Security Intelligence

Family Protection Security: Children, School Runs, and HNWI Families | CloseProtectionHire

Q: "When should an HNWI or executive consider security for their children?"

"The threshold for implementing security for children is lower than for the principal, because children are more vulnerable, less situationally aware, and present a more emotionally coercive leverage point for a kidnap-for-ransom operation. The relevant factors are: whether the family's wealth, the principal's public profile, or the principal's employer creates a KFR risk that is reflected in a current threat assessment; whether the children are identifiable (named on school websites, in press coverage, tagged in social media posts); and the security environment of the locations where the children spend time -- school, after-school activities, and travel routes. For families living in or travelling to P1 cities, the threshold is materially lower: in Lagos, Bogota, Manila, Nairobi, and Istanbul, the KFR risk profile that applies to any perceived wealthy family applies to their children. A family whose principal has a security programme but whose children have none presents an asymmetric vulnerability that a sophisticated threat actor will identify and exploit."

Q: "What are the main online safety risks for children of public figures?"

"Children of public figures face three specific risks that are distinct from standard child online safety concerns. First, location disclosure: children posting to social media from named locations -- school, home, sports clubs, or on holiday -- provide a real-time pattern-of-life for anyone interested in locating or targeting the family. EXIF metadata embedded in photographs discloses GPS coordinates unless stripped. Second, social engineering: children are more susceptible to grooming-style social engineering approaches on social media platforms, where the objective may be to gather information about the principal's patterns, properties, or travel. This is a documented intelligence-gathering vector used by organised crime. Third, digital kidnap: the harvesting of a child's images from social media to create fake profiles or to use as leverage. The UK Online Safety Act 2023 imposes obligations on platforms to protect children, but parental management of a child's digital footprint is the primary control."

Q: "How does the school run create a security vulnerability?"

"The school run is one of the most predictable elements of a high-profile family's routine. The same vehicle, the same route, the same times, the same drop-off and collection points, repeated daily. Hostile reconnaissance planning documents describe fixed routine and predictable patterns as the primary enablers of a successful approach. Specific vulnerabilities include: the school gate is a public, uncontrolled environment where anyone can observe collection times and vehicle identification; the route to and from school creates a predictable movement corridor that can be surveilled or interdicted; and the period while a child waits for collection is an unaccompanied window if the driver is late. Controls: route variation, varying departure times where possible, a security driver rather than a personal driver, a policy on who is authorised to collect the child and a verification protocol for ad hoc changes, and a briefing to the school's safeguarding lead on the security posture."

Q: "What does a child close protection deployment look like?"

"Child close protection is typically low-profile rather than visible. An overt armed or uniformed escort for a child creates social problems at school and in peer interactions. The standard deployment is a security-aware driver who accompanies the child, combined with a protective officer who may be positioned at the school or club rather than directly with the child. The protective officer coordinates with the school safeguarding lead, has the access credentials required to collect the child, and has the communication protocol to escalate any concern immediately. For families in P1 cities, the deployment is more overt: a vehicle with a driver and a protective officer, vetted school transport arrangements, and a protocol for communicating between the child's escort and the principal's close protection team. The child's age, awareness, and social environment all affect how visible the protective presence should be. A 16-year-old in a London secondary school has different requirements from a 7-year-old in Lagos."

Q: "What security briefing should family members receive?"

"Family security briefings should be graduated by age and role. For a spouse or adult partner: a full briefing on the threat assessment, the security protocols, and what to do if they believe they are being surveilled or followed. The briefing should cover: not confirming travel plans on social media; recognising surveillance indicators; what to do in an emergency (emergency contact, secure address, communication protocol); and awareness of the domestic staff security protocols. For older children (approximately 14+): an age-appropriate briefing covering social media OPSEC (what not to post and why), awareness of approaches by strangers including social engineering on social media, and a simple emergency protocol. For younger children: no formal security briefing, but supervision of social media accounts, a clear rule about not disclosing home address or school name online, and age-appropriate stranger awareness. The Suzy Lamplugh Trust and the NPSA both publish materials that can be adapted for family security briefings."

