1. Radicalization
2. Financing
3. Training
4. Concealment of Identity
5. Acquisition of Materials
6. Surveillance
7. Dry Runs
8. Other Suspicious Circumstances

Radicalization - There are usually radical ideologies behind the activities of terrorists. Violent ideologies may be propagated in educational institutions, in prisons, online, or in other settings. Any individuals that advocate or embrace radical ideologies (i.e., justifying or espousing killing, the destruction of property, or other criminal activities) should be reported.

Interest or participation in websites or online forums featuring violent or jihadist ideologies should be reported.

Individuals undergoing a radical shift in personality; sudden withdrawal from friends and family; and a willingness to express violent views (i.e., interest in killing, condone killing, sympathize with terrorists, encourage others to adopt violent views, etc.) should be reported.

Financing - Financing is an important part of a terrorist attack. Terrorists may need to be smuggled into the country; rent may need to be paid at locations facilitating surveillance or serving as safe houses; false identification may need to be provided; and bomb materials or weapons may need to be purchased, perhaps on the "black market." If terrorists are unemployed, they may attempt to maintain the appearance of employment. They will need clothing, food, shelter, and transportation. All of these activities require financing.

Unusual financial transactions, such as wiring large sums of money overseas with no apparent justification; attempts to travel with large amounts of cash; attempts to conceal the movement of cash through suspicious or counterfeit merchandise transactions; 'uncustomary' donations of large sums of money to charities; attempts to cash checks or pay for services with cash when identification is questionable or not offered should all be reported.

Training - No terrorist wants the plot to fail. As such, instruction or training may be diligently pursued. Instruction may be sought to better understand the vulnerabilities of a specific target; how intelligence or law enforcement agencies work to detect or deter terrorism; or how first responders might be expected to respond to a particular scenario. Training may be sought in bomb-making; firearms; martial arts or hand-to-hand combat; the handling of chemicals, biological or radiological agents; piloting of aircraft or boats; even scuba-diving. This list could go on, as terrorists have demonstrated the ability to be incredibly innovative.

Interest in any of the above areas with no valid or reasonable justification should be reported. Suspicious inquiries into training or instruction, particularly when there is an attempt to pay in cash and/or conceal one's identity should be reported.

Concealment of Identity - Fundamental to the success of a terrorist attack may be keeping the identities of the plotters concealed. Since the names of many people with terrorist connections are found in various government databases, these individuals may seek to obtain false identification, claim to be of a different ethnicity or language group than their own, or try to confuse authorities by using multiple names. It may be easy to obtain a false identification, but there is rarely a perfect facsimile of a legitimate government issued ID. Even rarer are consistent and quality falsified identities in multiple forms (i.e., driver's license, passport, etc.).

Varied name spellings between different IDs, erasures; and intentionally damaged IDs should be reported. Usage of an "international driver's permit" or other questionable sources of ID should also be reported.

Acquisition of Materials - With the exception of a cyber attack, every terrorist attack involves the use of a weapon or weapons. The most common weapon is the improvised explosive device (IED). IEDs have been used in literally hundreds of configurations (i.e., in backpacks, suitcases, cars, attached to suicide bombers, etc.). Other common weapons include firearms. There has also been much experimentation with chemical, biological and radiological agents.

There are only three ways to obtain these weapons; steal them, make them, or buy them. Even explosives that are made from household materials require the terrorist to purchase precursor materials. As such, any suspicious inquiries or the purchase of large quantities of fertilizers, peroxides, pesticides, or other chemicals; the theft of dangerous substances (i.e., poison, explosive or corrosive materials); or the attempted or actual online purchase of these items should be reported.

If any of these materials are discovered in locations that are not authorized for their use, or if there appears to be an attempt to conceal the possession of these items, this should be reported. Similarly, unusual nighttime shipments, dead or dying vegetation around a location, unusual odors or efforts to ventilate an area with no rational explanation; or unexplained chemical burns should also be reported.

Small arms assaults have also factored prominently into numerous recent terrorist attacks. As such, any unusual or unlawful attempts to obtain or amass weapons or ammunition should be reported. Similarly, suspicious individuals that demonstrate an interest in target practice or in commando-style training should also be reported. Any perceived attack planning in conjunction with the acquisition of firearms or commando-style training should also be reported.

Surveillance - Terrorists have demonstrated a consistent interest in targets that produce mass casualties and economic, symbolic, and psychological impact. In order to ensure the success of the attack, the targets must be carefully researched.

Much research can be conducted online, but there are few substitutes for on-site surveillance. Surveillance may allow the terrorist to observe security measures, traffic patterns, presence of law enforcement of security, first responder protocols, and so on.

Videotaping, photographing or sketching of buildings or facility features that are not routinely of interest to visitors or tourists should be reported. Attempts to conceal videotaping, photographing or sketching; prolonged observation or observation over several days; questioning about security procedures; describing building features of activities while videotaping; and attempts to conceal identity while conducting these activities should be reported.

Telephone solicitation is another suspicious activity that may warrant investigation. Suspicious individuals that telephone and inquire about sensitive information, particularly when it relates to sensitive locations, should be reported. Always ask for a name and call back telephone number whenever anyone inquires about sensitive information. The same principal applies to e-mail.

Dry Runs - Most terrorist attacks are meticulously planned prior to execution. An important part of the planning process is the dry run, also known as the test run or rehearsal. The dry run allows the terrorist(s) the opportunity to see if the attack can be successfully carried out without encountering obstacles or detection. Dry runs may involve probing the effectiveness of screening equipment or procedures; the presence of law enforcement or security at specific times; or the presence of a desired number of victims.

Dry runs may involve determining if a specific substance, weapon or concealment method will be detected. So as to not reveal the plot, the terrorist may use a substance, article or concealment method that closely mimics the one to be used on the day of the attack, but that employs no unlawful item or activity. If the substance, article, or concealment method eludes detection, the dry run would have been a success.

A vigilant observer may be alerted to a dry run owing to the suspicious nature of the activity. The list of potential activities is quite long. Therefore, any activity considered to be a test run should be reported. This may include leaving vehicles unattended in uncustomary locations, artfully concealing items while going through screening, or other unexplained suspicious circumstances.

Other Suspicious Circumstances - The above list is by no means 100% comprehensive. Other suspicious activities could include attempts to gain access to sensitive government or law enforcement information; attempts to obtain sensitive information about government facilities or other key locations in the community; suspicious interest in chemicals or hazardous materials; suspicious attempts to gain access to aircraft, boats or other water-borne vessels; and so on.

If you observe any activity, person or circumstance that appears suspicious, report it.rnings