AT YOUR DISPOSAL !!!
The Adversary: Case Study
Profiling and Suspect Identification
Foundation of Surveillance
Surveillance and Pre-Attack Indicators
Surveillance Counter Measures
Types of Adversaries
Stages in preparing an attack
Professional killers and mercenaries
To introduce potential adversaries’:
• We believe that the VIP Protection branch is the most important in the security field, it requires the highest level of skills, know-how, practical experience, quality of people and seriousness of all the various security fields, especially because the danger to a human life is the gravest and most immanent threat.
• Our graduates who work in the field of Installation Security or Securing Valuables will be able to do so very efficiently, without any further training.
An individual or organization whose intentions are to harm another object (individual or organization) in order to achieve their goals.
Types of Adversaries
· Terrorist Organizations
· Ideological Movements
· Political Movements
· Religious Movements
· Parties with economical/ financial interest
· Criminal Organizations
• Many assassins try to kill due to a belief that the target of their violence is either a cause or a contributor to some idea or action that the assassin opposes:
•Example, in the US, President Garfield was killed by a man who believed that he had abandoned the Principles of his political party and was thus contributing to its decline.
• Together with assassins motivated by psychological causes these types of killers are especially dangerous as their fanaticism may lead them to attack regardless of personal cost.
•Modern example: car and truck suicide bombers in the Middle East, such as those that attacked the Marine Compound in Beirut in 1983.
Political / Revolutionary
• There may be groups or individuals who want to change an existing governmental or social structure: these groups may resort to violence in order to remove a leader.
•Example: ex-Czar Nicholas of Russia and his family were assassinated by communists following the Bolshevik Revolution.
•Example: radical Puerto Ricans wanted to kill President Truman in 1950 to end US control over Puerto Rico.
• In some cases assassinations have been motivated by personal disputes or grievances.
• A leader or dignitary who has become involved in perceived “immoral behavior” such as infidelity or disputes concerning personal behavior.
•Example: President Morales of Bolivia was killed when he lost his temper and got into a fight with an aide. His nephew tried to stop him and ultimately shot and killed him.
• Business leaders, while not having control over a government may be involved in a controversy or dispute with another that may get him killed
Economic / Financial
• There are cases where the assassins believe the target of their attempt is responsible for some sort of economic hardship or condition.
•Example: Japanese Minister of Finance, Inukai Tsuyoshi, was assassinated because he was held accountable for the harsh economic conditions among Japans rural population.
• Some killers are mentally deranged or emotionally unstable.
•Example: John Hinckley, who had a fascination with actress Jodie Foster and the movie Taxi Driver, shot President Reagan, because he believed he would gain her favor by killing the President of the United States.
• These types of assailants are a special cause for concern, as they are not likely to be dissuaded from attacking by logical measures, such that would prevent a normal person from doing so.
• It is often hard to know the exact cause of a particular assassin’s decision to kill. Oftentimes, the killer himself is the only one who can supply the true evidence for motivation.
• It’s not always possible to pinpoint the exact reason, and it may also be a combination of reasons, in most cases more than one motive is involved.
• Whatever the motivation, a threat to a client and to the personnel protective detail may exist, and it must be planned for and anticipated by personal protective agents.
• Deterring and/or preventing the target’s activity
• Eliminating or harming the target
• Receiving media attention
• Threating or kidnapping for ransom
• Kidnapping in order to obtain information
• Robbery – obtain valuables & money
• Obtain information
• Disrupt operation
· Insulting – verbal, spitting
· Throwing objects
· Physical attack with bare hands -hitting, strangling
· Blunt, “cold” weapon – club, stick
· Sharp “cold” weapons – axe, knife
· Explosives – suicide explosive, hidden device, thrown object
· Arson – Flammable objects, manual arson, thrown objects
· Over powering and kidnapping
· Running over and hitting with vehicle
· Poisoning – poison, acid, radioactive material – in food, on object, by injection
· Shooting – firearm, improvised firearm, semi-automatics
· Shooting – firearm, automatic
· Shooting – from a vehicle
· Explosives – thrown objects
· Arson – thrown incendiary objects
· Shooting – Sniping from a hiding place, long range firearms/ automatic
· Rocket firing
· Catapult shooting
· Explosives – hidden devices, remote control, conditioned activator
· Arson – covert device, thrown device
· Poisoning – poisoned package/food – chemicals, biological and radioactive
Stages in Preparing an Attack
1. Choosing the target
2. Gathering intelligence prior to the operation and analyzing the information
3. Checking alternatives of attack
4. Choosing the best possibility
5. Detailed planning of the stages of attack based on processed information
6. Preparing personnel and equipment for the attack: recruiting and training personnel, preparing accessories, weapons and explosives, documents, etc. (*This can be in the first stage also)
7. Planning an escape route (vehicle, safe house, passports, flight tickets, etc.)
8. Field preparation for the attack
Never underestimate your Adversary
Think like the Adversary
Personal Protection Agents must become familiar with the personality types that have been found throughout history to present the most risk to the life of politicians, celebrities, dignitaries and other likely targets needing protection.
By understanding these basic personality types the agent may be able to increase his/her awareness of these types of assailants and to better prepare to defend against the threat they represent.
It is important to remember that profiles are generalized factors, that when considered together, are helpful in making sense of typical types of assassins.
This does not mean that people with characteristics exactly the opposite of the profiles types won’t become a threat to the Principle.
The use of profiles is meant to be a helpful guide, not a concrete “spotting manual”.
Profile of an Assassin:
• Statistically, most assassins are male, short in stature and slight in build.
• He may come from a broken family.
• He is often a loner, 25- 35 years old and neat in appearance.
• He is typically unmarried and has no steady girlfriend.
• To varying degrees, the assassin may be suffering from mental disorder or delusions.
• The assailant’s work history will generally be good, but may include a firing or other unhappy termination approximately 1 to 3 years prior his assassination attempt.
• He may identify with a religious or political movement. If he does not actually belong to an established or recognized movement, he may invent one.
• The assailant may be after the office the target holds, and not the actual target in themselves.
• The assailant will likely have orderly and systematic personal habits prior to the attack. Consider the “Unabomber”, who apparently kept extensive diaries detailing his bomb attacks on individuals.
• The mood of the assailant is likely to swing frequently, from happy to sad.
The assailant may have been diagnosed as a manic-depressive in the
past, and may be, or have been on medication.
• Something about the person will often not seem “quite right“ to the trained Personal Protection Agent. The person will not “fit in” for some reason.
•Example: the assailant may be the only one all alone in a crowd full of families and couples. It is not common for those with loved ones, like children or spouses, to attack a target.
Political or Religious
• Egyptian President Anwar Sadat was killed by Muslim fundamentalists, who believed that his political course of action regarding relations with Israel and his actions toward a more secular type of society were an insult to Islam.
• As recently as the 1990’s. The Egyptian government has been embroiled in a bitter struggle with extremists who hold similar beliefs.
• Many government officials have been killed in the years since the assassination of President Sadat.
