BOLO reports: writing a be-on-the-lookout alert your officers can act on

01

What a BOLO report is, and what rules touch it

BOLO stands for be on the lookout. Police agencies use the term for an alert about a suspect in a crime, a wanted or missing person, or a vehicle, and private security borrowed it for the same job on a single property or a portfolio. On a site, a BOLO report (also called a BOLO bulletin, BOLO alert or lookout notice) is a short, written instruction from the security supervisor, the account manager or the client's security lead: here is a person, vehicle or item that matters to this property, here is why, and here is what you do if you see it.

No federal statute and no OSHA standard sets the form of a BOLO. It is an internal operating document, like post orders, and it should sit alongside them rather than replace them. Several rules still shape what a BOLO can say and how it is used:

• Workplace violence programs. OSHA's workplace violence page defines workplace violence as "any act or threat of physical violence, harassment, intimidation, or other threatening behavior that occurs at the work site." There is no specific OSHA standard for it; OSHA enforces it under the General Duty Clause, Section 5(a)(1) of the OSH Act. A BOLO about a person who has threatened staff is often one of the controls in an employer's prevention program.
• California's plan and log. Most California employers have needed a written workplace violence prevention plan and a violent incident log since July 1, 2024, under California Labor Code section 6401.9. A BOLO can be one way the plan's response procedures reach the officers on post.
• Civil rights law. Title II of the Civil Rights Act of 1964 entitles everyone to the full and equal enjoyment of places of public accommodation, such as hotels, restaurants, theaters and arenas, "without discrimination on the ground of race, color, religion, or national origin." A BOLO that works as a list of people to turn away on the basis of how they look is a legal risk as well as a bad practice. Check your state's own civil rights law too, which may reach further.

A security officer is not a police officer. What an officer may lawfully do on seeing a BOLO subject, including any power to detain or arrest, depends on the state, the officer's license and the client's instructions. The BOLO should say what the officer does, and for most posts that means observe, report and keep people safe.

02

When a BOLO is the right tool

A BOLO earns its place when there is a specific, identifiable subject and a specific reason to expect them at this property. Typical triggers:

• A trespass warning or notice. Someone has been told in writing not to return. The BOLO lets every shift recognize them and follow the site's trespass procedure if they do.
• A threat to an employee or tenant. A former employee who left after making threats, or a person named in a protective or restraining order that an employee has shared with the employer. Handle these with HR and legal counsel; the person protected by the order should agree to what the officers are told.
• A vehicle linked to incidents. Break-ins in the parking garage, a car seen repeatedly casing the loading dock, a vehicle involved in a hit-and-run on the lot.
• A missing or vulnerable person. A resident who wanders from a senior living community, a child separated from a parent at an event. These BOLOs are urgent and short-lived.
• Stolen or missing property. A laptop cart, a set of master keys, a tenant's bicycle.
• A police BOLO shared with the property. Police officers sometimes ask a property to watch for a suspect or a vehicle after a crime nearby. Record who asked, when, and the officer's contact number.
• A pattern of behavior. Someone photographing access points, testing doors or asking staff about shift times. The Department of Homeland Security's guidance on recognizing the signs describes suspicious activity as "any observed behavior that may indicate pre-operational planning associated with terrorism or terrorism-related crime."

A BOLO is the wrong tool for a vague unease. "Watch out for anyone suspicious near the east entrance" gives an officer nothing to recognize and invites them to fill the gap with appearance. If there is a place of concern rather than a subject, the right document is a change to the post orders or an added patrol point, not a BOLO.