Security planning for HNWI and executive families. Covers school run security, online safety for children of public figures, kidnap risk assessment, domestic staff vetting, and close protection for family members.

12 May 2026

Written by James Whitfield, Senior Security Consultant

Speak to the Team

Security for HNWI and executive families addresses a targeting risk that is structurally different from the risk facing the principal alone. Family members – particularly children – are less situationally aware, more vulnerable to social engineering, and present a more emotionally compelling leverage point for a kidnap-for-ransom operation. A sophisticated threat actor who assesses that the principal is too well protected will look for the less protected asset.

The starting point for any family protection assessment is not the threat – it is the exposure. What information about the family is publicly available? Where do family members appear online? What pattern-of-life information is knowable from public sources? The answer to those questions determines the realistic threat.

The Digital Footprint Audit

The most common finding in a family protection assessment is that the family’s digital footprint has not been audited since before the principal’s current profile was established.

Sources of exploitable family information:

LinkedIn and company websites. Executive biographies frequently list the city of residence, the names of family members, or the school attended. These are standard CV fields completed without security review.
Social media accounts. Children’s social media accounts (Instagram, TikTok, Snapchat) tagged to named locations; the spouse’s or partner’s posts that disclose home address, school routes, or holiday plans; background detail in photographs that identifies the property, street, or school.
School and club websites. Many independent schools and sports clubs publish pupil names, year groups, and activity schedules on publicly accessible websites. Some include photographs.
Data brokers. Aggregator services hold home address, vehicle registration, and family composition data sourced from electoral roll, Companies House, and DVLA records.
EXIF metadata. Photographs taken on smartphones contain embedded GPS coordinates unless the camera location service is disabled or metadata is stripped before posting. A photograph posted from school, home, or a holiday villa contains precise location data.

The audit begins with a structured OSINT review of all publicly accessible information about the principal and family. The output identifies what a threat actor can know without any specialist capability, and what can be removed, suppressed, or obscured.

The School Run

The school run represents a fixed routine in a public, uncontrolled environment – the conditions that hostile surveillance documentation identifies as optimal for a static approach or an interdiction.

The school gate is a public space where vehicle types, registration plates, arrival and departure times, and the identity of collecting adults are all observable. A child who is collected by the same vehicle at the same time every weekday has a predictable pattern-of-life that requires no significant surveillance effort to document.

Controls:

Route variation. At minimum two separate routes between the home and the school, used on a variable pattern. The route should not be the most direct – it should be chosen for security characteristics.
Security driver. A driver with a security awareness qualification and, where the threat level warrants it, close protection training. The driver’s role includes surveillance detection, not just transport.
Authorised collection list. A list of named, vetted adults who are authorised to collect the child, communicated to the school safeguarding lead. Any change to the authorised list is confirmed by a pre-agreed code word, not simply a phone call. This controls against social engineering of school staff.
Communication protocol. The child and the driver both have a communication protocol: if the driver is delayed, the child waits inside (not outside the gate); if the child does not emerge within a defined window of the agreed time, the driver contacts the school and the family’s security function.

School Safeguarding Integration

UK schools have a statutory safeguarding lead under the Education Act 2002 and Keeping Children Safe in Education (KCSIE, 2024 edition). The safeguarding lead is the appropriate contact for communicating the family’s security posture in a school context.

The communication to the school safeguarding lead should:

Identify any restrictions on who may collect the child and the verification procedure
Note whether any third-party interest in the child has been identified (without disclosing sensitive threat details)
Provide an emergency contact for the family’s security function
Establish a protocol for the school to alert the family if any unusual enquiry about the child is received

The school cannot be required to implement a client’s security protocols, but most independent schools and many state schools will accommodate reasonable safeguarding requests if they are communicated clearly and at the appropriate level.

Child Close Protection

A visible uniformed escort for a child at school creates social difficulties and is generally counter-productive. The deployment model is typically low-profile: a security-aware driver for school transport, and – for higher-threat situations – a protective officer who is positioned at the school or activity venue rather than directly with the child during school hours.