• Similar problems exist in Morocco.
• The United States has seen extremist political groups of various types since the 1960’s.
• Many of these groups have posed a threat to politicians, governmental administrators, military officers and others who are seen as enemies by these groups and their members.
• Members of these groups often see the world in such a way that they are able to justify killing one or more people in order to make a statement about the causes(s) they believe in.
• These people may espouse terrorism as a legitimate means to bring about social change.
• If a particular Principal is seen as part of the ‘problem” from the standpoint of the adversary, that Principal may become one of their targets.
• In addition, the target may be at risk simply because the death of the target would result in what the adversary sees as sufficient propaganda or publicity value.
• Some of these groups consider themselves as “armies” engaged in struggle with an enemy government.
•Example: the Irish Republican Army has a “provisional” wing. The “provos”, as they are known, consider themselves at war with Great Britain.
• In the 1970’s, the Red Army Faction, which was active in assassinations, hijackings and robberies, considered itself at war with “imperialist” countries such as the United States, France and West Germany.
• These types of killers are especially dangerous as they willfully embark on missions to kill or maim others, often without regard to bystanders and often with fully automatic weapons and explosives.
• While their target may be innocent, people unknown to them such as the many shoppers, tavern customers and bystanders killed by the IRA over the years, the target may be a particular person who may be the Principal a Personal Protective Agent is assigned to protect.
• Terrorists, who usually kill for political or religious reasons may see an individual as either vulnerable or simply expedient in terms of making their point.
•Example: when the Red Brigade assassinated American Foreign Service officer Leamon Hunt in Rome, Italy in the 1980’s, they issued a statement opposing NATO and Italy’s involvement in NATO. However, he had nothing to do with NATO. He was simply an American residing in Italy and a convenient target.
• There have been other examples of terrorist killings since the 1970’s that highlight the need for Personal Protective Agents to be educated and aware of terrorist groups in operation, as well as the threat they may represent.
Professional Killers and Mercenaries
• Some killings have been committed by those who are paid to kill.
• Example: William of Orange, the King of the Netherlands was killed for a reward of 25,000 gold pieces offered by the King of Spain.
• Mercenaries in modern times are still occasionally involved in attempts to overthrow an underdeveloped country’s government.
• This may include assassination attempts on key political leaders.
• Assassins can also be hired to kill a Principal as part of an illegal business deal.
• The Principal may be at odds with another party, or may
represent a threat to the party who hired the killer for some reason.
• If there are those who would like to harm the Principal, these facts should be known to the Personal Protective Agent if at all possible.
• Who has a motive for wanting the Principal killed and why? Paid killers may be part of an organized crime syndicate like the Cosa Nostra in the United States, the Jamaican Posses or the Sicilian or Russian Mafia.
• Mercenaries may also “moonlight” between wars by carrying out assassinations.
• Killers such as these present special problems, as they are more highly trained and experienced than the disorganized or deranged loner.
• An attack by a trained killer is likely to be especially lethal and precise, and may be carried out by sniper attack or remote control explosives.
• If threats to a Principal from members of these groups are known to exist, extreme security measures by the personal protective agent are likely justified.
• This may include extra protective personnel, decoy vehicles and increased tactical firepower.
• Of current are former members of Soviet and Soviet-Bloc security and intelligence agencies, who found themselves out of work following the fall of the Iron Curtain. Many of these trained operatives have made their way into organized crime groups, such as the so-called “Russian Mafia”.
• It has been documented that these groups have allied themselves with other traditional organized crime groups in some areas.
• These new organized criminals have shown themselves to be especially ruthless, and have become a major problem in the former Soviet Union.
• Kidnapping has become a specialty for these groups, something that can pose a threat to many wealthy Principals, particularly those living, working or traveling abroad.
• Should the Personal Protective Agent travel in areas known to be frequented by these groups and their members, it would be important to avoid scenarios where a regular pattern is kept, making the Principal more vulnerable to a kidnapping attempt.
• One of the ways in which the modern Personal Protective Agent can help ensure the safety of a Principal from the threats presented by assailants, whether they are loners or members of organized groups, is to develop and practice Powers of Observation.
• These skills can serve the Personal Protective Agent well as he or she goes about the tasks associated with the protection of a Principal.
Check Your Understanding
1.Which one is NOT a type of adversary y?
a. Terrorist organization
b. Ideological Movement
c. Members of Parliament.
d. Religious Movement.
2.Which is a long-range weapon?
AT YOUR DISPOSAL !!!
The Adversary – Past Events
Past events – Case Study
Assassins and Assassination Behavior
Key Observations on Assassins
Case Study 1 – Aldo Moro Killing
Case Study 2 – Alfred Herrhausen
Modus Operandi and Ranges
Past Events – Case Study
This study examined the thinking and behavior of all 83 persons known to have attacked or attempted to attack a prominent public official or figure in the United States from 1949 to 1996.
During this time period, 74 attacks and near-lethal approaches occurred.
· 16 individuals who were members of groups carried out six attacks.
· 67 individuals acting alone carried out 68 of the attacks and near-lethal approaches. (One individual attacked two public figures.)
Assassins and Assassination Behavior
Three prevalent beliefs about assassinations exist in popular culture, which are largely unsupported by data. These beliefs have been gathered and analyzed about attackers of public officials and figures in the United States. Critical thinking about assassination behavior proves these beliefs to be myths.
Myth 1: There is an “assassin” profile
Attackers and near-lethal approaches do not fit anyone descriptive or demographic profile (or even several descriptive or demographic profiles)
Researching the histories and personal characteristics of attackers and near- lethal approaches revealed the following information:
• Their ages ranged between 16 and 73.
• Almost half had attended college or graduate school.
• They often had histories of mobility and transience.
• About two-thirds were described as socially isolated.
• Few had histories of arrests for violent crimes that involved weapons.
• Few had been incarcerated in Federal or State prison before their attack or attempt to attack a public figure.
• Most had histories of weapons use, but few had formal weapons training.
• Many had histories of explosive, angry behavior, but only half of the individuals had histories of physically violent behavior.
• Many had indicated their interest in attacking a public figure to someone else.
• They often had interests in militant or radical ideas and groups, though few had been members of such groups.
• Many had histories of serious depression or despair.
• Many were known to have attempted suicide or to have considered suicide at some point before their attack or near-lethal approach.
• Almost all had histories of grievances and resentments, many directed against a public official or figure.
Although there is no such thing as an “assassin profile”, potential attackers often engage in many of the same behaviors and actions before their attack.
Although not every attacker and near-attacker engaged in all of these activities and behaviors, most engaged in several of them.
John Wilkes Booth, he assassinated Abraham Lincoln
Lee Harvey Oswald, assassinated John F. Kennedy
Myth 2: Assassination is a product of mental illness or derangement
• Mental illness only rarely plays a key role in assassination behaviors.
• Many believe that attacks on public figures are deranged behaviors, without rational or understandable motives; they therefore conclude that perpetrators of this crime must be mentally ill.