03

What goes in a BOLO report

A BOLO has to be read in thirty seconds at the start of a shift and recalled hours later on a dark parking level. Keep it to one page, put the action near the top, and use the same fields every time so officers know where to look:

1. Reference and dates. A BOLO number, the date and time it was issued, and a review or expiry date. Every BOLO should have an end.
2. Issued by and on whose authority. The supervisor or manager issuing it, and the client contact or police officer who asked for it, with a phone number.
3. Action. What the officer does on a sighting, in order. For example: do not approach; keep the person in view from a safe distance; call the supervisor on the radio; call 911 if anyone is threatened; record the time and location. If the site's post orders allow the officer to speak to the person or deliver a trespass warning, say so here.
4. Reason. The specific conduct or order behind the BOLO, stated factually: "issued a written trespass warning on Sept. 14 after damaging the lobby turnstile," not "known troublemaker." A suspected crime is written as a suspicion, never as a finding that the subject is a criminal.
5. Subject description. Name if known and lawful to share, approximate age, height and build, hair, distinguishing marks, and clothing at the last sighting, marked as such because clothing changes. A clear, recent photo if one exists, with its source and date.
6. Vehicle. Make, model, color, body style, plate and issuing state, and any damage or stickers that make it recognizable.
7. Where and when. Last seen location and time, and any known pattern: arrives at the loading dock after 10 p.m., uses the north garage ramp.
8. Who is told. The distribution list: which posts, which shifts, which client contacts, and who must not be told.
9. Handling. A line marking it confidential, for internal security use only, not to be posted where the public can read it or copied to a personal phone.

Before it goes out, ask two questions. Could an officer who has never met the subject pick them out from this alone? Would it read, aloud to the subject, as a fair and factual account? If not, rewrite it.

04

Briefing, patrolling and responding to a BOLO

A BOLO that sits in a binder does nothing. The weak point is almost always the handover: day shift is briefed in person, and the relief officer at 11 p.m. inherits a sheet of paper they may not read. Make the briefing part of the routine:

• At every shift change, the outgoing officer points to open BOLOs in the daily activity report (DAR) or pass-down log, and the incoming officer confirms they have read each one.
• In the post orders, a standing instruction says where open BOLOs are kept and that officers read them before taking post, so relief and fill-in officers find them too.
• In the patrol, the supervisor adds focus to the points the BOLO names: the garage elevator lobby between 5 and 7 p.m., the loading dock gate after dark. The BOLO changes where officers look, not what they are allowed to do.
• Out of public view. A BOLO taped to the lobby desk facing visitors is a privacy problem and a warning to the subject.

When an officer believes they have seen the subject, the sequence in the Cybersecurity and Infrastructure Security Agency's de-escalation series fits well: recognize the warning signs, assess the situation to protect personal safety, de-escalate only if it is safe to do so, and report through the organization's reporting channels. CISA's own emphasis is that safety is the highest priority and that people should know their limits and get help immediately when they need it. For an immediate threat, that means 911.

Afterward, the sighting is written up. Time, place, what the officer saw, what they did, who they told and what happened next go in the daily activity report, and an incident report follows if anything more than a sighting occurred. DHS's advice for reporting suspicious activity, on its how to report page, is a good discipline for these entries: who or what you saw, when you saw it, where it occurred, and why it is suspicious.

05

Keeping a BOLO fair, private and short-lived

The most common way a BOLO goes wrong is not that the subject is missed. It is that the wrong person is stopped. DHS is direct about this on its Recognize the Signs page: "Factors such as race, ethnicity, sex, national origin, religion, or disability are not suspicious." CISA's de-escalation materials make the same point, telling people not to report based solely on protected activities or on race, religion, gender, sexual orientation, age or disability. A BOLO should be anchored to conduct, a documented order or a specific identifiable person, never to a type of person.

The Federal Trade Commission's action against Rite Aid shows the failure at scale. In its December 19, 2023 press release, the FTC said the company built "a database of images of individuals" it considered "persons of interest," and that many of the tens of thousands of images "were low-quality and came from Rite Aid's security cameras, employee phone cameras and even news stories." The FTC said the system generated "thousands of false-positive matches," and that employees acting on them "followed consumers around its stores, searched them, ordered them to leave, called the police to confront or remove consumers, and publicly accused them." Rite Aid was prohibited from using facial recognition technology for surveillance purposes for five years.

Most security teams will never run facial recognition, but the lessons carry straight over to a BOLO binder:

• Image quality matters. A grainy ceiling-camera still is a guess, not an identification; officers confirm with the supervisor before acting on a likeness alone.
• Every entry has a documented reason, the name of whoever approved it and a review date, typically weeks rather than months.
• Distribution is limited to those who need it, and copies are removed when it ends.
• Actions are proportionate. Observation and a call to the supervisor, not a public confrontation in a lobby.