Deployment calibration by threat level:

Lower threat (general HNWI profile, no specific threat). Security-aware driver, route variation, authorised collection protocol, digital footprint management.
Elevated threat (specific surveillance indicator or threat communication). Driver with CP training, protective officer for school transport and activity pick-up, enhanced residential security, school safeguarding notification.
High threat (credible KFR risk). Driver and protective officer in vehicle, counter-surveillance, potential school change or temporary home schooling, principal protection team coordinates with family protection team.

For families in P1 cities, the baseline for any family with a principal who has a security programme is elevated-threat-level measures. The KFR risk in Lagos, Nairobi, Bogota, Manila, and Istanbul applies to family members without the same discretion applied to the principal’s own programme.

Domestic Staff with Child Supervision Roles

A nanny, au pair, babysitter, or childminder who has unsupervised access to children is the most security-sensitive domestic role in the household. The vetting requirement is higher than for housekeeping or ground staff.

Minimum vetting for child supervision roles:

Enhanced DBS check (in England and Wales); equivalent check in the staff member’s country of residence for the preceding 5 years
Right-to-work verification
Two professional references with telephone follow-up (not email – verbal reference is harder to fabricate)
Social media review: check the applicant’s own social media presence for indicators of indiscretion regarding employer or household information
Probationary period with supervision and a structured review at 3 months

For P1 city families, any domestic staff member with child access also requires an in-country background check with criminal record database access, sourced from a vetted local provider.

For the broader domestic staff security vetting process covering all household roles, see our domestic staff security vetting guide. For the residential security measures that provide the physical security layer for family protection, see our residential security for executives guide.

Sources: OSAC: KFR Risk Assessment for Family Members of Executive Travellers 2024. Aid Worker Security Database: Non-Principal Family Member Incidents 2020-2024. Control Risks: Family Security Assessment Methodology 2024. Suzy Lamplugh Trust: Personal Safety at Home and in the Community 2024. NPSA: Protecting Your Family – HNWI Guidance Note 2024. UK Online Safety Act 2023. DfE: Keeping Children Safe in Education (KCSIE) 2024. UK GDPR: Article 4 and Schedule 1 DPA 2018 (Special Category Data). Childnet International: Child Online Safety for Families in the Public Eye 2023. ASIS International: Executive and Family Protection Standards 2023.

Summary

Key takeaways

Social media is the primary intelligence source for KFR targeting of families

A family whose principal is publicly identifiable -- through press, LinkedIn, social media, or company websites -- and whose children are tagged in social media posts, named on school websites, or visible in background photographs, has effectively published a pattern-of-life targeting package. The audit of a family's digital footprint -- the principal's, the spouse's, and the children's combined -- is the starting point for any family protection assessment.

The school environment is outside the control of the security team

The school safeguarding lead is the security focal point within the school, but the school operates its own security protocols and cannot be required to implement a client's personal security measures. Building a relationship with the school safeguarding lead, providing a clear brief on the security posture without disclosing sensitive details of the threat assessment, and agreeing a communication protocol for any concerning approaches or requests for information about the child is the correct approach.

Domestic staff with child supervision roles require enhanced vetting

A nanny, au pair, or childminder who supervises children unsupervised is one of the most security-sensitive roles in a household. Enhanced DBS (previously CRB) check, right-to-work verification, two professional references with telephone follow-up, and a probationary period with supervision are the minimum. For P1 city families, any domestic staff member with access to the children also requires a local background check through an in-country provider with law enforcement database access.

Children in P1 cities face KFR risk regardless of principal's security posture

A principal with a security driver and a close protection team who sends their children to school in an unaccompanied family vehicle on a fixed daily route has created an asymmetric vulnerability. In Lagos, Bogota, and Nairobi, this is not a theoretical risk -- the Aid Worker Security Database and OSAC both document cases where children of senior executives or diplomats were the target of approach or surveillance before the family implemented protective measures.