• In most cases, however, mental illness does not appear to be a primary cause of assassination behavior.
• Mental health histories of attackers and near- lethal approaches include the following:
• Many had contact with mental health professionals or care systems at some point in their lives, but few indicated to mental health staff that they were considering an attack on a public official figure.
• Almost half had histories of delusional ideas, but few of these ideas led directly to a near-lethal attack.
• Few had histories of commanding hallucinations (imagined voices ordering the individual to take action).
• Relatively few had histories of substance abuse, including alcohol abuse.
Myth 3: Those who threaten are most likely to car y out attacks
· Individuals who pose an actual threat often do not make threats, especially direct threats.
· People who study assassinations often associate threats with attackers, as if the two are the same. Many assume that those who make threats pose real danger.
· Although some who threaten may pose a real threat, usually they do not. However, most importantly, those who truly pose threats frequently do not threaten
· None of the 43 assassins and attackers communicated direct threats to the target before their attack.
· Less than one-tenth of all 83 attackers and near-lethal approaches communicated a direct threat to the target or to a law enforcement agency.
· Two-thirds of the assassins and near-lethal approaches were known to have spoken or written in a manner suggesting that they were considering an attack.
· Would-be assassins told family members, friends, colleagues, and associates about their thoughts and plans, or they wrote down their ideas in journals or diaries.
Key Observations of Assassins
Three key observations about assassins and their behaviors emerged from the ECSP study:
1. Assassinations and attacks on public officials and figures are the products of understandable and often discernible thought processes and behavior.
2. Most people who attack others perceive the attack as the means to a goal or a way to solve a problem.
3. An individual’s motives and selection of a target are directly connected.
Case Study #1
Aldo Moro Kidnapping
Target: Aldo Moro, former Italian Prime Minister
Offenders: Kidnapped by the Red Brigade
Date: March 16, 1978 at 8:20 A.M.
M.O: Red Brigade staged diversionary traffic accidents to tie up police
• Same departure times
• Same routes
• Detail was predictable
• Unskilled and unprepared driver
How the attack occurred:
Case Study #2
Assassination of Alfred Herrhausen
Target: Highly visible German banker
Date: November 30, 1989
M.O : Road-side bomb Photoelectric cell activation
Where the attack occurred:
• Tree-lined road
• Residential area
• Reduced speed limit
• School crossing
• Bus stop
How the attack occurred:
• Lead car passes bicycle
• Vehicle blocks intersection
• Adversary activates photoelectric cell
• Victim’s car breaks infrared beam
• Bomb detonates by rear door
• All adversaries escape
DO NOT MISS IT !!!
More than 289 Assassinations and attempts during the Last 100 Years
• No assault occurred by chance.
• The most important motive for assault is ideological.
• The most predominant operational method is short range shooting.
• The preferred method of assault by an Emotionally Disturbed Person (E.D.P) is short range shooting, mainly by blending in with the crowd.
• E.D.P have a high percentage of success.
• In 30% of assaults protection forces are injured.
• All assaults were pre-planned and prepared for.
• Travel routes are the preferred place for carrying out assaults.
Check Your Understanding
1. Which statement is NOT true?
a. There is an “assassin profile”
b. The most preferred place for an assault is en route
c. All assaults are pre-planned.
d. Individuals who threaten usually don’t attack.
2.What is the most important motive for assault?
AT YOUR DISPOSAL !!!
Profiling and Suspect Identification
Types of Offenders
“Vampire of Sacramento”
Questioning and Suspect Identification
The perpetrator’s modus operandi (method of operation or M.O.) describes the tools and strategies used to carry out the crime.
It demonstrates some of the suspect’s behavior that, in turn, is linked to their personality.
* Psychological profiles are a tool that can help crime investigators by telling them the kind of perpetrator they are seeking.
* Psychological profiling has been used in the pursuit of serial killers.
x Also in the investigation of product tampering, poison, written threats, serial bombing, serial rape, kidnapping, arson, and murders.
* A profile works best if the offender displays some form of mental disturbance such as employing torture or mutilation.
x Some take a trophy away from the victim, possibly an item of no obvious value but of deep symbolic significance to the perpetrator.
x They may also use a signature, which is a behavioral sign such as positioning the corpse in a certain way or tying a ligature with a complicated knot.
Types of Offenders
Plans the crime, sometimes in great detail, bringing tools and disposes of them.
Takes care not to leave evidence behind and will also hide or dispose of the body.
Average to high intelligence with a stable lifestyle. They normally tend to be married and employed.
Leaves a mess. They don’t plan or bring tools; instead they use whatever is at hand to carry out their attack.
Lives alone or with a relative, may be unemployed, of lower intelligence, and have a history of mental illness.
Their attacks are often accompanied by considerable violence.
Shows mixed characteristics of the first two types.
While their approach may be carefully planned, the assault itself may be frenzied, showing a person losing control over deep-seated urges and fantasies.
“Vampire of Sacramento” (1978)
Name: Richard Trenton Chase
M.O: murdered women, drank their blood and cannibalized their bodies.
At the crime scene investigators noted the following:
Disorder at the scene.
From a study of body type and mental temperament, concluded the murderer was white, thin, undernourished, and in his mid-twenties.
As a disorganized type, he’d be unemployed and live alone.
Found him soon after a 3rd killing spree and he was exactly as they profiled him.
Questioning and Suspect Identification
If suspicion was raised during a security activity, the suspect should be questioned based on the following subjects while trying to confute or to verify the suspicion.
• Ethnic background
• Willingness to cooperate
• Excessive nervousness
• Abnormal or unexplained behavior
• Muscles & blood circulation response (e.g. shaking, peripheral organs turning white/blue)
• Perspiration (e.g. face, hands)
• Spontaneous speaking disorders (e.g. muttering, coughing, choking)
• Reason-ability in the suspect’s version for his presence or behavior
• Changing or inconsistent versions and/or details
• Unrelated clothing & appearance (e.g. coat on sunny day)
• Accessories (e.g. heavy bag, items concealed under clothing)
• Clandestine contact with other people
• Attempt to hide
• Hiding of identity or impersonation
• Extensive interest about security measures and means
• Signs for information gathering (e.g. taking pictures, questioning people).
What to check?
o ID – check picture & authenticity
What to ask?
o Full name
o Updated address
What to check?
o Passport – check picture and authenticity
o Attention to stamps and countries visited
What to ask?
o Where did he arrive from (country of origin)?
o Did he arrive by himself or with others?
o What does he do in his country of origin (occupation)?
o Who initiated his visit to the country/who sent him?
o Where does he stay and visit?
o With whom is he in contact during his stay?
o When does he plan to leave and how?
o What are his plans during his visit?
• Does the suspect own a car – check license and verify details
• Does the suspect have a rented car – check the renter ‘s name and details, verify with the rental company
• Does the suspect have a loaned car – check the loaner name and details, verify with the loaner
In each case the suspect has a vehicle, it is important to locate and inspect to rule out a car bomb
What to ask?
