Indicators of Terrorist Activity

SECURITY WARNING: The following blog post discusses information that has been marked as ‘Law Enforcement Sensitive’ by DHS, Protective Security Division, and has been disclosed without appropriate authorization. Under the Obama Administration’s Wiki Leaks Doctrine, reading this post or downloading the referenced document by a government employee or contractor with access to sensitive but unclassified information could have negative consequences.


Thanks to the folks over at PublicIntelligence.net I have had a chance to read an interesting document that should be of interest to everyone in the chemical security community. This draft version of the 2004 “Potential Indicators of Terrorist Activity Infrastructure Category: Chemical Storage Facilities” provides an overview of the reasons why a chemical facility might be attacked by terrorists. It also provides an extensive discussion of indicators that might be expected to be observed as terrorists prepare for an attack.

As I have noted on many occasions in this blog an effective terrorist attack will be preceeded by a period of surveillance that will allow the terrorist to collect the information necessary to prepare an effective attack on the site. Detecting this pre-operational reconnaissance may allow law enforcement personnel to disrupt the attack before it has a chance to cause any damage at the targeted chemical facility. Being able to recognize this surveillance is thus should be key part of any chemical facility security plan.

This DHS report breaks the indicators down into four areas:

• Surveillance Indicators;

• Transactional Indicators;

• Customer Behavioral Indicators, and

• Weapons Indicators.

Document Shortcomings

There are two major shortcomings in the discussion in this document. First it does not do a good job of reminding people that the indicators are not proof of terrorist intent. Many of the indicators, including photography of the site, may have perfectly innocent reasons for being done and may, in fact, be politically protected behavior. This needs to be specifically and repeatedly brought to the attention to front line security personnel in training and exercise situations. Failure to do so could result in lengthy and expensive litigation.

Second, there is no discussion of the fact that facility personnel need to report this type behavior and take no direct response to the potential terrorists until an actual attack starts. In almost all cases facility security personnel have no authority to take actions off-site to protect the facility. Even politically correct overt responses to potential indicators of pre-operational planning could result in increased efforts at concealing pre-attack preparations and making preemption of the attack difficult or impossible.

Recommendation

Even with the inadequate coverage of those two topics, I firmly recommend that all chemical facility security managers download and review this document.

Suspicious Activity Reporting Training

This is a good place to mention that I have been asked to plug a SAR training program that I have previously mentioned. For obvious reasons both DHS and DOJ are really getting behind the suspicious activity reporting movement. While the LEAPS.TV training program mentioned is primarily targeted at law enforcement personnel, security guards and anyone responsible for facility security planning would do well to take the 18 minutes necessary to complete this free, on-line training program. (Full Disclosure: I have a training program available on LEAPS.TV and will hopefully be developing more of them in the future.)