716 U.S. Postal Service

• The Postal Service should provide explicit guidance to managers on 

communicating with employees and unions regarding incidents in which 

a suspicious mail piece is sent for testing. This guidance should specify 

when information should be provided and to whom and what types of 

information should be shared. 

Agency Comments and 

Our Evaluation

We requested comments on a draft of this report from the Postal Service, 

CDC, DHS, the FBI, and the two postal unions that represent employees of 

the Greenville airmail facility (the American Postal Workers Union and the 

National Postal Mail Handlers Union). The Postal Service provided written 

comments generally agreeing with our recommendations. These comments 

are reprinted in appendix II and are summarized below. The Postal Service 

also provided some technical comments, which we incorporated. The FBI 

provided technical comments, which we incorporated, to clarify portions 

of our draft report that described actions of its Joint Terrorism Task Force 

in the Greenville area. DHS and CDC had no comments on the draft. The 

American Postal Workers Union also had no comments and the National 

Postal Mail Handlers Union did not accept our offer to review the draft.

The Postal Service stated in its overall comments on the draft report that it 

concurs with the intent of our recommendations and, in response, intends 

to implement a number of improvements in its suspicious mail guidance, 

including expanded training for employees. The Postal Service also 

emphasized that it does not believe such guidance should be unduly 

specific or detailed. It explained that it believes that the proper approach is 

to keep instructions to employees relatively basic and general, so that they 

will be easily understood and applicable to many potential situations. While 

we understand the Postal Service’s rationale for this approach, we also 

believe that it needs to ensure that its employees have adequate guidance 

to be able to make appropriate decisions in responding to future incidents 

involving mail that may contain biological or chemical agents. 

Regarding response actions in the event a mail piece has characteristics of 

both suspicious mail and mail containing hazardous material, the Postal 

Service told us that it will revise existing guidance to clarify appropriate 

response actions to take in such scenarios. Regarding its suspicious mail 

training for managers and supervisors, the Postal Service stated that it will 

expand and improve this training by adding exercises that include a variety 

of suspicious mail scenarios, including ones involving mail pieces that are 

not leaking a powder. It also noted that early contact with the Inspection 

Service is specified in its new response checklist and that its new training 
Page 50 GAO-05-716 U.S. Postal Service

will stress the need to contact the Inspection Service in any suspicious mail 

incident. However, it does not plan to impose specific timeframes for 

calling inspectors, to allow managers and supervisors the flexibility to 

respond to events as they occur and evolve. While specific timeframes may 

not be needed, we continue to believe that training for managers and 

supervisors should reinforce the message in the Postal Service’s new 

guidance that calling the Inspection Service is one of the immediate 

response actions that should be taken upon the discovery of any suspicious 

mail piece.

Regarding communications with employees and unions concerning 

incidents in which a suspicious mail piece is sent for testing, the Postal 

Service stated that it fully agrees with the concept that timely and accurate 

communication with employees is vitally important, especially when their 

safety and health is concerned. It intends to provide additional guidance to 

local managers regarding their responsibility for providing information, 

including general guidelines on the types of events that should lead to 

communication with employees and unions. While we are pleased that the 

Postal Service plans to provide this additional guidance, we note that its 

response does not indicate whether this guidance will address situations in 

which a suspicious mail piece is sent for testing. For such situations, we 

continue to believe that the Postal Service should specify when information 

should be provided and to whom and what types of information should be 

shared. Such explicit guidance could be provided in various ways, 

including training. Such guidance can help to avoid situations in which 

efforts by management to communicate information do not meet 

expectations. 

As arranged with your office, unless you publicly announce its contents 

earlier, we plan no further distribution of this report until 30 days after its 

date. At that time, we will send copies of this report to congressional 

committees and subcommittees with responsibility for postal issues, the 

Postmaster General, CDC, DHS, the FBI, and the South Carolina 

Department of Health and Environmental Control, as well as to postal 

unions and other interested parties. We will provide copies to others upon 

request. In addition, the report will be available at no charge on the GAO 

Web site at http://www.gao.gov. 
Page 51 GAO-05-716 U.S. Postal Service

If you have any questions about this report, please contact me at 

siggerudk@gao.gov or (202) 512-2834. Contact points for our offices of 

Congressional Relations and Public Affairs may be found on the last page 

of this report. Staff who made key contributions to this report are listed in 

appendix III.

Sincerely yours,

Katherine A. Siggerud

Director, Physical Infrastructure Issues
Page 52 GAO-05-716 U.S. Postal Service

Appendix I

Scope and Methodology ApApenednxidexiIs

To determine what actions the United States Postal Service (USPS), the 

Centers for Disease Control and Prevention (CDC) and other agencies took 

in responding to the October 2003 incident in Greenville, South Carolina, to 

protect the health of postal employees and the public, we reviewed 

documents of agencies involved in the response, including timelines, that 

explained the sequence and timing of actions the agencies took during the 

response. We also interviewed officials of these agencies and of unions 

representing workers at the Greenville airmail facility concerning the 

actions taken to protect the health of postal employees and the public and 

to discuss reasons for any delays in taking these actions. We obtained 

pertinent documents and interviewed officials from the following 

organizations:

• United States Postal Service (USPS) headquarters and Greater South 

Carolina Area. 