• Did he take pictures? What and when? Other sites?
If it is possible to confiscate the film/data, it is important not to expose it to avoid damaging the images.
Luggage and body search
What to look for?
• Weaponry and explosives
• Information gathering equipment – cameras, binoculars, video cameras, tape recorder
• Documents – maps, drawings, telephone book
Check Your Understanding
1.What is an organized offender?
a. Plans in great detail, but leaves a mess.
b. Doesn’t plan and leaves a mess.
c. Plans in great detail and cleans up any evidence.
d. Uses weapons of opportunity instead of bringing a weapon.
2.What is one of the things you look for in a luggage search?
b. Tape recorder.
Foundation of Surveillance
Covert Personal Surveillance
Overt Personal Surveillance
Covert Electronic Surveillance
Overt Electronic Surveillance
Surveillance Detection Principles
Surveillance Pattern Identification
How Adversaries Select Targets / Victims
Areas of Concern
Methods of Gathering P.O.I
In most popular media, the concept of surveillance is either portrayed as a middle-aged man in a wrinkled coffee-stained suit or an extremely large, sophisticated and complex electronic array, which requires three or more people to monitor. In reality, the typical surveillance operation falls somewhere in between these.
The basic goal of surveillance is the obtaining of information, which might not be immediately available, without a concerted effort and a focused attention.
In most cases, it is the watchful, knowledgeable, and sometimes lucky selection of points of focus that yield the best results. In other cases, it is the act of watching that produces results, as will be discussed later.
Surveillance operations can be broken down into a matrix of sorts with the headers being covert and overt on one side, and personal and electronic on the cross-referenced edge.
As such, it is only appropriate that the bulk of this discussion be framed within the four possible combinations of these types:
1. Covert operations are those done in secret without the knowledge of those being observed. Blending with the surroundings is critical to the success of these operations.
2. Overt operations are out in the open, and can usually be easily identified as what they are.
3. Personal operations are those carried out in person by individuals or teams of operatives. Although the initial set-up of such an operation may not be overly expensive, the continued use of manpower quickly increases the amount of required funding and quickly outweighs the cost of electronic alternatives.
4. Electronic operations can range from CCTV systems to transmission interception and receipt of other electronic information. Usually, the operators are well out of sight, even if the equipment is clearly visible.
Covert Personal Surveillance
The act of watching another from a location of concealment, or in a manner in which this act is not obviously being carried out.
Surveillance is investigators’ main focus when dealing with cases, such as marital strife, insurance fraud, and even in law enforcement investigations.
Even though this is personal rather than electronic, it should be noted simply that some electronics are usually involved, but they are often limited to a camera, a voice recorder for the retention of comments on their observations, and similar low-end electronics.
The biggest advantage of this method is that it leaves room for the human factor in decision making as the situation evolves. By being on the scene, the operative(s) can determine how to refocus the operation to obtain better results.
The major drawback is that it is extremely manpower intensive.
To not attract too much attention, it is best to randomly change operatives s that the same person is not in the area for an extended period of time, which would be conspicuous and draw potential interest.
When performing vehicle surveillance, this is even more of an issue, as specific vehicles can be easily recognized if they are continuously passing into and out of view.
These operations can yield interesting results stemming from the fact that, when properly executed, those observed are not aware that others are paying attention to them.
Overt Personal Surveillance
This type of operation ranges widely in its application.
Most people in the field of protection engage in this type of operation on regular basis without realizing that it falls within this type of category.
It is the execution of visible and open inspection, such as when on patrol.
The act of gathering information is shared in importance with the deterrent value of such an operation.
The person executing these duties may be looking for specific types of incidents or situations.
Through their presence, and the fact that they are paying attention to their surroundings, individuals in the area may reconsider intentions of violating company policy or legal restrictions.
The performance of this type of operation is most likely to alter the behaviors and responses of persons in the observed environment since there is clearly a person paying attention to those present.
Covert Electronic Surveillance
The use of hidden cameras, voice and electronic recording equipment, and similar devices falls within this category.
Some equipment options might include: pinhole cameras; cameras concealed in sprinkler heads, clocks, books and other non-descript items; scanners, tuned to permissible frequencies; and even long-range audio amplifiers as permitted. The equipment selection, given the right budget, can look very much like the something out of a movie spy.
The actual selection is often limited only by the budget of the operation. Much like personal covert operations, this method often yields very interesting results.
If properly executed, those being watched are not aware that they are being observed. As a result, they will act in a manner that is completely natural to them in the given environment.
Overt Electronic Surveillance
The classic examples would be the pan/tilt/zoom camera domes found in most department stores. These provide a significant amount of information to a trained operator, but also a very visible deterrent to certain types of crime.
Often, if the recordings of such a system are replayed, people can be seen behaving in one manner, then looking up to find that a camera is in the area and immediately altering the previous behavior to bring it more in line with the expectations of that environment.
It is not that the devices themselves have any potential to bring harm to the individual. It is the concept that, absent of a clear view of the system operator, there is no way to know if the camera is being paid attention to at that moment.
It is the fear of possibly being observed that provides the deterrent factor in this case.
It is because of this that CCTV systems in such setting as industrial locations and employee-only areas of businesses should be placed in such a manner as to make it plainly obvious that CCTV is in use, but without providing a view of the monitors themselves.
Those in the area should know that observation occurs, but not be able to determine which area at any given time is being observed.
As previously stated, the equipment may range widely. In the case of personal surveillance, either covert or overt, it may be as simple as binoculars, a camera, a mini-recorder, and a note pad.
The initial outlay might be as low as a few hundred dollars, and the equipment retained over a period of many operations.
In electronic operations, the initial outlay may be thousands, or tens or hundreds of thousands, of dollars. This is based upon the scope and sophistication of the intended operation.
For example, moderate grade pan/tilt/zoom camera operations require not only the camera dome itself, but also a Control Unit, video cabling, power sources and cable, and a method of recording the input.
A single P/T/Z camera, in a stand-alone system, could be thousands of dollars and would still have to be manned at least occasionally.
The equipment must be appropriate to the nature and scope of the operation if it is to be of optimal effectiveness. Experience and common sense will dictate the exact requirements.
Regardless of the nature and method of the operation, the underlying goal of obtaining information must also be addressed in the equipment.
If this information is to be used in a truly effective manner, it must be recorded in some way. Certainly, in cases of criminal and civil actions, the best possible method of recording the information should be sought.
To appear in court without physical evidence, which could be inspected and reviewed, would be of almost no use at all.
In many cases, simple still photographs can make a significant impact. If videotape can be made through camcorders or more complex systems, this often makes cases, such as insurance fraud.
Kidnapping and assassinations by terrorist or criminal organizations are almost always preceded by an intense period of surveillance.
Fortunately, the site of the incident can be predicted with a reasonable degree of accuracy.
Presenting such incidents is obviously the prime objective and detecting surveillance gives the victim the best opportunity to erupt the attack cycle.
