The Department of Homeland Security prepared and distributed an
information guide titled The Seven Signs of Terrorism; the guide is an
accurate representation of the strategies employed by terrorists.
These Seven Signs offer an opportunity to look for unusual
circumstances and report them to law enforcement. The benefit to all
Americans is that at any one of these steps, a potential attack can be
prevented.
Sign 1 – Surveillance
Prior to an attack, often weeks or months before, terrorists will
conduct surveillance and scouting operations. Such methods include
photography, videotapes, diagramming, mapping, measuring, and
observing security, or other out of the ordinary practices. These acts
have occurred on our ferry systems in New York and Washington State,
the JFK airport, power grids, dams, buildings (Sears Tower in
Chicago), bridges (Brooklyn and George Washington in New York),
tunnels (Lincoln and Holland in New York), subway systems, rail, and
many others.
What to look for:
- Suspicious people taking video or photos, diagramming or measuring
in areas not normal; they may be there on multiple occurrences, or may
be different people collecting the same information; staying in
position for longer than normal times. - The use of technology such as cell phone cameras, mini-cameras.
- Taking photos or video of security; timing security, measuring
distances from police or fire stations to the target. - The use of GPS units where it seems unusual.
- People in possession of maps of critical infrastructure, highlighted
in key areas. - The use of communications equipment where not normally used – cell
phones, walkie-talkies.
For example, in Washington State, there has been considerable
surveillance done on the ferry system. Hundreds of reports have been
made of suspicious activities, including photography, videotaping,
measuring, diagramming, cell phone conversations with nearby boats,
attempts to enter secure areas, including the pilot house and engine
rooms. The photography has not been of the truly outstanding scenery
of Seattle, but has been structural supports of the ferries, security
operations, traffic and passenger movement, and ferry operations. Many
of these cases have been reported to law enforcement and
investigations determined that more than two dozen were classified as
pre-operational surveillance.
Other examples have included surveillance of similar activities in
shopping malls, mass transportation, power stations, cell towers,
dams, and other critical facilities. There are many well documented
cases of such behavior in the United States. As will be discussed in a
later chapter, there have been a number of attacks disrupted in
America due to citizens and law enforcement personnel who are alert
and aware.
Sign 2 – Elicitation
Terrorists will attempt to gather and obtain information about a
place, person, or operation that is more likely than not a critical
infrastructure, either public or private. They may ask questions, make
inquiries, they may obtain plans or blueprints, or other information,
much of it from the Internet.
What to look for:
- People asking questions, unusual or normal, looking to get
information. Pay particular attention to questions about security,
access to facilities or information systems, delivery schedules. - Attempts to access information via computer – blueprints, plans,
schedules, anything to do with strengths or weaknesses. Information in the media has been of interest.
An example of elicitation may involve a person unknown to you, asking
what may appear to be normal questions, always looking for
information. Such a case may involve a critical facility, such as a
power station, or computer data center. The person may appear as if a
tourist or just a person interested in electronics or computers.
Questions may include hours of operation, how many people work in the
building, whether it has security, or alarm systems to protect the
facility or business information. These questions may be fitted in
among other ordinary conversation. Always be aware that if it doesn’t
seem normal, it probably isn’t.
Sign 3 – Tests of Security
Terrorists will test security/law enforcement by entering or
attempting to enter secured or essential faciities or locations, and/
or will time reponses and routes of response. The locations of police,
fire, emergency medical services will be identified and routes of
response located; timing of resonse likely will happen as well,
usually through a false alarm.
What to look for:
- People attempting to enter secured or forbidden areas. If contacted
by security while doing so, they will usually have a plausible story. - Attempts to move prohibited materials through security to determine
if they will be detected and what the response will be. - False alarm or false report of an incident to test response times,
deployment, and numbers of responders. - Testing of alarm systems to determine reaction and timing.
- Unattended packages or briefcases to see what the reaction will be.
There are any number of examples supporting this as a planning step.
On the Washington State ferries, for example, there were many attemps
to enter teh locked engineering facilities or locked pilot house.
These attempts have been both overt and covert. Each time, when caught
doing so, there is always a prepared story for the particular
circumstances.
Another case occurred at a major shopping mall where the suspicious
behavior involved the attempt to enter secure areas. The intent is to
try to determine what the response by security, law enforcement, or
store personnel would be, always looking for the amount of time it
takes to react, as well as what the actual reaction will be. Again,
when contacted, there is always a prepared story to be told.
Sign 4 – Acquiring Supplies
Terrorists will purchase weapons and ammunition, explosives or the
components of explosives, chemicals, equipment, or military or law
enforcement identification and uniforms to allow easier access into
areas.
What to look for:
- People who buy excessive amounts of dangerous chemicals or
components that can be used in constructing explosive devices – an
example would be fertilizer (ammonium nitrate). - People buying weapons and ammunition at unusual levels.
