The First Twenty-Four Hours: What to Do When a CEO Receives a Threatening Letter

The envelope was the fourth one in the stack, and it was the only one addressed by hand.

Tuesday, a little after ten. Reception had sent the mail up with a box of printer toner. The executive assistant sorted it between a calendar change and a call she was waiting on. Two invoices. A conference brochure. Then the envelope. Blue ink, block capitals, no return address.

There was one page inside. She read it standing. Then she sat down and read it again.

She did not take it into the office behind her. The door was open, and she could hear him on a call. She laid the page on the desk, set the envelope beside it, and dialed the general counsel.

He came down the back stairs instead of waiting for the elevator. He said nothing when he got there. He bent over the desk with his hands in his pockets and read the page. Then he read it again.

He straightened up and looked at her.

“Who else has touched this?”

---

When an executive receives a threatening letter, the first twenty-four hours decide three things: whether the evidence survives, whether the right authorities are told, and whether the company can later show what it knew and what it did.

The general counsel’s question was the first right decision of that day. None of the three can be recovered later. A letter handled carelessly in the first hour stays handled. A report made on Friday reads differently from one made on Tuesday. And a decision no one wrote down is, for any later purpose, a decision no one made.

What follows is the order we work in when a client calls on that day. Blue Goose Security Transportation is licensed by the Texas Department of Public Safety as a Class C security and investigations company, License C31088701. The needs assessment and advance work described below are carried out under that license. Most of the day, though, belongs to the company. This is what it should do.

The day at a glance

When	What to do	Who owns it
First hour	Stop handling the letter and envelope. List everyone who touched them. Do not reply to the sender. Keep the circle small.	Whoever received it; general counsel
Within the morning	Report to local police. Mailed threats: U.S. Postal Inspection Service. Online threats across state lines: FBI.	General counsel, security lead
Same day	Needs assessment: interviews with the executive and the people around them to set the level of risk.	Security lead, protection provider
Before evening	Proportionate interim measures: residence, commute, published schedule, household, mailroom, public exposure.	Security lead
Throughout	Decision log: the time, what was known, what was decided, and why.	General counsel
End of day one	Hand off to a documented risk assessment with a set re-evaluation date.	A named owner

The first hour: preserve the letter and contain it

The first hour is for keeping what you have and keeping it from spreading. Nothing more is asked of it.

Stop handling the letter and the envelope. Whoever is holding them puts them down, and no one else picks them up. Keep both flat, together, in a clean folder or sleeve.

Write down everyone who has touched them, and when. The mailroom, reception, the assistant, anyone she showed it to. At ten-fifteen this is a short list. By the afternoon it is hard to rebuild.

Do not reply to the sender. Not by mail, phone, email or post, and not to any number or address the letter offers.

Keep the circle small. The people who need to know are the people who need to act. Everyone else can learn later, if at all.

That is the whole first hour. It is short on purpose. What investigators need from the company is a letter that has been left alone and a list of the hands that touched it.

Who to call after a threatening letter, and in what order

The general counsel and the security lead come first, because they own the decisions that follow. Law enforcement comes next. It should come within the morning, not after a meeting about whether to call.

Call the local police where the letter was received. In Texas, a threat of violence intended to put someone in fear of imminent serious bodily injury, or to disrupt a workplace, can be a terroristic threat under Texas Penal Code § 22.07. A written threat meant to alarm can also fall under the harassment statute, § 42.07. The local report is the foundation for everything after it.

Because the threat came by mail, it is also a federal matter. Mailing a threat to kidnap or injure someone is a federal crime under 18 U.S.C. § 876, and the U.S. Postal Inspection Service investigates it. Threats sent across state lines by email, text, phone or social media fall under 18 U.S.C. § 875(c), and the FBI takes those reports. A letter that arrives alongside online messages may involve both.

One point is easy to lose in the relief of having made the call. A police report starts a criminal inquiry. It does not move the company’s duty to its executive onto anyone else. Investigators are building a case, on their own schedule. The executive still drives home tonight, and how that happens is still the company’s decision.

Making a threat is not posing one: assessing the risk

The letter is one data point. Its weight comes from what surrounds it.

Many people who make threats never act, and many who act never warn. Most serious work on executive threat assessment, in Texas or anywhere else, comes back to that finding. So the words on the page matter less than the behavior and circumstances around them.

The signals that change the picture are behavioral. Fixation: a grievance the writer returns to again and again. Research into the executive: the home, the family, the schedule. Attempts to approach, at the office, an event or the house. And leakage, the writer telling other people what they intend.

At Blue Goose, coverage is set by a needs assessment. It is an interview with the executive and the key people around them: the assistant, the general counsel, the security lead, sometimes the household. It establishes a level of risk and determines the coverage that level calls for.

It is not a full security assessment. A full study of an executive’s exposure, residence and organization is deeper, slower work. Where the facts call for one, it is a separate engagement, and we will say so.

The two errors on this day run in opposite directions. Overreaction puts a visible detail on a family that needed a changed commute, and teaches the executive to resent protection. Dismissal files the letter under cranks and waits to see. The assessment exists to avoid both. People ask in the abstract when a CEO needs security. On this day the question has a concrete answer: when the assessment says so.

What changes tonight: interim security measures

Interim measures should be proportionate. Enough to close the obvious gaps before evening. Not so much that the company announces it is frightened.

• The residence. Decide who checks it before the executive gets home.
• The commute. Vary it. A different time, a different route, a different door.
• The schedule. Pull whatever is published: speaking dates, conference listings, any calendar an outside office can see.
• The household and the assistant. Brief them in plain terms: what arrived, what is being done, and whom to call.
• Reception and the mail. Tell them how to handle anything similar that arrives, and who to call when it does.
• Public exposure. Run a quick scrub of where the executive’s home, family and movements appear in public, and take down what can come down today.

If the needs assessment supports close protection, it can begin the same night. In Texas, that means licensed personal protection officers working for a company licensed under Chapter 1702 of the Occupations Code. Ours are protective officers employed W-2, who train together and requalify quarterly. That is the difference between a team and a roster assembled the afternoon of the call. Where the executive already has a team, interim coverage works alongside it, as we describe in The Visiting Detail.

Write it down as you go: the decision log

Keep a decision log from the first hour. One line per decision: the time, what was known, what was decided, and why.

It does not need to be elegant. 10:20. Letter isolated; four people had handled it. 11:05. Police report filed. 14:30. Commute changed for tonight; household briefed. A shared document with one owner, usually the general counsel, is enough.

The log becomes the duty-of-care record. When a board member asks next month what the company did, or a lawyer asks next year, the answer is a document written at the time. It is not a memory assembled afterward. Why that record carries the weight it does is the subject of Duty of Care as a Demonstration.

When the twenty-four hours end: handoff and re-evaluation

The first day ends with a handoff, not a resolution. The interim measures, the police report and the decision log feed a documented assessment of the executive’s risk. That assessment sets a date to re-evaluate, and someone owns the date.

Some letters lead nowhere. Some are the first of several. A dated re-evaluation is how the company learns which one it has, instead of letting the measures lapse once the office calms down.

The documentation does a second job. A documented study of the executive’s risk also bears on how the protection that follows is treated for tax purposes. We cover that in A House Is Not an Employer.

General information only. Not legal, tax or accounting advice. Consult your own advisers about your company’s situation.