Historically, the surveillance phase of the attack has been the weakest link in the chain. It makes good sense then to attempt to break the chain at its weakest and earliest phase.
There are two reasons for the weakness of the surveillance phase.
1. First, the initial surveillance is usually poorly done, due to lack of training, poor discipline or both.
2. The second reason is that the surveillance goes on for a period of time, thereby proving many opportunities to spot poor surveillance.
Even if a well-trained team is used, surveillance must still be carried out for a period of time.
Based on case studies, we know that an attack is not a single event, but rather a multi-step process:
1. A preliminary list of potential targets is drawn up.
2. Initial surveillance is conducted.
3. The list is finalized.
4. The attack is planned; involving additional surveillance.
5. The attack team deploys on the day of the incident.
6. The victim arrives.
7. The actual execution phase takes place.
The surveillance of those on the preliminary list may continue for a few weeks or a few months.
Usually based on the results of this effort the group decides which person will be attacked.
Next, a new period of pre-attack surveillance is initialed
These persons are almost always closely tied to the organization and may have better surveillance skills than the first group. This final surveillance is done more quickly and is for attack planning purposes.
Detecting this surveillance may require building a surveillance detection route (SDR).
The last few steps of the attack cycle are much more definite and shorter in duration than the first four and, depending on the type of attack, there may not be any further visible signs for the victim to notice after surveillance is completed.
This is certainly the situation with remote-controlled or standoff attacks.
Historically, an attack once initiated, has over a 90% chance of success.
Failed attacks can usually be traced to weapons malfunctions, poor aim or timing errors rather than on any positive action by the victim.
Control and distraction lead to total surprise, which is the attacker’s best weapon. The best chance for survival is to detect surveillance and respond properly.
To detect surveillance, you should look for three basic things:
1. The first is location . Where would you position yourself to watch your residence? If you are targeted, you can almost always count on your residence being watched. There may be many people in the right location to watch your residence. In fact, 90% of your suspect sightings will be in this category.
2. This sets the stage for the second point: correlation. The most common mistake made by a poor surveillance team is some sort of correlation with the target. People that have been seen more than one time are observed leaving the area immediately after the target departs the area. This detection can quite often be done from within the residence by other family members. About eight percent of your suspect sightings will be in the correlation category.
3. The last is an obvious mistake. This accounts for the remaining two percent . You will note; however, the correlation is the central theme.
A list of common mistakes made by surveillance teams:
> Vehicles parked in prohibited zones.
> Vehicles parked in the same spot for an extended time, with possible surveillance sitting in the front seat.
> Vehicles that stop or start as the target moves.
> Vehicles that pass the target and park.
> Vehicles driving too fast or too slow, making erratic moves, or abrupt stops.
> Any vehicle that goes through and intersection slowly, rounds a corner slowly, or pokes its nose around a corner and then withdraws.
> Vehicles that signal a turn and fail to execute the turn.
> Vehicles that follow the target through a red light.
> Flashing lights between vehicles.
> Any vehicle that maintains the same distance from the target even at varying speeds.
> Vehicles that slow and duck behind other vehicles when the target slows.
> Vehicles moving on parallel streets at roughly the same speed as the target.
> Vehicles apparently hiding behind traffic (pulling out as if to pass, then dropping back).
Vehicles pausing in a traffic circle until the target has taken an exit.
> Vehicles closing on the target in heavy traffic and dropping back in light traffic.
> Vehicles stopping nearby when the target stops briefly.
> Persons dismounting from vehicles when the target stops.
> Persons turning away when being observed.
> Anyone running.
> Persons hesitating or looking around when entering a building that the target has just entered.
> Persons leaving or entering a building immediately before or after the target.
> Persons who begin to move or stop as the target does.
> Persons standing on the street or in lobbies, reading newspapers or magazines.
> Broken down vehicles.
> Vehicles parking, but no one getting out.
> Unprofessional shift changes, especially near the residence (one vehicle arriving, another leaving, possible communication between drivers).
> Any vehicle with an altered or obstructed license plate in or near a choke point.
> Improper dress or action for the area. Surveillance Detection Principals
Become a trained discreet observer and reporter
NEED TO KNOW:
– Where to Look
– When to Look
– How to Look
– What to Look For
Surveillance Pattern Identification
– Observe Activities Over a Period of Time
– Gather Information on Target’s Habits
– Documentation / Proof
– Types of Surveillance used will depend on:
– Awareness of Target
– Security around Target
– Locations of Target
– Capability of Adversaries Axioms
– Adversaries use surveillance in all hostile operations
– Adversaries find our vulnerabilities:
– Lack of security and security awareness
– Patterns and predictable routines
– Adversaries select their means of attack to exploit our vulnerabilities
– Effective Surveillance Detection
is a powerful weapon against terrorists.
The Threat is Real… It is International … It is Now
How Adversaries Select Targets / Victims
– Regular Routes
– Regular Times
– Same Type of Transportation
– Lack of Security
– Easy to Identify
– By Vehicle
– On Foot
> Attack will make a Statement
> Building Design
> Proximity to Uncontrolled Areas
> Portals (Vehicular & Pedestrian)
> Barriers (Including Standoff–Lack of)
> Access by unauthorized Personnel
> Service Access Areas of Concern Facilities
– Recreational Sites/Events
– Regular Routes
– Periodic Routes with Excellent Attack Sites
– Routes Known in Advance
– Visiting Dignitaries
– Special Events/Ceremonies
– Special Routing Due to Road Construction, etc. Adversary Surveillance:
The Critical Activity in Planning an Attack
Adversaries will Conduct Surveillance to Gather Information…
a target; identify
vulnerabilities; and choose
the time, place and means of attack·
Element of Surprise
– Sudden, Speed, Overwhelm Facility’s Personnel
– Morning – People Generally Less Aware
– Workplace or Home, or Regular Home-to-Work Routes
– Weekends / Holidays / Recreational Periods
– Regular or Well-Known Locations/Activities, or Regular Routes to/from them Cover/Concealment
– Clear View of the Target
– Fit the Environment
– Bus Stops
– Vacant Buildings
– Observation Posts (Height)
– Cover Entrances/Exits to Keep People Inside
– Single Lane Bridges
– One Way Streets
– Crowded Streets with Cars Parked on Both Sides
– Narrow Alleys
– Controlled Intersections/Traffic Circles
– Traffic Lights with Heavy Pedestrian Crossing Traffic
– Avenues of Escape
– Vehicles to Major Roads Out of the Area
– Pedestrians to Crowded Streets, Stores, Safe houses
Choke Points- Selection –
Definition: Any Area the Target MUST Travel
*Home–Driveway / Garage Entrance
*Alley / Narrow Street
*Rail Road Crossing
– Choke Points May or May Not Make Good Attack Sites, Depending on:
– Ease of Access
– Ability to Control the Target
Think Like the Enemy!!
Methods of P.O.I. Gathering
P.O.I = Pre-Operation Intelligence Open sources –
publicity, media coverage, internet.
