What should you do with evidence after a security incident?

• A. Destroy evidence to avoid triggering an investigation.
• B. Preserve evidence and document times and actions according to SOP.
• C. Move evidence to the galley to secure it.
• D. Broadcast the existence of evidence to all passengers.

Answer: (B)

Preserving evidence and documenting times and actions according to SOP is essential after a security incident. Treating evidence with care maintains the investigation’s integrity and supports accountability, safety improvements, and any legal or regulatory requirements. This means securing items, video footage, logs, and witness statements, and keeping a clear record of who touched what, when, where it was stored, and what steps were taken. This creates a reliable chain of custody and an accurate timeline for investigators.

Destruction of evidence would jeopardize the investigation and could be illegal. Moving evidence to the galley risks contamination or misplacement. Broadcasting that evidence exists to passengers would cause unnecessary alarm and could compromise the investigation.