is a sad reality in today's world. But terrorist attack plots do
not always result in success. Many terrorist attacks are prevented
because a vigilant observer reports the suspicious activity, known
as "Indicators and Warnings," allowing investigators to
If you observe something truly suspicious, and you believe there
may be a terrorism connection, don't take any chances. Report it.
Your actions could stop the next terrorist attack.
Below are a few activities that are frequently associated with
terrorist attack planning. The activities below are designed to
provide "basic" information about the types of
suspicious activities that should be reported. Bear in mind that
this list is not 100% comprehensive since terrorist tactics are
always evolving. Should you witness any activity or circumstance
that just doesn't seem right, please report it. We take all
information reported seriously.
Indicators and Warnings may include the following.
4. Concealment of Identity
5. Acquisition of Materials
7. Dry Runs
8. Other Suspicious Circumstances
Radicalization - There are usually radical ideologies
behind the activities of terrorists. Violent ideologies may be
propagated in educational institutions, in prisons, online, or in
other settings. Any individuals that advocate or embrace radical
ideologies (i.e., justifying or espousing killing, the destruction
of property, or other criminal activities) should be reported.
Interest or participation in websites or online forums featuring
violent or jihadist ideologies should be reported.
Individuals undergoing a radical shift in personality; sudden
withdrawal from friends and family; and a willingness to express
violent views (i.e., interest in killing, condone killing,
sympathize with terrorists, encourage others to adopt violent
views, etc.) should be reported.
Financing - Financing is an important part of a terrorist
attack. Terrorists may need to be smuggled into the country; rent
may need to be paid at locations facilitating surveillance or
serving as safe houses; false identification may need to be
provided; and bomb materials or weapons may need to be purchased,
perhaps on the "black market." If terrorists are
unemployed, they may attempt to maintain the appearance of
employment. They will need clothing, food, shelter, and
transportation. All of these activities require financing.
Unusual financial transactions, such as wiring large sums of money
overseas with no apparent justification; attempts to travel with
large amounts of cash; attempts to conceal the movement of cash
through suspicious or counterfeit merchandise transactions;
'uncustomary' donations of large sums of money to charities;
attempts to cash checks or pay for services with cash when
identification is questionable or not offered should all be
Training - No terrorist wants the plot to fail. As such,
instruction or training may be diligently pursued. Instruction may
be sought to better understand the vulnerabilities of a specific
target; how intelligence or law enforcement agencies work to
detect or deter terrorism; or how first responders might be
expected to respond to a particular scenario. Training may be
sought in bomb-making; firearms; martial arts or hand-to-hand
combat; the handling of chemicals, biological or radiological
agents; piloting of aircraft or boats; even scuba-diving. This
list could go on, as terrorists have demonstrated the ability to
be incredibly innovative.
Interest in any of the above areas with no valid or reasonable
justification should be reported. Suspicious inquiries into
training or instruction, particularly when there is an attempt to
pay in cash and/or conceal one's identity should be reported.
Concealment of Identity - Fundamental to the success of a
terrorist attack may be keeping the identities of the plotters
concealed. Since the names of many people with terrorist
connections are found in various government databases, these
individuals may seek to obtain false identification, claim to be
of a different ethnicity or language group than their own, or try
to confuse authorities by using multiple names. It may be easy to
obtain a false identification, but there is rarely a perfect
facsimile of a legitimate government issued ID. Even rarer are
consistent and quality falsified identities in multiple forms
(i.e., driver's license, passport, etc.).
Varied name spellings between different IDs, erasures; and
intentionally damaged IDs should be reported. Usage of an
"international driver's permit" or other questionable
sources of ID should also be reported.
Acquisition of Materials - With the exception of a cyber
attack, every terrorist attack involves the use of a weapon or
weapons. The most common weapon is the improvised explosive device
(IED). IEDs have been used in literally hundreds of configurations
(i.e., in backpacks, suitcases, cars, attached to suicide bombers,
etc.). Other common weapons include firearms. There has also been
much experimentation with chemical, biological and radiological
There are only three ways to obtain these weapons; steal them,
make them, or buy them. Even explosives that are made from
household materials require the terrorist to purchase precursor
materials. As such, any suspicious inquiries or the purchase of
large quantities of fertilizers, peroxides, pesticides, or other
chemicals; the theft of dangerous substances (i.e., poison,
explosive or corrosive materials); or the attempted or actual
online purchase of these items should be reported.
If any of these materials are discovered in locations that are not
authorized for their use, or if there appears to be an attempt to
conceal the possession of these items, this should be reported.
Similarly, unusual nighttime shipments, dead or dying vegetation
around a location, unusual odors or efforts to ventilate an area
with no rational explanation; or unexplained chemical burns should
also be reported.
Small arms assaults have also factored prominently into numerous
recent terrorist attacks. As such, any unusual or unlawful
attempts to obtain or amass weapons or ammunition should be
reported. Similarly, suspicious individuals that demonstrate an
interest in target practice or in commando-style training should
also be reported. Any perceived attack planning in conjunction
with the acquisition of firearms or commando-style training should
also be reported.
Surveillance - Terrorists have demonstrated a consistent
interest in targets that produce mass casualties and economic,
symbolic, and psychological impact. In order to ensure the success
of the attack, the targets must be carefully researched.
Much research can be conducted online, but there are few
substitutes for on-site surveillance. Surveillance may allow the
terrorist to observe security measures, traffic patterns, presence
of law enforcement of security, first responder protocols, and so
Videotaping, photographing or sketching of buildings or facility
features that are not routinely of interest to visitors or
tourists should be reported. Attempts to conceal videotaping,
photographing or sketching; prolonged observation or observation
over several days; questioning about security procedures;
describing building features of activities while videotaping; and
attempts to conceal identity while conducting these activities
should be reported.
Telephone solicitation is another suspicious activity that may
warrant investigation. Suspicious individuals that telephone and
inquire about sensitive information, particularly when it relates
to sensitive locations, should be reported. Always ask for a name
and call back telephone number whenever anyone inquires about
sensitive information. The same principal applies to e-mail.
Dry Runs - Most terrorist attacks are meticulously planned
prior to execution. An important part of the planning process is
the dry run, also known as the test run or rehearsal. The dry run
allows the terrorist(s) the opportunity to see if the attack can
be successfully carried out without encountering obstacles or
detection. Dry runs may involve probing the effectiveness of
screening equipment or procedures; the presence of law enforcement
or security at specific times; or the presence of a desired number
Dry runs may involve determining if a specific substance, weapon
or concealment method will be detected. So as to not reveal the
plot, the terrorist may use a substance, article or concealment
method that closely mimics the one to be used on the day of the
attack, but that employs no unlawful item or activity. If the
substance, article, or concealment method eludes detection, the
dry run would have been a success.
A vigilant observer may be alerted to a dry run owing to the
suspicious nature of the activity. The list of potential
activities is quite long. Therefore, any activity considered to be
a test run should be reported. This may include leaving vehicles
unattended in uncustomary locations, artfully concealing items
while going through screening, or other unexplained suspicious
Other Suspicious Circumstances - The above list is by no
means 100% comprehensive. Other suspicious activities could
include attempts to gain access to sensitive government or law
enforcement information; attempts to obtain sensitive information
about government facilities or other key locations in the
community; suspicious interest in chemicals or hazardous
materials; suspicious attempts to gain access to aircraft, boats
or other water-borne vessels; and so on.
If you observe any activity, person or circumstance that appears
suspicious, report it.rnings