– building an innocent cover story in order to receive information – imposing as a relevant businessman, government employee, etc. – the approach
might be by phone, letter, fax, meeting in the protected object’s facilities, invitation for a meeting at another site.
Collection of non destroyed documents
– from garbage, etc.
Intrusion to Data Systems & Banks
– intrusion through communication networks, end units and computer systems to data bases to obtain, change or destroy information.
Eavesdropping and “bugging”
– obtaining information transferred in conversation, telephone or fax by installing electronic devices to communication lines or in places.
Surveillance and Observation
– monitoring and studying the target’s activity by following and watching his activities, either in stationary activity or in motion.
MAJOR GOAL TO INCREASE EMPLOYMENT OPPORTUNITIES FOR SECURITY PRACTITIONERS WORLDWIDE, WHO ARE ACTIVE IN THE DOMAIN’S SECTOR Recruitment of source
· Gathering information from people who are close to the object by establishing contact with an employee/assistant/family member and receiving the information from him either by “innocent” interviewing or by payment.
Insertion of informers
–Insertion of an informant who is recruited to work as an employee for the protected object to get the desired information.
–Breaking and Entry to the facility to gather information or to install information gathering equipment.
-Entry to the facility by imposing as authorized personnel to gather information or to install information gathering equipment. Review Questions: Check Your Understanding
1.What is NOT a common mistake made by surveillance teams?
a. Vehicles parked in prohibited zones.
b. Vehicles pausing in a traffic circle
c. People turn away when observed
d. Vehicles blasting music
2.Which is NOT a method of POI gathering?
c. Open Source
d. Intrusion to Databases ISA-ISRAEL CHANNEL AT YOUR DISPOSAL !!! https://www.youtube.com/c/securityacademy/featured
_________ Surveillance and Pre-Attack Indicators Content Indicators of Surveillance Activity What Surveillants Fear Surveillance Pattern Identification Surveillance Indicators Possible Surveillance Indicators (Mobile) What to Look for in Vehicles Possible Surveillance Indicators (Combination) Possible Surveillance Indicators (Fixed) Pre-Attack Indicators How Surveillants Behave What to Look For What to Look for in People Make no Assumptions Sixth Sense Concerns Indicators of Surveillance Activity What are Surveillants Afraid of? Detection! Surveillance Pattern Identification
• Observe activities over a period of time
• Gather information on target’s habits
• Documentation / proof Types of surveillance used will depend on:
• Awareness of target
• Security around target
• Locations of target
• Capability of adversaries Surveillance Indicators
• Indicators are actions or characteristics that trigger our suspicions.
• The absence
of expected actions or characteristics should also trigger our suspicions. These, too, are indicators.
• People usually behave naturally
and according to expectations. When they do not
, they merit further consideration, observation, and study. Possible Surveillance Indicators (Mobile)
• Repeated presence
• Pausing at key vantage points
• Maintaining same distance at varying speeds
• Ducking behind others vehicles to hide
• Altered license plates
• Too fast, too slow
• Target fixation
• Turning away when observed What to Look for In Vehicles
· Repeated Sightings – Separated by time and/or location
· Correlating Activities
· Start/Stop/Same Route
· Alerting Behavior/Demeanor
· Parked in Key Locations
· Target Fixation
· Absence of Conversation
· Absence of Activity
· Unusual Activity
· Erratic/Hesitant Driving
· Making Notes (Recording Events/Times)
· Photographing Possible Surveillance Indicators (Combination)
· Signaling, telephoning
· Selection of parking spots that cover all directions
· Work crews out of place/time
· Surrounding area not working
· Improper dress/tools
· Correlating activity Possible Surveillance Indicators (Fixed)
· Spending extensive time in one location
· Loitering/Continued presence at a good vantage point
· Photographing key personnel, facilities, or locations in background
· Using windows and mirrors
· Unusual mannerisms
· Nervous behavior
· Inappropriate repetitive actions
· Avoiding eye contact
· Constantly shifting body positions
· Note taking
· Target fixation
…the fear is detection!
· An act or characteristic outside normal expectations
· Parked cars
· Continually occupied – same spot for long periods
· Flashing lights between vehicles
· Obstructed/missing license plates
· Hiding behind other vehicles
· Parked in a “No Parking” Zone
· Changing fixed positions with same vehicle
· Out of place with surroundings
· Dress, demeanor, activity
· Target Fixation Pre-Attack Indicators
It isn’t enough to be able to recognize pre-attack behavior when observing a single, isolated target. We must be able to observe and identify such indicators in a crowd of thousands. It necessitates a basic understanding of how the body functions and the peripheral indicators caused by those functions. The following is a basic overview of pre-attack indicators.
: In response to acute stress, the body’s sympathetic nervous system is triggered due to the sudden release of hormones, often referred to as the ‘fight or flight’ response. The sympathetic nervous system stimulates the adrenal glands releasing catecholamine, which include adrenaline and noradrenaline. These catecholamine hormones facilitate immediate physical reactions by triggering increases in heart rate and breathing, constricting blood vessels and tightening muscles. The involuntary and non-behavioral outward manifestations of this response include:
· Profuse sweating
· Rapid, shallow breathing
· Dilation of the pupils,
· Flared nostrils
· Trembling of the hands or knees
In addition to the aforementioned physical reactions, there are more observable indicators individuals employ when they are demonstrating pre-attack behavior. The following are known as Behavioral Indicators
Avoiding Eye Contact
: When under stress, it is difficult to multi-task. When a person is trying to process a situation under stress, avoiding eye contact better enables them to focus on their own agenda.
Fist Clenching or Pumping:
Under acute stress, the body withdraws blood from its extremities to better support the large muscle groups and major organs. In response to the vasoconstriction of the hands and fingers, it is natural to pump or clench them.
Posturing indicates a display of dominance and possibly a threat of attack. Puffing up the chest to make one appear larger, lowering the head as if ready to charge and muscle clenching, causing the jaw muscle to bulge, fists to close and facial muscles to contract, are all indicators of a potential attack.
Bobbing and/or Rocking:
The combination of adrenaline and oxygen being pumped into the body from an acute stress response causes the body to display abnormal movements. Bouncing up and down, rocking back and forth, shifting weight, pacing and other signs of agitation provide a release of excess oxygen and may indicate a subconscious preparation for action.
Hiding the Face:
Someone on the verge of a pending attack my attempt to conceal their stress, intention or even excitement by turning or bowing their head to hide their face, or by subconsciously placing their hands in front of their face.
Fixation on a specific target, or even a specific area of a target, reveals an adversary’s focused and undivided attention, indicating they have identified their target and are fixated on an attack.
The ‘thousand-yard stare’, or ‘death stare’, can be recognized by an adversary’s blank, unfocused gaze, failure to engage and appearance of looking right through you. The thousand-yard stare often indicates that the adversary’s mind is absent from reality, and monopolized with the impending attack.
Paranoid and aggressive scanning of an area may be an indicator that a subject is about to attack. Those participating in a lone or coordinated attack often reveal themselves by noticeably scanning an area for their companions, law enforcement, potential targets, witnesses and escape routes. Coupled with nervousness and time keeping, scanning is a strong pre-attack indicator.
