Recognizing Terrorist Methods Seven Signs and Signals
By Thomas Leo

It is more important than ever for all private security and law enforcement agencies to be able to detect and interdict possible threats of terror.

It is vitally important for all of us to realize that incidents do not occur in a vacuum. They are planned, organized, and carried out by individuals acting alone or in groups. There are seven categories of suspicious activities.

1. Surveillance

If there is a specific target that terrorists have chosen, that target area will be most likely be observed during the planning phase of the operation. They identify the strengths and weaknesses and number of personnel who may respond to an incident. Routes to and from the target are usually established during the surveillance phase. Therefore, it is important to take note of such things as someone recording or monitoring activities, drawing diagrams or annotating maps, the use of vision-enhancing devices, having in one's possession floor plans or blue prints of places such as hightech firms, financial institutions, or Government/military facilities. Any of these surveillance-type acts MAY be an indicator that something just isn't right. Nothing is too menial and should not be discarded as such.

2. Elicitation

The second sign or signal is elicitation. What this means is anyone attempting to gain information about a place, person, or operations. Example: someone attempting to gain knowledge about critical infrastructures such as power plants, water reservoirs, or
maritime ports. Terrorists may attempt to research bridge and tunnel usage, make unusual inquiries concerning shipments, or inquire as to how a military base operates. They may also attempt to place "key" people in sensitive work locations.

3. Tests of Security

Tests of Security are another area where terrorists can attempt to gather data. Tests are usually conducted by driving by targets, moving into sensitive areas, and observing security or law enforcement responses. They will be interested in times it takes to respond to incidents or the routes taken to specific locations. They may also try to penetrate physical security barriers or procedures to assess strengths and weaknesses. They often gain legitimate employment at key locations in order to monitor day-to-day activities. In any event, they may try to gain this knowledge in order to make their mission or scheme more effective.

4. Acquiring Supplies

Be cognizant of anyone acquiring supplies: someone purchasing or stealing explosives, weapons, or ammunition. It could also be someone storing harmful chemicals or chemical equipment. Terrorists would also find it useful to have in their possession law enforcement equipment and identification, military uniforms and decals, as well as flight passes, badges or even flight manuals. If they can't find the opportunity to steal these types of things, they may try to photocopy IDs; make “passports” or other forms of identification by counterfeiting. These items make it easier to gain entrance into secured or usually prohibited areas.

5. Suspicious People Who Don't Belong

A fifth pre-incident indicator is observing suspicious people who just“don't belong.” This does not mean profiling individuals but it does mean profiling behaviors. This includes suspicious border crossings and stowaways aboard ships; or people jumping ship in ports. It may mean observing someone in a workplace, building, neighborhood, or business who doesn't fit in because of their demeanor, their language usage or unusual questions they ask. As an officer you may respond to complaints that appear to be routine investigations but result in something much larger, more far-reaching in scope.

6. Dry Runs

Another sign to watch for is "dry runs". Before execution of final operations or plans, practice sessions may be run to work out flaws or unanticipated problems. Dry runs may very well be the heart of planning stages in terrorist acts. If you find someone monitoring police radio frequencies and recording emergency response times, you may very well be observing a “dry run”. Another element could include mapping out routes and determining the timing of traffic lights and flow. This stage is actually one of the best chances to intercept and stop an attack. Multiple dry runs are normally conducted at or near the target area.

7. Deploying Assets / Getting into Position

The seventh and final sign or signal is someone deploying assets or getting into position. This is the last chance to alert authorities before the terrorist act occurs. Remember that pre-incident indicators may come months or even years apart. Therefore, document every fragment of information, no matter how insignificant it may appear, and forward this information.

>> Return to This Issue's Table of Contents