So how many of these suspicious activities do you engage in?
Via Public Intelligence, who note, “The following document was obtained from the public website of a national disaster recovery network.”
Suspicious Activity Behavior & Indicators For Public Sector Partners
Page Count: 2 pages
Date: February 2016
Restriction: Not for Public Release, For Official Use Only
Originating Organization: Boston Regional Intelligence Center
File Type: pdf
File Size: 148,203 bytes
File Hash (SHA-256):B2514919DF7D7DBA5F1BA77402944CD5F964B81173E98317A6E74578429AC763
You can download the whole file here (pdf), but here are the indicators, below.
PREOPERATIONAL BEHAVIORS & INDICATORS
- Eliciting Information: Questions focused on operations, security procedures, entry points, security checkpoints, crowds, access controls such as alarms, locks and cameras; or questions about a facility’s air conditioning, heating and ventilation system. This includes individuals questioning employees in person, on or off-site, over the phone or via the Internet.
- Testing of Security: Deliberate acts that would prompt a law enforcement or first responder response in order to observe response times and actions. For example: purposely dropping a package and moving away from the area, parking illegally and waiting to see how long until the vehicle gets towed, or making false fire alarms and bomb threats.
- Photography: Taking pictures or video of facilities, infrastructure, personnel, surroundings, or crowds.
- Observation/Surveillance: Showing unusual interest in facility/ infrastructure/personnel and monitoring the activity of people, facilities, processes or systems; for example, taking notes, drawing maps, observing first responder drills or procedures; this may include multiple false alarms or emergency calls to the same locations or similar venues.
- Theft/Loss/Diversion: Stealing or diverting something associated with a facility/infrastructure; for example: badges, uniforms, identification, emergency vehicles, technology, or documents; these items may be used to misrepresent one’s identity in order to gain access to secure areas or information.
- Sabotage/Tampering/Vandalism: Damaging, manipulating, or defacing part of a facility/infrastructure, such as security cameras or a protected site.
- Expressed or Implied Threat: Communicating a spoken or written threat to damage or compromise a facility/event/person.
- Materials Acquisition/Storage: Acquisition of unusual quantities of precursor materials. For example: cell phones, chemicals, fertilizers, fuel, timers, toxic materials, fireworks
- Other: Other behaviors that may be suspicious in nature include: hotel guests who deny housekeeping from performing routine cleaning duties over a period of several days; evidence that guests have changed their physical appearance, a request at check in for views of specific areas of interest; suspicious parcels and packages (protruding wires, unusual smells, greasy marks, unknown source/sender); possession or viewing of extremists propaganda, including unusual searches on public computers, such as instructions on how to make weapons, or web browsing of extremist websites that advocate violence.
OPERATIONAL INDICATORS
(U//NP) Below is a list of behaviors operatives may exhibit prior to launching an attack; please note that an individual displaying one of more of these indicators cannot necessarily be identified as a probable terrorist. These indicators need to be considered with other factors.
- (U//FOUO) Inappropriate attire, such as loose or bulky clothing inconsistent with weather conditions
- (U//FOUO) Carrying heavy luggage or wearing a backpack
- (U//FOUO) Unfocused eyes, disregard for surrounding activities or persons
- (U//FOUO) Unresponsiveness to authoritative voice commands, salutations, or other routine distractions
- (U//FOUO) Behavior consistent with lack of future plans, such as purchase of a one-way ticket or lack of concern about getting receipts, receiving change from purchases, paying in cash, or extended hotel stays with no end date
- (U//FOUO) Unnatural gait or posture
- (U//FOUO) Ambivalent or anxious behavior, such as retracing steps or movements, or engaging in seemingly purposeless actions.
PROTECTIVE MEASURES
(U//NP) The BRIC would like to highlight the following protective measures to encourage businesses to take a proactive role:
- (U//FOUO) Establish a comprehensive security plan and emergency response plan
- (U//FOUO) Test communication and camera equipment with emergency responders
- (U//FOUO) Educate staff and employees about possible suspicious activity indicators
- (U//FOUO) Remain alert and vigilant for suspicious individuals / objects and report anything that sticks out as suspicious to the Boston Police Department.