Verbal threats are a clear indicator of an individual’s state of mind and of his intentions. Though obvious, an overt threat is a pre-indicator of an attack that should not be underestimated.
Target glancing is a common term used to describe the preoccupation a subject has with his target, or a specific aspect of his target. Commonly, target glances include a subject making obvious and continuous glances at his target’s face, or more specifically his chin, nose, or throat, or other body part that he is specifically targeting. If his target is armed, the adversary may make specific target glances at his targets weapon, indicating it is of concern or of specific interest to him. Target glancing generally indicates that adversary is evaluating with an interest for an attack.
Blading occurs when an adversary places his strong foot slightly behind him, rotating his body to an approximate 45 degree and reducing his physical profile. Blading is often done subconsciously, and a clear indicator that an adversary is settling into a fighting position.
Tactical Maneuvering / Flanking:
Tactical maneuvering and flanking are terms used to describe the actions of potential attackers to convene, stage, position or re-position to a more advantageous location. As a pre-attack indicator, tactical maneuvering can be observed by both monitoring suspicious individuals and/or specific locations that have a distinct advantage. Hesitation in Response:
Divided attention is a possible indicator of a potential attack. The more stress an individual is under, the more difficult it is for that person to multi-task and has a presence of mind. A protracted response from a subject may indicate that his mind is engaged with internal thoughts and otherwise engaged.
Non-compliance is often an indicator that an individual is stalling for time in attempt to formulate an attack plan or an escape strategy, is seeking an opportune time to attack or struggling with indecision about an impending attack.
Readying for Action:
The changing, or removing, of clothing, jewelry, backpacks, etc. may indicate that an individual is readying himself for an attack. The totality of circumstances plays an important role in using this as a pre-attack indicator. From what and to what the individual is changing will aid in identifying the individual’s intent, as will where the individual is changing and if it is being done with an abnormal sense of urgency or anxiety.
Gestures, hand or other signals, code words and a common foreign language among a group of suspicious subjects may indicate a potential coordinated attack, particularly if the individuals appear to be together but are physically distant from one another.
Altered Mental State:
Individuals with an altered mental state due to a history of mental illness or the effects of alcohol or drugs, can be have symptoms including confusion; amnesia; loss of orientation; loss of alertness; poor judgment; abnormal behavior; poor regulation of emotions; and disruptions in perception, psychomotor skills, and behavior. Individuals with an altered mental state may or may not exhibit traditional pre-attack indicators, but may act impetuously and without regard to the consequences.
Violent Past / Views:
Individuals with a violent past may be considered a potential threat, as should those expressing violent views. Extremists, gang members and others often advertise their past and present violent tendencies or affiliations through tattoos, insignia, clothing and general behavior. Conclusion
Identifying pre-attack indicators necessitates an understanding of the basics and an unparalleled discipline. Practice observation, question people’s actions and intentions and, when on detail, make the search for these indicators relentless.
How Surveillants Behave Awkward attempts to act legitimate:
• Nervous pacing
• Extensive time at bus stops, telephone booths, cafés
• Reading but not turning pages
• Standing around broken-down vehicles Unusual behavior:
• Repeated presence
• Obviously avoiding eye-contacт
• Turning away when observed
• Hesitant movements
• Staring and target fixation
• Repeatedly checking watch
• Taking notes • Photographing What to Look For
• Repeated Sightings
• Correlating Activities
• Alerting Behavior / Demeanor What to Look for in People Repeated Sightings
• Separated by time and/or location
• Start/Stop/Same Route
• Lingering Without Action
• Nervous, Suspicious
• Avoiding Eye Contact
• Out of Place
• Target Fixation
• Unusual Activity
• Recording Events/Times
• Photographing Make No Assumptions Do Not Ignore
• ELDERLY PEOPLE
• People Walking Dogs
• Taxi Drivers
• Delivery Persons
• Street Sweepers
• Shop Operators/Vendors
• Mentally Unstable Sixth Sense
• Develop your sixth sense to identify
, and a mental checklist to question
• Why is that person, vehicle, or equipment there?
• Why are they doing what they are doing?
• Is that activity logical?
Trust your instincts
Indicators help identify suspected hostile surveillance.
Concerns Origins and Destinations:
• Consulate / Other Official Facilities
• Recreational Sites
• Airports / Hotels Routes:
• Residences to Consulate
• Airport to Hotel
• Mail / Supply / Warehouse
• Trips to Host Offices
• Changes due to Road Work, Construction, etc. Review Questions: Check Your Understanding
1.What is NOT a possible mobile surveillance indicator?
a. Varying speeds.
b. Repeated presence
c. Maintaining a consistent distance
d. Stopping at a stop sign
2.Which is NOT an alerting behavior noticed in people?
c. Avoiding eye contact
d. Photographing ISA-ISRAEL CHANNEL AT YOUR DISPOSAL !!! https://www.youtube.com/c/securityacademy/featured ___________________________ Surveillance Counter Measures Content Counter Surveillance Counter Surveillance Tactics Summary Pre- Incident Indicators to a Terrorist Attack Course Objectives Normal Activity Identifying Activity Types Suspicious Activity, Actions and Behavior Individual Behaviors Apparel and Accessories Body Language Behavior in Crowds Reactions to police or Uniformed Personnel Personal Interactions Suspicious Vehicle Characteristics Recognizing Suspicious Activity / Assessing Activity / Reacting to Activity Notification Dangerous Activity / Reacting to Dangerous Activity What Else Can You Do? Al Qaeda Espionage Manual
i. Detecting Surveillance ii. Gathering Information iii. Surveillance on Foot and by Car iv. The Drawing of the Target v. Target Information vi. Ideal Motives for Recruiting Informants
____________________________ Counter – Surveillance
• The practice of trying to determine who may be watching or stalking the VIP and/or his security operation.
• In essence, it is the practice of following the followers. This is especially important in cases where individuals are following the VIP in an attempt to gain intelligence they feel they need in order to conduct an assassination attempt.
• Judgment calls often have to be made about whether to stop and challenge these individuals or to continue to follow them in order to gain information on co-conspirators and their further plans
• Basic surveillance techniques.
• Anti – Surveillance techniques.
• Action can be taken to counter unwanted surveillance.
• Various technical aids that may be deployed by people or groups to assist in surveillance. Counter- Surveillance Tactics
• Preventing in advance.
• Take alternative routes.
• Change timetable.
• Change cars.
• Use camouflage exits.
• Look for the “TRIGGER”
• What is different in the environment?
• Is it the daily routine?
• Use different exits.
• Driving at night (in rural areas any surveillance car will be spotted).
• Is the activity in the area normal activity? Tactics on foot and mobile to lose “TAILS”:
• Don’t panic.
• Act naturally.
• Park on the roadside and walk away from your vehicle out of sight.
