By Craig Gundry and K.C. Poulin
Since the attacks of September 11th, a number of bulletins have been issued by the FBI warning of an increased potential for terrorist attacks. In many cases, these warnings are vague and unspecific—the result of fragmented or unverified information filtering in from the intelligence community. Yet in these alerts, the public is warned to be on the watch for “suspicious activity” and to maintain a “heightened state of alert.” Without specific guidance, these types of warnings have created a state of confusion and frustration by the public and local authorities who, until recently, have never confronted the threat of terrorism.
So what can the public do to aid in the War on Terrorism? What should citizens and local police be looking for with regard to “suspicious activity?” Addressing these questions requires an understanding of how Al-Qaida and other affiliated threat groups operate and how terrorist attacks are planned and executed. By assessing the terrorist’s modus operandi, we can identify many observable activities or events that can indicate a potential terrorist attack. In the anti-terrorism community, these types of observable activities are referred to as “threat indicators.” Any notice of these activities should be reported to police and promptly investigated.
Threat Indicators
When many people think of suspicious activity, they tend to think of suspicious looking men entering and leaving an apartment at unusual hours or overhearing words like “bomb” or “anthrax” in a suspicious conversation. These types of public sightings have, on a number of occasions, led authorities to uncovering terrorist plots. However, there are many other types of activities or circumstances that can suggest the potential for a terrorist attack. Most of these indicators relate to the terrorist’s gathering of target intelligence, the acquisition of materials necessary for an attack, preparation of bombs or chemical/biological weapons, and the first steps of executing an attack (bomb delivery, gaining access to a plane, etc.).
All terrorist operations are preceded by a process of intelligence gathering. This often involves conducting reconnaissance visits or stationary surveillance of a target for weeks or even months. Citizens are often in an excellent position to recognize threat indicators associated with target surveillance. For example, a waitress in a diner may notice that two men who come in every morning always request a seat by a certain window. The same two men stay for a long time and seem more interested in activity outside of the window than talking. Whenever they do talk, they become quiet when someone approaches their table or the men quickly change their topic of discussion. This type of activity should be regarded as highly suspicious (especially if the window provides a view of an ideal terrorist target, such as a government building, shopping mall, or symbolic commercial building). People who loiter for very long periods of time, people who seem to take strong interest in a particular facility or building, or anyone who seems self-conscious or nervous while photographing or videotaping a location should be regarded as suspicious.
Citizens who work in locations that sell or store possible bomb making materials or items that can be used in manufacturing chemical or biological weapons should be aware of suspicious purchases or thefts. Many items commonly used in making bombs or chemical weapons are openly sold in hardware stores, pharmacies, garden stores, hobby shops, and electronics stores. For example, hardware clerks should be aware of anyone purchasing threaded pipes and end caps, gas canisters, large quantities of pesticides, ammonia nitrate fertilizers, etc. Employees in drug stores should be suspicious of anyone purchasing unusual quantities of isopropanol or DMSO. Pharmacists should also note suspicious inquiries or thefts of antibiotics, atropine, fentanyl medications, or other drugs used as chemical agent precursors or used to treat chemical or biological agent exposure. To recognize suspicious purchases and thefts, citizens need to know what items are located in their workplace that have value in terrorist applications.
The public should also be aware of threat indicators related to the preparation and delivery of terrorist weapons. For example, many terrorist groups acquire vehicles for bomb attacks by theft or rental. As a result, people who work for vehicle rental companies should be aware of anyone renting a utility van or truck that appears vague or suspicious about its purpose. Additionally, police and the public should be aware of any unusual thefts of large-size vehicles—particularly trucks that were empty at the time they were stolen. Thieves-for-profit normally steal large vehicles for the cargo, not the vehicle itself. From the terrorist’s perspective, getting rid of a stolen vehicle’s cargo is a risky inconvenience.
Landlords and citizens should also be aware of unusual activities around apartments or rental properties. For instance, an apartment tenant may notice unusual petroleum or acidic smells coming from a neighbor’s apartment, or an employee in a rental storage complex may notice 55-gal drums being moved in or out of a rental space. These are both examples of the types of subtle indicators that ordinary citizens may observe.
Companies that may be targeted by terrorists should also be aware of special threat indicators. In addition to activities associated with intelligence collection, items such as the theft of employee identity cards, access key cards, or vehicle stickers should be promptly investigated. Terrorists frequently steal or forge these types of identity items to gain access to protected facilities. The unusual disappearance or murder of a facility employee is another potential threat indicator. There are a number of documented cases where terrorists have kidnapped or killed facility employees for their credentials or clothing uniforms. In Northern Ireland and the Middle East, terrorists have even taken families hostage to coerce a member of the family (usually a facility employee) to deliver a bomb by proxy.
