The Department of Homeland Security has developed several indicators of possible terrorist activity, and has asked citizens to report those activities to the police. Therefore, a public safety dispatcher should be vigilant for and understand when citizens calls to report any of the following types of activities.
Surveillance
If terrorists have chosen a specific target, that target area will most likely be observed during the planning phase of the operation. They do this in order to determine the strengths, weaknesses and number of personnel that may respond to an incident. Routes to and from the target are usually established during the surveillance phase. It is therefore important to take note of such things as someone recording or monitoring activities, drawing diagrams on or annotating maps, using vision-enhancing devices and/or having in one's possession floor plans or blue prints of places such as high-tech firms, financial institutions or government/military facilities. Any of these surveillance-type acts may be an indicator that something just is not right. Nothing is too trivial and should not be discarded as such.
Indicators are based on the type of surveillance:
- Fixed surveillance is done from a static, often concealed position, possibly an adjacent building, business or other facility. In fixed surveillance scenarios, terrorists may establish themselves in a public location over an extended period of time or choose disguises or occupations such as street vendors, tourists, repair or deliverymen, photographers or even demonstrators to provide a plausible reason for being in the area.
- Mobile surveillance usually entails observing and following persons or individual human targets, although it can be conducted against nonmobile facilities (e.g. driving by a site to observe the facility or site operations). To enhance mobile surveillance many terrorists have become more adept at progressive surveillance.
- Progressive surveillance is a technique whereby the terrorist observes a target for a short time from one position, withdraws for a time (possibly days or even weeks), then resumes surveillance from another position. This activity continues until the terrorist determines target suitability and/or noticeable patterns in the operation’s or target’s movements. This type of transient presence makes the surveillance much more difficult to detect or predict.
- More sophisticated surveillance is likely to be accomplished over a long period of time. This type of surveillance tends to evade detection and improve the quality of information. Some terrorists perform surveillance of a target or target area over a period of months or even years. Public parks and other public gathering areas provide convenient venues for surveillance because it is not unusual for individuals or small groups in these areas to loiter or engage in leisure activities that could serve to cover surveillance activities.
Examples of surveillance include:
- Foot surveillance involving 2-3 individuals working together.
- Mobile surveillance using bicycles, scooters, motorcycles, sport-utility vehicles, cars, trucks, boats or small aircraft.
- Persons or vehicles being seen in the same location on multiple occasions; persons sitting in a parked car for an extended period of time.
- Persons not fitting into the surrounding environment, such as wearing improper attire for the location, or persons drawing pictures or taking notes in an area not normally of interest to a tourist.
- Persons using possible ruses to cover their activities, such as taking on a disguise as a beggar, demonstrator, shoe shiner, fruit or food vendor, street sweeper, or a newspaper or flower vendor not previously recognized in the area.
- Persons videotaping or photographing security cameras or guard locations. Unusual or prolonged interest in security measures or personnel, entry points and
access controls, or perimeter barriers such as fences or walls. - An increase in anonymous threats followed by individuals noticeably observing security reaction drills or procedures. Questioning of security or facility personnel by an individual(s) that appears benign.
Elicitation
The second sign or signal is elicitation. What this means is anyone attempting to gain information about a place, person or operation. An example is someone attempting to gain knowledge about a critical infrastructure like a power plant, water reservoir or maritime port.
Terrorists may attempt to research bridge and tunnel usage, make unusual inquiries concerning shipments or inquire as to how a military base operates. They may also attempt to place "key" people in sensitive work locations.
Tests of Security
Tests of security is another area in which terrorists would attempt to gather data. This is usually conducted by driving by the target, moving into sensitive areas and observing security or law enforcement response. Terrorists would be interested in the time in which it takes to respond to an incident and/or the routes taken to a specific location. They may also try to penetrate physical security barriers or procedures in order to assess strengths and weaknesses. They often gain legitimate employment at key locations in order to monitor day-to-day activities. In any event, they may try to gain this knowledge in order to make their mission or scheme more effective.
Acquiring Supplies
Another area to be cognizant of is anyone acquiring supplies. This may be a case where someone is purchasing or stealing explosives, weapons or ammunition. It could also be someone storing harmful chemicals or chemical equipment. Terrorists would also find it useful to have in their possession law enforcement equipment and identification, military uniforms and decals, flight passes, badges or even flight manuals. If they can't find the opportunity to steal these types of things, they may try to photocopy IDs or attempt to make passports or other forms of identification by counterfeiting. Possessing any of these would make it easier for one to gain entrance into secured or usually prohibited areas.
Suspicious People Who Don't Belong
A fifth pre-incident indicator is observing suspicious people who just "don't belong." This does not mean we should profile individuals; rather, it means we should profile behaviors. These include suspicious border crossings, stowaways aboard a ship or people jumping ship in a port. It may mean having someone in a workplace, building, neighborhood or business establishment that does not fit in because of their demeanor, their language usage or unusual questions they are asking. As an officer you may respond to a complaint that may appear to be a routine investigation but results in something much larger in significance.
Dry Runs
Another sign to watch for is "dry runs." Before execution of the final operation or plan, a practice session will be run to work out the flaws and unanticipated problems. A dry run may very well be the heart of a planning stage of a terrorist act. If you find someone monitoring a police radio frequency and recording emergency response times, you may very well be observing a "dry run." Another element of this activity could include mapping out routes and determining the timing of traffic lights and flow. This stage is actually our best chance to intercept and stop an attack. Multiple dry runs are normally conducted at or near the target area.
Deploying Assets/Getting Into Position
The seventh and final sign or signal to look for is someone deploying assets or getting into position. This is a person's last chance to alert authorities before the terrorist act occurs. It is also important to remember that pre-incident indicators may come months or even years apart. It is threfore extremely important to document every fragment of information no matter how insignificant it may appear and forward this information.