• Consider doing a “u” turn and driving away to arouse suspicion. Doing this may force hostile surveillance into “showing” themselves.
• Act unexpected, change often, let them observe that they were exposed.
• Change your routine or schedule.
• On-foot surveillance, if there is a sudden change in direction (e.g. “ABOUT FACE”) look for an unreasonable response. Summary
> Area Study
> Target Selection, Pattern Analysis and Vulnerability Assessment
> Operational Planning
> Execution and Escape
> Exploitation Pre-Incident Indicators to Terrorist Attacks Objectives
> Provide a brief overview of Terrorism
> Define pre-attack terrorist activity
> Identify the 3 Indicator types:
> Normal Activity
> Suspicious Activity
> Dangerous Activity Normal Activity
> Individual behaviors and activities that are routinely observed in your work environment
> Variety of people who use your system/facility
> Range of appearances and behaviors
> Normal traffic patterns
> Events / situations Identifying Activity Types
> Suspicious activity is a combination
of actions and behaviors that are inconsistent or out-of-the-ordinary for the environment
Dangerous activity is any specific situation involving physical or verbal threats, visible weapons or devices, or apparent suicide attack behavior Suspicious Activity A combination of actions and behaviors that appear strange, inconsistent, or out-of- the ordinary for your work environment
• Individual behaviors
• Personal interactions and dynamics
• Vehicle characteristics Suspicious Actions
> Gathering intelligence
> Obtaining security sensitive Information
> Conducting surveillance
> Running security tests
> Attempting infiltration
> Conducting a “dry run”
> Deploying assets Suspicious Behavior Focus on behavior
Suspicion should be based upon:
• Where someone is
• When he or she is there
• What he or she is doing
Suspicion is NOT
• Color, ethnicity, nationality, or religion Individual Behaviors
> How a person is acting or behaving in the environment
> Behavior may be the manifestation of suspicious intent or activity
> Observation should focus on a combination of factors, not ONE
specific behavior Apparel and Accessories A person may be suspicious if he/she:
• Wears attire inconsistent with weather conditions
• Is holding unusual packages or baggage
• Carries security sensitive information or material
• Appears to be wearing a disguise Body Language
A person’s body language may be suspicious if:
> Attempts to conceal his/her face by turning away when someone approaches
> Hides in shadows or behind objects to keep from being clearly seen
> Avoids eye contact or departs quickly when seen Behavior in Crowds
A person’s behavior in a crowd may be suspicious if:
> Acts in a disorderly manner
> Remains extremely private and does not interact with those around him/her
> Tries hard not to be impolite and risk calling attention to him/herself Reactions to Police or Uniformed Personnel
A person’s reactions to police or uniformed personnel may be suspicious if he/she:
• Avoids areas where police are present
• Avoids eye contact with uniformed employees
• Does not respond to authoritative voice commands Personal Interactions People’s interactions may be suspicious if they:
> Meet at unusual hours
> Try not to be noticed
> Have similar bags or packages Suspicious Vehicle Characteristics Vehicles may be suspicious if they:
• Contain unusual equipment
• Are overloaded and/or have bulging tires or sagging frames
• Appear to have altered or makeshift company insignia or license plates Recognizing Suspicious Activity
> Use your knowledge of what is normal in the workplace to recognize suspicious activity
> Never use ethnicity, nationality, or religion to decide if a person is suspicious
> Be aware that, in most cases, suspicious activity is defined by a combination of behaviors/actions Assessing Activity What about the person or the activity strikes you as suspicious?
• What is the person doing?
• Where is the person?
• When is he or she there? Engaging Suspicious Persons Reacting to Activity When you observe potentially suspicious activity…
> Keep your interaction brief
> Approach and engage the person to resolve or confirm your suspicion
> Be sure that you are NOT giving the person the impression that you are detaining him/her in any way – he/she should always feel free to leave Notification
Make notification if there is no explanation for his/her presence or activity
· Try to keep the person in sight at all times
· Check the area where he/she was seen for signs of tampering
· Look for suspicious packages or devices Dangerous Activity A situation where you, your co-workers, customers, organizational assets, or critical infrastructure may be in imminent danger of being injured or damaged:
• Armed threat/attack
• Hostage taking
• Suicide bombing
• Explosive attack
• Weapon of Mass Destruction attack Reacting to Dangerous Activity
> Recognizing dangerous activity can require split-second decision making
> Always err on the side of safety
> Protecting yourself and others is ALWAYS the top priority What Else Can You Do? As an Employee…
> Create a defensive network of observant personnel
> Help harden your organization as a target
> Become a physical symbol of diligence Al Qaeda Espionage Manual Espionage = Information gathered through covert means
> Residence, workplace, times of leaving and returning, family members and places visited.
> Strategic buildings, important establishments and institutions, embassies and security operations within these facilities. Detecting Surveillance
> Walk down a dead-end street and observe who is following.
> Casually drop something out of your pocket to see who will pick it up.
> Walk fast and stop suddenly to see who notices.
> Stop in front of a store window and observe who is watching.
> Get on a bus and get off after it departs to see who reacts.
> Agree with one of your Brothers to look for whoever is watching you (countering Surveillance Detection). Gathering Information >Avoid anything that reveals your identity
> Do not attempt to be too creative or inventive
> Do not appear to be too anxious
> Move slowly and travel far
> Do not be conspicuous >Be aware of quick or casual friendships
> Study the area where information gathering takes place
> Do not speak vaguely or act mysteriously
> Do not accept events on face value
> Find a cover prior to gathering the information Surveillance on Foot
>Carefully study the area where observation will take place
>Agree on means of communication with leaders should you be discovered
> Agree on special signals to exchange orders between team members
> Cameras are recommended for collecting information Surveillance by Car
> The car should be a common type so it will not attract attention
> The car plates should not contain real numbers
> The car’s interior lights should be disabled for better cover The Drawing of the Target
> The Brother should draw a diagram of the area, the streets, location of the target and places where information can be gathered
> Shape and characteristics
> Direction of traffic
> Police/ Security Postings
> Security Centers
> Amount and Location of lighting Target Information
> Transport to it
> Weapons used
> Fortifications and tunnels
> Security Posts
> Number and rank of officers
> Location of ammunition depots
> Types of vehicles entering
> Leave/ vacation policy >Degree and speed of mobilization
> The brother gathering information may start a friendship with one of the officers at the target site, collecting information gradually and easily Ideal Motives for Recruiting Informants
> Greed and love for money
> Mental and political orientation
> Fear of being harmed or exposed (blackmail)
> Coercion and entanglement Review Questions: Check Your Understanding
1. What is NOT suspicious body language?
a. Draws attention to himself.
b. Attempts to conceal his/her face by turning away when someone
c. Avoids eye contact or departs quickly when seen
d. Hides in shadows or behind objects to keep from being clearly seen
2. Which is NOT an ideal motive for recruiting informants?
d. Food ___________________________ ISA-ISRAEL CHANNEL AT YOUR DISPOSAL !!! https://www.youtube.com/c/securityacademy/featured