Skip Navigation LinksHome > Alerts & Warnings > Seven Signs of Terrorist Activity
Seven Signs of Terrorist Activity

The following information was obtained from the ASIS public website. These seven signs of terrorist activity were developed by the Metropolitan Transportation Authority of New York.  The Michigan State Police have created a video presentation of the seven signs of terrorist activity.  To view the video, click here.

Surveillance
Elicitation
Test of Security
Acquiring Supplies
Suspicious People Who Don't Belong
Dry Runs
Deploying Assets/Getting Into Position

Surveillance

If terrorists have chosen a specific target, that target area will most likely be observed during the planning phase of the operation. They do this in order to determine the strengths, weaknesses and number of personnel that may respond to an incident. Routes to and from the target are usually established during the surveillance phase. It is therefore important to take note of such things as someone recording or monitoring activities, drawing diagrams on or annotating maps, using vision-enhancing devices and/or having in one's possession floor plans or blue prints of places such as high-tech firms, financial institutions or government/military facilities. Any of these surveillance-type acts may be an indicator that something just is not right. Nothing is too trivial and should not be discarded as such.

Elicitation

The second sign or signal is elicitation. What this means is anyone attempting to gain information about a place, person or operation. An example is someone attempting to gain knowledge about a critical infrastructure like a power plant, water reservoir or maritime port.

Terrorists may attempt to research bridge and tunnel usage, make unusual inquiries concerning shipments or inquire as to how a military base operates.  They may also attempt to place "key" people in sensitive work locations.

Tests of Security

Tests of security is another area in which terrorists would attempt to gather data. This is usually conducted by driving by the target, moving into sensitive areas and observing security or law enforcement response. Terrorists would be interested in the time in which it takes to respond to an incident and/or the routes taken to a specific location. They may also try to penetrate physical security barriers or procedures in order to assess strengths and weaknesses. They often gain legitimate employment at key locations in order to monitor day-to-day activities. In any event, they may try to gain this knowledge in order to make their mission or scheme more effective.

Acquiring Supplies

Another area to be cognizant of is anyone acquiring supplies. This may be a case where someone is purchasing or stealing explosives, weapons or ammunition. It could also be someone storing harmful chemicals or chemical equipment. Terrorists would also find it useful to have in their possession law enforcement equipment and identification, military uniforms and decals, flight passes, badges or even flight manuals. If they can't find the opportunity to steal these types of things, they may try to photocopy IDs or attempt to make passports or other forms of identification by counterfeiting. Possessing any of these would make it easier for one to gain entrance into secured or usually prohibited areas.

Suspicious People Who Don't Belong

A fifth pre-incident indicator is observing suspicious people who just "don't belong." This does not mean we should profile individuals; rather, it means we should profile behaviors. These include suspicious border crossings, stowaways aboard a ship or people jumping ship in a port. It may mean having someone in a workplace, building, neighborhood or business establishment that does not fit in because of their demeanor, their language usage or unusual questions they are asking. As an officer you may respond to a complaint that may appear to be a routine investigation but results in something much larger in significance.

Dry Runs

Another sign to watch for is "dry runs." Before execution of the final operation or plan, a practice session will be run to work out the flaws and unanticipated problems. A dry run may very well be the heart of a planning stage of a terrorist act. If you find someone monitoring a police radio frequency and recording emergency response times, you may very well be observing a "dry run." Another element of this activity could include mapping out routes and determining the timing of traffic lights and flow. This stage is actually our best chance to intercept and stop an attack. Multiple dry runs are normally conducted at or near the target area.

Deploying Assets/Getting Into Position

The seventh and final sign or signal to look for is someone deploying assets or getting into position. This is a person's last chance to alert authorities before the terrorist act occurs. It is also important to remember that pre-incident indicators may come months or even years apart. It is threfore extremely important to document every fragment of information no matter how insignificant it may appear and forward this information.