- People who are not law enforcement or security buying (or stealing)
uniforms, badges, identification cards. - People buying used emergency vehicles that may be used in an effort
to access the target without raising suspicion. - People attempting to obtain access cards to facilities.
- Thefts of weapons, with an emphasis on military grade weapons.
In recent years, there have been a number of thefts of law enforcement
vehicles, ambulances, and government vehicles. There are also a number
of cases of stolen or missing law enforcement, fire, and emergency
medical personnel uniforms, badges and identification cards. Many have
not been recovered, and it is not known if terrorists stole them.
Presuming they did in some cases, and emergency vehicle or uniform,
including identification can offer any number of opportunities to
enter into areas not normally accessible.
Weapons are easy to obtain, as is ammunition. Explosives and explosive
components are no longer that easy to purchase in quantity due to the
highly successful efforts of law enforcement. Due to the awareness of
the American people it has become much more difficult to amass large
quantities of potentially dangerous materials for use in an attack. Of
note is that we must remain diligent in being aware, prepared, and
need to report.
Sign 5 – Suspicious People
Look for people who are out of the ordinary, who do not belong, or
whose actions are out of the ordinary. Appearance, position, and the
actions may each be indicators. This may be as simple as knowing it
when you see it – to follow your instincts. Profile behaviors, not
people. Terrorists take advantage of political correctness and the far
of potentially offending someone.
Terrorists are not all of one race, color, or gender. They use men,
women, and children of many races and ages. There are numerous cases
of these actions, including parents placing explosives on their
children and exploding them in crowds. There are cases of terrorists
placing explosives on the elderly and mentally handicapped people,
then directing them to the target and exploding them. Watch for
suspicious behaviors, not suspicious people. If it looks wrong, it may
very well be wrong – report it.
What to look for:
- People whose actions are not ordinary or normal.
- People who seem out of place.
- People not dressed for the weather or location.
- People trying to avoid detection or letting others see who they are.
- People who are evasive when spoken to or confronted.
- Carrying materials not suitable to the location.
- People attempting to hide.
- Reports of weapons practice in out of the way areas.
Because the American people are substantially more aware of events,
circumstances, and their surroundings, detecting these activities is
much more frequent. Passengers on Washington State ferries report many
suspicious behaviors. The recent case in New Jersey involving the
terrorists plotting to attack Fort Dix was stopped due to an alert
store clerk reporting behaviors on a video.
A case in Washington State involved neighbors observing long-time
neighbors with their garage full of cases of cigarettes. Although they
did not know of the significance, this inquiry led the FBI to money
laundering for terrorists through cigarette purchases, which is not an
uncommon tactic to raise money. Other than the cigarettes these next
door neighbors were friendly and sociable people.
Sign 6 – Dry Runs
Prior to the actual attack the terrorists will conduct one or more dry
runs to look for flaws or unanticipated problems. This is a critical
time when they may be identified or caught. There are many examples of
this occurring. Prior to 9/11 the hijackers flew on the same planes
they ultimately hijacke on multiple occasions scouting the best seats,
timing opening and closing cockpit doors, timing specific actions of
flight attendants, which planes had the most fuel and fewest
passengers, always looking to maximize casualties and damage.
The terrorists plotting to hijack 10 airliners out of the UK were
identified and apprehended during a dry run. Virtually all major
attacks, before they occur, will have had a least one or more dry
runs. Terrorists will conduct a test of their plan to look for
problems they may overcome before the actual operation.
What to look for:
- Tests of the system: security, response times, reactions to the
test. - Suspicious people or suspicious actions – if they seem out of the
ordinary they probably are.
Terrorist interest in airlines has not diminished, and they are
continually seeking new ways to use aircraft as controlled missiles to
specific targets. More recent dry runs have included using larger
numbers of hijackers, different types of explosives,, and theft of
airline uniforms and identification. Actual attempts have been stopped
in other countries, including a recent attempt in China.
The Fort Dix plotters made a number of runs into the fort delivering
pizza in order to determine the best time, best route, and best escape
route from the fort. From an elicitation perspective, as a result of
prior business in the fort, they were able to obtain a map, ostensibly
to know where to deliver pizza – an excellent example of elicitation.
Sign 7 – Deployment of Assets
This is immediately prior to the attack and is the last opportunity to
stop the attack. The terrorists will move into their pre-determined
positions just prior to the attack. Once in place and the timing is
appropriate, they will attack the target. The history of attacks
demonstrates that the terrorists may not always assemble in one
location. These are the activities where the terrorists stage for the
attack.
What to look for:
- People or vehicles in unusual positions or places.
- People dressed in clothing not aligned with weather or location.
- Unusual number of people or vehicles (or vehicle types) in vicinity
of possible attack site.
While these indicators and signs are not a complete list, they give
the reader an idea of what to look for and report, or respond to.
(Source: Suicide Terror: Confronting the Threat by William E.
Cooper)