is a sad reality in today's world. But terrorist attack
plots do not always result in success. Many terrorist
attacks are prevented because a vigilant observer reports
the suspicious activity, known as "Indicators and
Warnings," allowing investigators to act.
you observe something truly suspicious, and you believe
there may be a terrorism connection, don't take any
chances. Report it. Your actions could stop the next
are a few activities that are frequently associated with
terrorist attack planning. The activities below are
designed to provide "basic" information about
the types of suspicious activities that should be
reported. Bear in mind that this list is not 100%
comprehensive since terrorist tactics are always evolving.
Should you witness any activity or circumstance that just
doesn't seem right, please report it. We take all
information reported seriously.
and Warnings may include the following.
- There are usually radical ideologies behind the
activities of terrorists. Violent ideologies may be
propagated in educational institutions, in prisons,
online, or in other settings. Any individuals that
advocate or embrace radical ideologies (i.e., justifying
or espousing killing, the destruction of property, or
other criminal activities) should be reported.
or participation in websites or online forums featuring
violent or jihadist ideologies should be reported.
undergoing a radical shift in personality; sudden
withdrawal from friends and family; and a willingness to
express violent views (i.e., interest in killing, condone
killing, sympathize with terrorists, encourage others to
adopt violent views, etc.) should be reported.
- Financing is an important part of a terrorist attack.
Terrorists may need to be smuggled into the country; rent
may need to be paid at locations facilitating surveillance
or serving as safe houses; false identification may need
to be provided; and bomb materials or weapons may need to
be purchased, perhaps on the "black market." If
terrorists are unemployed, they may attempt to maintain
the appearance of employment. They will need clothing,
food, shelter, and transportation. All of these activities
financial transactions, such as wiring large sums of money
overseas with no apparent justification; attempts to
travel with large amounts of cash; attempts to conceal the
movement of cash through suspicious or counterfeit
merchandise transactions; 'uncustomary' donations of large
sums of money to charities; attempts to cash checks or pay
for services with cash when identification is questionable
or not offered should all be reported.
- No terrorist wants the plot to fail. As such,
instruction or training may be diligently pursued.
Instruction may be sought to better understand the
vulnerabilities of a specific target; how intelligence or
law enforcement agencies work to detect or deter
terrorism; or how first responders might be expected to
respond to a particular scenario. Training may be sought
in bomb-making; firearms; martial arts or hand-to-hand
combat; the handling of chemicals, biological or
radiological agents; piloting of aircraft or boats; even
scuba-diving. This list could go on, as terrorists have
demonstrated the ability to be incredibly innovative.
in any of the above areas with no valid or reasonable
justification should be reported. Suspicious inquiries
into training or instruction, particularly when there is
an attempt to pay in cash and/or conceal one's identity
should be reported.
of Identity - Fundamental to the success of a
terrorist attack may be keeping the identities of the
plotters concealed. Since the names of many people with
terrorist connections are found in various government
databases, these individuals may seek to obtain false
identification, claim to be of a different ethnicity or
language group than their own, or try to confuse
authorities by using multiple names. It may be easy to
obtain a false identification, but there is rarely a
perfect facsimile of a legitimate government issued ID.
Even rarer are consistent and quality falsified identities
in multiple forms (i.e., driver's license, passport,
name spellings between different IDs, erasures; and
intentionally damaged IDs should be reported. Usage of an
"international driver's permit" or other
questionable sources of ID should also be reported.
of Materials - With the exception of a cyber
attack, every terrorist attack involves the use of a
weapon or weapons. The most common weapon is the
improvised explosive device (IED). IEDs have been used in
literally hundreds of configurations (i.e., in backpacks,
suitcases, cars, attached to suicide bombers, etc.). Other
common weapons include firearms. There has also been much
experimentation with chemical, biological and radiological
are only three ways to obtain these weapons; steal them,
make them, or buy them. Even explosives that are made from
household materials require the terrorist to purchase
precursor materials. As such, any suspicious inquiries or
the purchase of large quantities of fertilizers,
peroxides, pesticides, or other chemicals; the theft of
dangerous substances (i.e., poison, explosive or corrosive
materials); or the attempted or actual online purchase of
these items should be reported.
any of these materials are discovered in locations that
are not authorized for their use, or if there appears to
be an attempt to conceal the possession of these items,
this should be reported. Similarly, unusual nighttime
shipments, dead or dying vegetation around a location,
unusual odors or efforts to ventilate an area with no
rational explanation; or unexplained chemical burns should
also be reported.
arms assaults have also factored prominently into numerous
recent terrorist attacks. As such, any unusual or unlawful
attempts to obtain or amass weapons or ammunition should
be reported. Similarly, suspicious individuals that
demonstrate an interest in target practice or in
commando-style training should also be reported. Any
perceived attack planning in conjunction with the
acquisition of firearms or commando-style training should
also be reported.
- Terrorists have demonstrated a consistent interest in
targets that produce mass casualties and economic,
symbolic, and psychological impact. In order to ensure the
success of the attack, the targets must be carefully
research can be conducted online, but there are few
substitutes for on-site surveillance. Surveillance may
allow the terrorist to observe security measures, traffic
patterns, presence of law enforcement of security, first
responder protocols, and so on.
photographing or sketching of buildings or facility
features that are not routinely of interest to visitors or
tourists should be reported. Attempts to conceal
videotaping, photographing or sketching; prolonged
observation or observation over several days; questioning
about security procedures; describing building features of
activities while videotaping; and attempts to conceal
identity while conducting these activities should be
solicitation is another suspicious activity that may
warrant investigation. Suspicious individuals that
telephone and inquire about sensitive information,
particularly when it relates to sensitive locations,
should be reported. Always ask for a name and call back
telephone number whenever anyone inquires about sensitive
information. The same principal applies to e-mail.
Runs - Most terrorist attacks are meticulously
planned prior to execution. An important part of the
planning process is the dry run, also known as the test
run or rehearsal. The dry run allows the terrorist(s) the
opportunity to see if the attack can be successfully
carried out without encountering obstacles or detection.
Dry runs may involve probing the effectiveness of
screening equipment or procedures; the presence of law
enforcement or security at specific times; or the presence
of a desired number of victims.
runs may involve determining if a specific substance,
weapon or concealment method will be detected. So as to
not reveal the plot, the terrorist may use a substance,
article or concealment method that closely mimics the one
to be used on the day of the attack, but that employs no
unlawful item or activity. If the substance, article, or
concealment method eludes detection, the dry run would
have been a success.
vigilant observer may be alerted to a dry run owing to the
suspicious nature of the activity. The list of potential
activities is quite long. Therefore, any activity
considered to be a test run should be reported. This may
include leaving vehicles unattended in uncustomary
locations, artfully concealing items while going through
screening, or other unexplained suspicious circumstances.
Suspicious Circumstances - The above list is by
no means 100% comprehensive. Other suspicious activities
could include attempts to gain access to sensitive
government or law enforcement information; attempts to
obtain sensitive information about government facilities
or other key locations in the community; suspicious
interest in chemicals or hazardous materials; suspicious
attempts to gain access to aircraft, boats or other
water-borne vessels; and so on.
you observe any activity, person or circumstance that
appears suspicious, report it.