Keep the BOLO separate from the records the law requires. In California, the violent incident log under Labor Code section 6401.9 records the date, time and location of each incident, its type and a detailed description, but must omit personal identifying information such as a person's name, address, email address, phone number or Social Security number, and is kept for at least five years. A BOLO that names a subject is a different document with a different purpose, and one should never be pasted into the other.

When a BOLO ends, issue a short cancellation with its number and the reason, remove every copy and note it in the daily activity report so the next shift knows.

06

Where the BOLO process fails, and where SiteClara fits

The BOLO itself is rarely the problem. What fails is the routine around it. The supervisor adds the garage elevator lobby to the evening patrol, and the DAR says "patrol completed, all secure" whether anyone walked there or not. A BOLO issued for two weeks is still taped up in March because nobody owns the review.

SiteClara records the routine part of the shift where it happens. A printed QR poster, with an optional NFC tag behind it, goes at each checkpoint the post orders name, including the points a BOLO adds focus to: the garage elevator lobby, the loading dock gate, the fitness center door. The officer scans the code or taps the tag on their own phone, with no app to install, sees the checks due at that point and marks them done, or says what stopped them. The time and the named officer are recorded as it happens, with a photo of the checkpoint when one is asked for. A problem found on the round, such as that unlocked gate, is reported there and goes onto the team's list of jobs until someone closes it.

The security supervisor sees what was due, done and missed, with the reason where one was given, and a job that needs the building manager can be escalated to them to answer. Each day the supervisor reviews the totals and photos, adds a note and approves a report that goes to nominated management or client contacts at 8 a.m. the next morning, showing what was reported, what was completed, what is still open and how the scheduled checks went.

07

Questions people ask

What is a BOLO report?

A BOLO report is a be-on-the-lookout alert: a notice telling officers who or what to watch for and what to do on a sighting. Some police agencies also publish them to the public; the Georgia Bureau of Investigation's BOLO's (Be On the Lookout) page describes a vehicle linked to a shooting death investigation and asks anyone with information to call its tip line. On a private property, a BOLO report does the same job for the security team, and is kept for internal use.

What does BOLO stand for?

BOLO stands for be on the lookout. The Department of Homeland Security's Homeland Security Information Network page for law enforcement uses the term this way, listing "Be on the Lookouts (BOLOs)" among the law enforcement sensitive documents that agencies share on the network.

Is a BOLO like a warrant?

No. An arrest warrant is a court order. Under Rule 4 of the Federal Rules of Criminal Procedure, a judge must issue one when a criminal complaint or its affidavits establish probable cause to believe that an offense has been committed and that the defendant committed it, unless the government asks for a summons instead, and the warrant must describe the offense, command that the defendant be arrested and be signed by a judge. States have their own rules for their own courts. A BOLO is an alert, not an order: no judge signs it, and a security BOLO gives an officer no power beyond what state law and their license already allow.

08

Further reading, and a list to take away

The official pages worth reading before you write a BOLO procedure:

• OSHA, Workplace Violence.
• California Labor Code section 6401.9.
• CISA, De-escalation Series.
• DHS, Recognize the Signs and How to Report Suspicious Activity.
• FTC, Rite Aid facial recognition press release.
• U.S. Department of Justice, Title II of the Civil Rights Act.

A checklist for every BOLO on your sites:

1. A specific subject and a documented reason: conduct, an order or a police request, never appearance.
2. Approved by a named supervisor or client contact, with a number to call.
3. The action first, in plain steps, consistent with the post orders and the officer's license.
4. A description usable by an officer who has never met the subject, with the photo's source and date.
5. A review date set on the day it is issued.
6. Briefed and acknowledged at every shift change, relief officers included.
7. Kept out of public view, with limited distribution.
8. Patrol focus at the points it names, and evidence those points were walked.
9. Every sighting recorded in the DAR, false ones included.
10. Cancelled in writing when it ends.