So how many of these suspicious activities do you engage in?
Via Public Intelligence, who note, “The following document was obtained from the public website of a national disaster recovery network.”
Suspicious Activity Behavior & Indicators For Public Sector Partners
Page Count: 2 pages
Date: February 2016
Restriction: Not for Public Release, For Official Use Only
Originating Organization: Boston Regional Intelligence Center
File Type: pdf
File Size: 148,203 bytes
File Hash (SHA-256):B2514919DF7D7DBA5F1BA77402944CD5F964B81173E98317A6E74578429AC763
You can download the whole file here (pdf), but here are the indicators, below.
PREOPERATIONAL BEHAVIORS & INDICATORS
- Eliciting Information: Questions focused on operations, security procedures, entry points, security checkpoints, crowds, access controls such as alarms, locks and cameras; or questions about a facility’s air conditioning, heating and ventilation system. This includes individuals questioning employees in person, on or off-site, over the phone or via the Internet.
- Testing of Security: Deliberate acts that would prompt a law enforcement or first responder response in order to observe response times and actions. For example: purposely dropping a package and moving away from the area, parking illegally and waiting to see how long until the vehicle gets towed, or making false fire alarms and bomb threats.
- Photography: Taking pictures or video of facilities, infrastructure, personnel, surroundings, or crowds.
- Observation/Surveillance: Showing unusual interest in facility/ infrastructure/personnel and monitoring the activity of people, facilities, processes or systems; for example, taking notes, drawing maps, observing first responder drills or procedures; this may include multiple false alarms or emergency calls to the same locations or similar venues.
- Theft/Loss/Diversion: Stealing or diverting something associated with a facility/infrastructure; for example: badges, uniforms, identification, emergency vehicles, technology, or documents; these items may be used to misrepresent one’s identity in order to gain access to secure areas or information.
- Sabotage/Tampering/Vandalism: Damaging, manipulating, or defacing part of a facility/infrastructure, such as security cameras or a protected site.
- Expressed or Implied Threat: Communicating a spoken or written threat to damage or compromise a facility/event/person.
- Materials Acquisition/Storage: Acquisition of unusual quantities of precursor materials. For example: cell phones, chemicals, fertilizers, fuel, timers, toxic materials, fireworks
- Other: Other behaviors that may be suspicious in nature include: hotel guests who deny housekeeping from performing routine cleaning duties over a period of several days; evidence that guests have changed their physical appearance, a request at check in for views of specific areas of interest; suspicious parcels and packages (protruding wires, unusual smells, greasy marks, unknown source/sender); possession or viewing of extremists propaganda, including unusual searches on public computers, such as instructions on how to make weapons, or web browsing of extremist websites that advocate violence.
(U//NP) Below is a list of behaviors operatives may exhibit prior to launching an attack; please note that an individual displaying one of more of these indicators cannot necessarily be identified as a probable terrorist. These indicators need to be considered with other factors.
- (U//FOUO) Inappropriate attire, such as loose or bulky clothing inconsistent with weather conditions
- (U//FOUO) Carrying heavy luggage or wearing a backpack
- (U//FOUO) Unfocused eyes, disregard for surrounding activities or persons
- (U//FOUO) Unresponsiveness to authoritative voice commands, salutations, or other routine distractions
- (U//FOUO) Behavior consistent with lack of future plans, such as purchase of a one-way ticket or lack of concern about getting receipts, receiving change from purchases, paying in cash, or extended hotel stays with no end date
- (U//FOUO) Unnatural gait or posture
- (U//FOUO) Ambivalent or anxious behavior, such as retracing steps or movements, or engaging in seemingly purposeless actions.
(U//NP) The BRIC would like to highlight the following protective measures to encourage businesses to take a proactive role:
- (U//FOUO) Establish a comprehensive security plan and emergency response plan
- (U//FOUO) Test communication and camera equipment with emergency responders
- (U//FOUO) Educate staff and employees about possible suspicious activity indicators
- (U//FOUO) Remain alert and vigilant for suspicious individuals / objects and report anything that sticks out as suspicious to the Boston Police Department.