Police and Suspicious Activity
Since September 11th, local law enforcement agencies have found themselves in the difficult situation of sorting and investigating an overwhelming number of suspicious activity reports from the public. To be effective in processing these reports, local police must be aware of what constitutes “suspicious activity” and how terrorist operations are planned and executed. Historically, recognizing indications of terrorist activity has not been a concern in domestic law enforcement training. Addressing this issue is critical if local law enforcement is to play a proactive role in homeland security.
In addition to investigating public reports of suspicious events, there are many types of threat indicators that law enforcement officers are most likely to observe. In this regard, local law enforcement agencies can strongly benefit by examining the training of police in countries that have had long histories of terrorist activity. For example, in Israel and the United Kingdom, most police officers are trained to be aware of abandoned objects in public places and vehicles parked in no-parking zones. In Northern Ireland, police are warned to be aware of trucks or vans with fresh rust around the base or the bumper (a potential indicator of a bomb employing ammonia or urea nitrate explosives). These are all examples of the types of items that police may encounter in the course of their ordinary activities.
Racial Profiling and Suspicious Activity
One of the most controversial issues associated with suspicious activity investigation is racial profiling. To balance the needs of homeland security and the suppression of racial prejudice, it is important that the public distinguishes the difference between perpetrator profiling and racial profiling. Racial profiling is based on the assumption that people of a specific race are prone to specific types of behavior. This is, in essence, a form of racial prejudice as it creates a generalization of all people of a certain ethnicity. Perpetrator profiling, on the other hand, examines the common characteristics of perpetrators to generate a useful and accurate picture of a typical perpetrator.
In perpetrator profiling, recognition of common ethnic characteristics provides a very useful tool for investigating crimes or suspicious activity—especially if the variation in ethnicity is very low. For example, the National Center for the Analysis of Violent Crime (NCAVC) has identified that over 90% of malevolent criminal bombers in the United States are white males, many with specific personality traits. This does not mean that all white males are prone to being bombers. However, recognizing this characteristic is a tremendous aid to police in identifying probable suspects in the early stages of a bomb investigation. Likewise, recognizing that members of Al-Qaida are motivated by Islamist ideology and that most Al-Qaida members are of Middle-Eastern descent provides a useful tool in the early stages of investigating suspicious activity. This fact by no means suggests that all Muslims or people of Middle-Eastern origin are potential terrorists. As demonstrated throughout history, terrorism transcends all races.
It is equally important to recognize the limits of ethnic identification in perpetrator profiling. Though many Al-Qaida members are of Middle-Eastern origin, there are many that are not. Al-Qaida has also recruited members from Africa, Asia, and many other parts of the world. Considering this, it is very dangerous for the public or law enforcement to assume that all Al-Qaida members have a Middle-Eastern appearance. Apparent ethnicity may contribute to the probability of suspicions, but should never be regarded as a final means of qualifying a threat.
Terrorism Consciousness and American Society After 911
No one would deny that American society has changed in the aftermath of September 11th. The reality of terrorism as a threat has become imprinted in the consciousness of most everyone. From government officials and police to housewives and young children—virtually every American has felt the effect of September 11th. For many people this new awareness has led to a state of fear and frustration.
Nevertheless, people in many part of the world have learned to successfully cope with terrorism. In locations such as Northern Ireland, Sri Lanka, Israel, and Spain, terrorist attacks have been a persistent threat for decades. Yet despite the daily occurrence of bombings and armed assaults, people in these countries have learned to live with terrorism as a fact of life. Bakers still bake bread, teachers still teach, and bus drivers still drive buses. For citizens in these countries, awareness of suspicious activity and preparation during terrorist alerts are an integral part of daily life. As the American War on Terrorism continues, it is only a matter of time before the public adjusts to this new “Post-911” reality. One of the first steps in this adjustment is the realization that the public is not helpless or solely dependent on the work of the authorities. Quite the opposite: By being aware of suspicious activity and reporting these events to police, every citizen plays a vital role in winning the War on Terrorism.
About the authors
This essay was prepared by Craig Gundry and K.C. Poulin of Critical Intervention Services. Mr. Gundry, the Vice President of Special Projects for CIS, is a security consultant with over 13 years experience in anti-terrorism and weapon of mass destruction issues. Mr. Poulin is the President of Critical Intervention Services and a frequent lecturer on terrorism preparedness.