• United States Postal Inspection Service (Inspection Service) 

headquarters and Charlotte, North Carolina office. 

• Centers for Disease Control and Prevention (CDC). 

• Department of Homeland Security (DHS). 

• Federal Bureau of Investigation (FBI) headquarters and Columbia, 

South Carolina Division. 

• South Carolina Department of Health and Environmental Control. 

• American Postal Workers Union. 

• National Postal Mail Handlers Union. 

We developed a timeline of actions taken by the agencies based on the 

information in agency documents, generally determining the actions of a 

specific agency from the timeline provided by that agency, and 

corroborated, to the extent possible, the timeline with information gained 

from interviews with agency officials. 

To determine what USPS guidance for identifying and responding to 

suspicious mail was in place in October 2003 and to what extent actions 

taken by USPS personnel were in accordance with this guidance, we 

reviewed USPS guidance available in October 2003 for identifying and 
Appendix I

Scope and Methodology

Page 53 GAO-05-716 U.S. Postal Service

initially responding to suspicious mail, analyzed this guidance for clarity 

and consistency, and compared actions taken by USPS personnel with 

steps in this guidance. In performing this analysis, we also reviewed related 

USPS procedures and guidance for identifying, handling and responding to 

hazardous materials in the mail and USPS guidance on actions to take 

during emergencies. We also reviewed USPS guidance on communicating 

with employees and unions that could pertain to suspicious mail incidents 

and compared USPS’s actions to communicate with employees and unions 

with its existing guidance on such communication. We also interviewed 

local and national officials from USPS and postal unions about suspicious 

mail and other related guidance, actions taken during the response, and 

communication with employees and the unions about the incident. We used 

information from the interviews to further understand and clarify USPS 

guidance and actions taken during the response.

To determine what changes USPS has made in its guidance since the 

incident and to what extent current USPS guidance addresses issues raised 

by the incident, we reviewed current USPS guidance related to suspicious 

mail and communicating with employees and the unions about suspicious 

mail incidents, and compared it to guidance available during the incident to 

identify changes and the extent to which improvements have been made 

that address issues raised by the incident. To assist in evaluating USPS 

suspicious mail guidance, we also reviewed guidance developed by CDC, 

DHS, the General Services Administration and others on mail security and 

responding to biological threats in the mail and reports of the USPS Office 

of the Inspector General related to suspicious mail. We reviewed previous 

GAO work on risk management and risk communication, as well as some 

other pertinent literature, and compared this information with USPS 

guidance to determine whether they incorporated a risk management or 

risk communication approach in their guidance. We also reviewed previous 

GAO work on USPS’s response to anthrax to obtain a broader perspective 

on how USPS has responded to risks posed by biological threats in the mail 

system. In addition, we interviewed USPS officials concerning how USPS’s 

suspicious mail guidance was developed, plans for updating or revising 

current guidance and developing new guidance, and how USPS used risk 

management in the development of its guidance. We also interviewed 

officials from the American Postal Workers Union and the National Postal 

Mail Handlers Union about USPS communication with employees and 

unions during suspicious mail incidents. Finally, we reviewed scientific 

literature on ricin and interviewed experts in CDC and the U.S. Army 

Medical Research Institute of Infectious Diseases to determine the 
Appendix I

Scope and Methodology

Page 54 GAO-05-716 U.S. Postal Service

potential health risks associated with ricin or other biological or chemical 

agents in the mail system.

We limited the suspicious mail guidance we reviewed to those pertaining to 

the initial discovery of a suspicious mail piece until the point when the mail 

piece is removed from the facility. We also limited the comparison of 

actions USPS took with suspicious mail guidance to actions taken from the 

initial discovery through the removal of the envelope from the facility, 

except for communication with employees and unions, which we covered 

until final results of testing of the envelope and its contents were available. 

We did not review the Postal Service’s implementation of its biohazard 

detection systems or related procedures, other than aspects of these 

procedures that pertained to communications with employees and unions. 

We did not review the communication among all involved agencies or with 

emergency responders or the public. We also did not review the procedures 

of other agencies or of the Inspection Service. Finally, we did not review 

the capability of the Inspection Service or other agencies to conduct initial 

threat assessments or actions relating to the investigation of this incident.

We performed our work from June 2004 through May 2005 in Washington, 

D.C.; Greenville, South Carolina; Columbia, South Carolina; Charlotte, 

North Carolina; and Atlanta, Georgia. We conducted our review in 

accordance with generally accepted government auditing standards.
Page 55 GAO-05-716 U.S. Postal Service

Appendix II

Comments from the U.S. Postal Service ApendxiI
Appendix II

Comments from the U.S. Postal Service

Page 56 GAO-05-716 U.S. Postal Service
Appendix II

Comments from the U.S. Postal Service

Page 57 GAO-05-716 U.S. Postal Service
Page 58 GAO-05-716 U.S. Postal Service

Appendix III

Contact and Staff Acknowledgments ApendxiI

Contact Katherine Siggerud, (202) 512-2834 or siggerudk@gao.gov.

