The document discusses suspicious activity reporting and adversarial surveillance. It defines suspicious activity as behavior reasonably indicative of preoperational planning related to terrorism or other criminal activity. Prior to attacks, terrorists often engage in precursor activities like planning, acquiring materials, and reconnaissance. This adversarial surveillance is meant to gather information on locations, security procedures, and personnel. Citizens should report any suspicious surveillance activities to local authorities. Reports are reviewed by fusion centers and possibly shared with the FBI if deemed relevant to national security.

1. - PowerPoint by Jeffery Martin
SUSPICIOUS ACTIVITY REPORTING

2. • Both past and recent terror attacks
show that events that may seem
unrelated may actually be part of a
larger plot.
• Prior to terrorist acts, the terrorist
usually engage in precursor
activities; where they make plans,
acquire materials, collect
information, and commit other
criminal acts.
• These actions will produce
behaviors that may seem
suspicious and may provide clues as
to what may lie ahead.
SUSPICIOUS ACTIVITY

3. • Suspicious activity is defined as
“Observed behavior reasonably
indicative of preoperational
planning, related to terrorism or
other criminal activity”.
• When thinking about suspicious
activity do not focus on “who”;
instead focus on “what”.
• A persons race, ethnicity, nationality,
or religious beliefs do not make a
person “suspicious”.
• When reporting suspicious activity ,
focus on the observable behaviors;
such as the location of the activity,
the timeline of events, and the tools
and methods used (cameras,
binoculars, fake I.D.s, etc.).
WHAT IS SUSPICIOUS ACTIVITY?

4. • A breach, or attempted breach, of a
secured area.
• A person that is lying about their
identity, or trying to use false
identification, insignias, or
documentation.
• Theft, loss, or diversion of materials
associated with the facility.
• Vandalism of a facility or protected
site.
• Cyber attacks to attempt to disrupt an
organization’s IT systems.
• Expressed or implied threats to
damage or compromise a facility or
structure.
• Unusual or dangerous aviation
activity in the area, that has been
recently interpreted as suspicious; or
poses a threat to people or property.
• Someone asking for specific facility,
operations, or security information.
• Testing security systems, by pulling
fire alarms, opening doors armed
with an alarm, etc.
• Storing unusual quantities of
materials; such as weapons,
chemicals, cell phones, and laptop
computers
TYPES OF SUSPICIOUS ACTIVITIES

5. • Prior to a terrorist attack or other
planned criminal act, the actors
usually perform some type of
adversarial surveillance.
• Adversarial Surveillance is the
gathering of information in
preparation for an action that is
aggressive or criminal in nature.
• These actions include domestic and
international terrorism, crimes
against individuals, espionage, theft,
stalking, and destruction of property.
ADVERSARIAL SURVEILLANCE

6. • When planning illegal activities –
including terrorist attacks or other
crimes – perpetrators may conduct
surveillance to try to learn all they
can about:
 The location.
 Building access, egress, or
vulnerabilities.
 Routine activities of employees,
suppliers, customers, and visitors.
 Security protocols or equipment.
 Other relevant information.
ADVERSARIAL SURVEILLANCE (CONTINUED)

7. The following types of information can
be collected through adversarial
surveillance:
• Facility layout, including access and
egress routes
• Locations and numbers of security
personnel and cameras
• Timing of routine events
• Security/visitor processes and
procedures
• Security equipment, including
badges and uniforms
• Access requirements for restricted
or employee-only areas
• Information about maintenance and
cleaning personnel or procedures
ADVERSARIAL SURVEILLANCE (CONTINUED)

8. • Surveillance is usually the weak
point in the planning process for
terrorist attacks or other criminal
acts.
• This is because It takes time, and
may involve repeated visits.
• Surveillance may take place over
several days, weeks, or longer.
• Surveillance by highly trained
individuals can be hard to detect;
however experience has shown us
that individuals involved in planning
terrorism are not always well-trained
or equipped, and are more
vulnerable to detection by
employees, passers-by, and others.
DETECTING ADVERSARIAL SURVEILLANCE

9. • In order to detect surveillance by
adversaries, first you should take
note of activities you observe that
are typically associated with
surveillance, such as watching a
location or recording information
about it over time.
• Next, you should evaluate any
surveillance-related activities that
you observe to determine if they
seem unusual or noteworthy. Often,
you will find that surveillance
activities will appear unusual and out
of place.
DETECTING ADVERSARIAL SURVEILLANCE
(CONTINUED)

10. • In order to raise awareness, and
emphasize the importance of citizen
reporting, the Department of
Homeland Security launched the “If
You See Something, Say Something”
campaign.
• Illegal or suspicious activities should
be reported to Security and/or local
law enforcement; for investigative
follow-up, and recording.
REPORTING

11. • When you report suspicious activity
to Security, they will investigate the
event, gather information, look for
any trends or patterns, and decide if
local law enforcement needs to be
notified.
• When suspicious activity is reported
to law enforcement, they will
provide it to a local fusion center for
further review.
WHAT HAPPENS AFTER A REPORT HAS BEEN
MADE?

12. • Fusion center receive information
from a variety of sources, such as
suspicious activity reports (SARs)
from law enforcement, citizen
reporting, emergency responders,
and other government entities;
including federal partners.
• Qualified analysts at these centers
review the information and decide if
there are any possible links to
potential terrorist attacks, and if the
information meets the criteria for
sharing nationwide.
FUSION CENTERS

13. • If the information meets the criteria
to be shared nationwide, it is
reported to the Nationwide SAR
Initiative (NSI), and forwarded to the
Federal Bureau of Investigation
(FBI), and law enforcement agencies
across the nation; for investigative
follow-up.
FUSION CENTERS (CONTINUED)