Family location should be excluded from all public-facing employer content

Executive profiles on company websites and LinkedIn frequently include residential city, school attended, and sports clubs. These details are not included by accident -- they appear in biography fields and About sections that are completed without any security review. A security audit of all public-facing content for the principal and their family members should be the first action in any family protection programme. Data broker removal (DeleteMe, Kanary) should follow.

FAQ

Frequently Asked Questions

The threshold for implementing security for children is lower than for the principal, because children are more vulnerable, less situationally aware, and present a more emotionally coercive leverage point for a kidnap-for-ransom operation. The relevant factors are: whether the family’s wealth, the principal’s public profile, or the principal’s employer creates a KFR risk that is reflected in a current threat assessment; whether the children are identifiable (named on school websites, in press coverage, tagged in social media posts); and the security environment of the locations where the children spend time – school, after-school activities, and travel routes. For families living in or travelling to P1 cities, the threshold is materially lower: in Lagos, Bogota, Manila, Nairobi, and Istanbul, the KFR risk profile that applies to any perceived wealthy family applies to their children. A family whose principal has a security programme but whose children have none presents an asymmetric vulnerability that a sophisticated threat actor will identify and exploit.

Children of public figures face three specific risks that are distinct from standard child online safety concerns. First, location disclosure: children posting to social media from named locations – school, home, sports clubs, or on holiday – provide a real-time pattern-of-life for anyone interested in locating or targeting the family. EXIF metadata embedded in photographs discloses GPS coordinates unless stripped. Second, social engineering: children are more susceptible to grooming-style social engineering approaches on social media platforms, where the objective may be to gather information about the principal’s patterns, properties, or travel. This is a documented intelligence-gathering vector used by organised crime. Third, digital kidnap: the harvesting of a child’s images from social media to create fake profiles or to use as leverage. The UK Online Safety Act 2023 imposes obligations on platforms to protect children, but parental management of a child’s digital footprint is the primary control.

The school run is one of the most predictable elements of a high-profile family’s routine. The same vehicle, the same route, the same times, the same drop-off and collection points, repeated daily. Hostile reconnaissance planning documents describe fixed routine and predictable patterns as the primary enablers of a successful approach. Specific vulnerabilities include: the school gate is a public, uncontrolled environment where anyone can observe collection times and vehicle identification; the route to and from school creates a predictable movement corridor that can be surveilled or interdicted; and the period while a child waits for collection is an unaccompanied window if the driver is late. Controls: route variation, varying departure times where possible, a security driver rather than a personal driver, a policy on who is authorised to collect the child and a verification protocol for ad hoc changes, and a briefing to the school’s safeguarding lead on the security posture.

Child close protection is typically low-profile rather than visible. An overt armed or uniformed escort for a child creates social problems at school and in peer interactions. The standard deployment is a security-aware driver who accompanies the child, combined with a protective officer who may be positioned at the school or club rather than directly with the child. The protective officer coordinates with the school safeguarding lead, has the access credentials required to collect the child, and has the communication protocol to escalate any concern immediately. For families in P1 cities, the deployment is more overt: a vehicle with a driver and a protective officer, vetted school transport arrangements, and a protocol for communicating between the child’s escort and the principal’s close protection team. The child’s age, awareness, and social environment all affect how visible the protective presence should be. A 16-year-old in a London secondary school has different requirements from a 7-year-old in Lagos.

Family security briefings should be graduated by age and role. For a spouse or adult partner: a full briefing on the threat assessment, the security protocols, and what to do if they believe they are being surveilled or followed. The briefing should cover: not confirming travel plans on social media; recognising surveillance indicators; what to do in an emergency (emergency contact, secure address, communication protocol); and awareness of the domestic staff security protocols. For older children (approximately 14+): an age-appropriate briefing covering social media OPSEC (what not to post and why), awareness of approaches by strangers including social engineering on social media, and a simple emergency protocol. For younger children: no formal security briefing, but supervision of social media accounts, a clear rule about not disclosing home address or school name online, and age-appropriate stranger awareness. The Suzy Lamplugh Trust and the NPSA both publish materials that can be adapted for family security briefings.

Get in Touch

Request a Consultation

Describe your security requirements below. All enquiries are confidential and handled by licensed consultants.