Staff 

Acknowledgments

In addition to the above, Susan Fleming, Assistant Director; Heather 

Balent; Colin Fallon; Scott Farrow; Judy Guilliams-Tapia; Daniel Kaneshiro; 

Jamie Meuwissen, and Matthew Mohning made key contributions to this 

report.
Page 59 GAO-05-716 U.S. Postal Service

Related GAO Products

Anthrax Detection: Agencies Need to Validate Sampling Activities in 

Order to Increase Confidence in Negative Results. GAO-05-251. 

Washington, D.C.: March 31, 2005.

21st Century Challenges: Reexamining the Base of the Federal 

Government. GAO-05-325SP. Washington, D.C.: February 2005.

High-Risk Series: An Update. GAO-05-207. Washington, D.C.: January 

2005.

U.S. Postal Service: Better Guidance Is Needed to Ensure an Appropriate 

Response to Anthrax Contamination. GAO-04-239. Washington, D.C.: 

September 9, 2004.

U.S. Postal Service: Clear Communication with Employees Needed Before 

Reopening the Brentwood Facility. GAO-04-205T. Washington, D.C.: 

October 23, 2003.

Bioterrorism: Public Health Response to Anthrax Incidents of 2001. GAO04-152. Washington, D.C.: October 15, 2003.

Capitol Hill Anthrax Incident: EPA's Cleanup Was Successful; 

Opportunities Exist to Enhance Contract Oversight. GAO-03-686. 

Washington, D.C.: June 4, 2003.

U.S. Postal Service: Issues Associated with Anthrax Testing at the 

Wallingford Facility. GAO-03-787T. Washington, D.C.: May 19, 2003.

U.S. Postal Service: Better Guidance is Needed to Improve 

Communication Should Anthrax Contamination Occur in the Future. 

GAO-03-316. Washington, D.C.: April 7, 2003.

Major Management Challenges and Program Risks: U.S. Postal Service. 

GAO-03-118. Washington, D.C.: January 2003.

Diffuse Security Threats: USPS Air Filtration Systems Need More Testing 

and Cost Benefit Analysis Before Implementation. GAO-02-838. 

Washington, D.C.: August 22, 2002.

U.S. Postal Service: Moving Forward on Financial and Transformation 

Challenges. GAO-02-694T. Washington, D.C.: May 13, 2002.
Related GAO Products

Page 60 GAO-05-716 U.S. Postal Service

Highlights of GAO’s Conference on Options to Enhance Mail Security and 

Postal Operations. GAO-02-315SP. Washington, D.C.: December 20, 2001.

Homeland Security: A Risk Management Approach Can Guide 

Preparedness Efforts. GAO-02-208T. Washington, D.C.: October 31, 2001.

Combating Terrorism: Observations on Biological Terrorism and Public 

Health Initiatives. GAO/T-NSIAD-99-112. Washington, D.C.: March 16, 

1999.

(543103)
GAO’s Mission The Government Accountability Office, the audit, evaluation and 

investigative arm of Congress, exists to support Congress in meeting its 

constitutional responsibilities and to help improve the performance and 

accountability of the federal government for the American people. GAO 

examines the use of public funds; evaluates federal programs and policies; 

and provides analyses, recommendations, and other assistance to help 

Congress make informed oversight, policy, and funding decisions. GAO’s 

commitment to good government is reflected in its core values of 

accountability, integrity, and reliability.

Obtaining Copies of 

GAO Reports and 

Testimony

The fastest and easiest way to obtain copies of GAO documents at no cost 

is through GAO’s Web site (www.gao.gov). Each weekday, GAO posts 

newly released reports, testimony, and correspondence on its Web site. To 

have GAO e-mail you a list of newly posted products every afternoon, go to 

www.gao.gov and select “Subscribe to Updates.”

Order by Mail or Phone The first copy of each printed report is free. Additional copies are $2 each. 

A check or money order should be made out to the Superintendent of 

Documents. GAO also accepts VISA and Mastercard. Orders for 100 or 

more copies mailed to a single address are discounted 25 percent. Orders 

should be sent to:

U.S. Government Accountability Office

441 G Street NW, Room LM

Washington, D.C. 20548

To order by Phone: Voice: (202) 512-6000 

TDD: (202) 512-2537 

Fax: (202) 512-6061

To Report Fraud, 

Waste, and Abuse in 

Federal Programs

Contact:

Web site: www.gao.gov/fraudnet/fraudnet.htm

E-mail: fraudnet@gao.gov

Automated answering system: (800) 424-5454 or (202) 512-7470

Congressional 

Relations

Gloria Jarmon, Managing Director, JarmonG@gao.gov (202) 512-4400

U.S. Government Accountability Office, 441 G Street NW, Room 7125 

Washington, D.C. 20548

Public Affairs Paul Anderson, Managing Director, AndersonP1@gao.gov (202) 512-4800

U.S. Government Accountability Office, 441 G Street NW, Room 7149 

Washington, D.C. 20548