Suspicious Activity Reporting - A Job for Everyone

by Jerome H. Kahan

Law enforcement personnel operating in their communities have been trained to report suspicious activity sightings to their headquarters. Firefighters, emergency medical service providers, public health officials, and other first responders have been asked to “Remain Alert for Suspicious Activity.” Now, every citizen and visitor plays a critical role in preventing terrorist threats.

Riders of the Metro in Washington, D.C., New York City, and other transit systems across the nation might see signs saying, If You See Something, Say Something™. The Department of Homeland Security (DHS) initiated this program in July 2010 to alert citizens to be on the lookout for indicators that could reasonably be interpreted as steps a terrorist or other violent extremist might take before committing an act of violence, and to be prepared to tell local authorities about these observations via a suspicious activity report (SAR). This campaign targets any person who may happen to see something suspicious in his or her surroundings.

However, the message also warns that, when suspicious activity turns into an emergency, observers (who may remain anonymous if desired) should immediately call 911 to contact the nearest police station, fire, medical, or ambulance service. These situations include times when weapons have been or are about to be used, explosives have been placed in or in front of a building or in a populated area, a suicide bombing is in the making, or a chemical or biological attack seems possible.

Identifying Suspicious Behaviors

The official SAR Functional Standard released in February 2015 contains a detailed list of 16 es of behaviors “reasonably indicative of preoperational planning” by violent extremists for local law enforcement agencies to draw upon in assessing the degree to which such observed activities might warrant action. This list includes breach/attempted intrusion, aviation activity, materials acquisition, and other topics.

With some items similar to those found in the SAR Functional Standard, examples of non-emergency suspicious activities extracted from Tips for Reporting Suspicious Persons, Activities, etc. to Prevent Terrorism include:

  • Intense surveillance and/or photographing of a particular site;

  • Discreet use of cameras or video recorders;

  • Extensive sketching or note taking;

  • Probing of a facility’s public access points;

  • Questioning about a building’s purpose and operations, beyond simple curiosity;

  • Unauthorized attempts to obtain dangerous chemicals or biologic agent;

  • Unusually bulky clothing that may be used to conceal weapons; and

  • Unattended packages or vehicles left near crowded areas or in front of public transportation facilities.

Notwithstanding efforts to provide guidance, certain signs in transit facilities concede, “It can be difficult to know what ‘something suspicious’ looks like. Faced with uncertainly, dutiful citizens have responded to the government’s If You See Something, Say Something™ campaign feeling obliged to report “suspicious activities” even if they doubt that anything is actually wrong. The question here is whether to err on the side of caution or make a report just in case. Perhaps persons in this quandary should heed the saying, “When the hair on the back of your neck stands up, listen to it,” and then contact authorities.

The SAR Process at Work

Any person observing something suspicious can tell a police officer or other uniformed authority, call the local police station, or even contact the Federal Bureau of Investigation (FBI) at one of its local field offices, where an agent will send it to the proper authority. Given that terrorists might target the nation’s critical infrastructure – much of which is privately owned and operated – DHS has developed a special process for these homeland security partners to rapidly alert appropriate local police to suspicious or unusual activities via the Homeland Security Information Network (HSIN).

A fundamental precept of the SAR system is to share such threat-related information among state, local, tribal, and territorial (SLTT) agencies to assist all communities in dealing with violent extremism by discovering patterns of behavior and links among potential perpetrators. For this reason, the Nationwide Suspicious Activity Reporting Initiative (NSI) was developed as a standardized process for gathering, documenting, processing, analyzing, comparing, combining, and sharing suspicious activity reports across a range of participating SLTT law enforcements agencies and also with the FBI and other federal partners. This system might lead to assessments suggesting that a particular person is leaning toward or already undergoing radicalization, intending to join a violent extremist group, or planning to commit a violent act in a community, whereupon a Joint Terrorism Task Force led by an FBI special agent would likely intervene.

The initial step in this process is for the local police station’s senior law enforcement officer to check the information received for completeness, which includes ensuring that each SAR describes in as much detail as possible what was observed, who or what was seen (distinguishing characteristics), where and when the action occurred, and why it seems to be suspicious. When appropriate, the officer in charge puts the data into official SAR format and sends the file to one of the dozens of Fusion Centers for review by a trained intelligence analyst to determine whether it meets the established SAR Functional Standard criteria as indeed having a nexus to violent extremism.

Only SARs that document behavior “reasonably indicative” of preparations for planning acts of violent extremism become part of the official SAR process. SARs that pass the test are entered into the national Information Sharing Environment (ISE), where they become accessible to authorized agencies at all levels of government for further analysis and integration with other intelligence information. A valuable node within the ISE is the FBI’s nationwide eGuardian system, mainly fed by counterterrorism tips and leads, which sends information regarding potential threats or suspicious activities throughout the national law enforcement community. The five key steps in the SAR-NSI-ISE Process are shown in Figure 1., Reports that are not determined to be a threat may either be discarded or retained, perhaps combining new entries with pieces of information on suspicious behaviors already in the ISE to develop a new report for authorities to act upon.

To help citizens and employeesentify particular types of suspicious behavior, the FBI (with assistance from the Justice Department) launched a Communities Against Terrorism program, which consists of a series of 25 pamphlets. Each pamphlet offers general guidelines for spotting suspicious behavior in connection with different “threat areas,” including: airport service providers, financial institutions, shopping malls, storage facilities, and even tattoo shops. Each brochure warns that, “Some of the activities, taken individually, could be innocent and must be examined by law enforcement professionals in a larger context to determine whether there is a basis to investigate.” Finally, these flyers recommend that citizens, “Make note of suspicious statements, people and/or vehicles, and if something seems wrong, notify law enforcement authorities.” No doubt this series can be useful to citizens, workers, private businesses, and others throughout a community.

Law enforcement officials and first responders do their best to remain alert for and report suspicioius activities. However, this is indeed a job for everyone, including an alert citizenry and a vigilant community. Bad guys beware – it may become more difficult to plan and execute destructive actions!

Jerome Kahan is an independent analyst with over 40 years of experience on national and homeland security issues, including senior positions in the Foreign Service, the Brookings Institution, and the Homeland Security Institute. In addition to his publications, he has been an adjunct professor in the graduate school at Georgetown University and a member of the Council on Foreign Relations, with BS and MS degrees from Columbia University.