' ... being able to distinguish the ordinary from the extraordinary'
Coinciding with concerns among some intelligence services that
suspected Hezbollah "sleeper cells" in Canada have been activated,
Canadian law enforcement authorities increasingly are training for
spotting potentially suspicious activity and behavior that may indicate
terrorists are conducting surveillance or other goings-on in
preparation for targeting a specific structure or location for attack.
Several years ago, Robert David Steele, an outspoken veteran
intelligence officer, told HSToday.us that “50 percent of the ‘dots’
that prevent the next 9/11 will come from bottom-up [local] level
observation” and unconventional intelligence from “private sector
parties.”
Since 9/11, the Department of Homeland Security (DHS) and law
enforcement in the Washington, DC capital region have actively urged
citizens to report “suspicious activity.” Mobile electronic signs
urging people to report suspicious activity are routinely placed at
strategic locations throughout the metro area for periods of time. The
last one of these portable warnings I saw was at the convergence of Key
Bridge and George Washington Memorial Parkway on the Virginia-side of
the Potomac River just across from Georgetown.
Lynda Howes, a civilian member of the emergency event and management
unit of the Calgary (Canada) Police Service, told attendees of the “Tri-lateral Security Conference”
in Calgary last week that law enforcement must learn how terrorists
operating in order to prevent attacks. She said counterterrorism is
only manageable if it is tackled at the grass roots level. She
explained that it’s vital that everyone - including the public, the
police, government and private industry – recognizes the potential
indicators of terrorism and what actions to take if, and when, they are
encountered.
Howes said terrorists must recruit members, research their targets,
procure resources, receive, transfer and conceal money, and provide
transportation and communication.
And "each one of those phases represents an activity” that can be
identified if a person is trained to know what to be on the look-out
for. “Those activities are associated with a behavior. Once we have
that behavior, those are things you and I will be witnessing every
single day and are things we can pick up on as potential indicators.”
In late 2002, The Air Force's Office of Special Investigations
launched “Eagle Eyes,” a program to "deter terrorism by recognizing and
reporting pre-attack activities," according an OSI memo.
"Every terrorist act is preceded by observable planning activities,"
according to the OSI memo. "When troops and citizens know what to look
for and how to report suspicious activity, terrorist acts can be
prevented."
Department of Defense personnel have routinely been advised to
report suspicious reconnoitering of military facilities, people asking
detailed information about specific sites, and any other activity which
could indicate a "dry run” attack.
DHS says “knowing what to look for and being able to distinguish the
ordinary from the extraordinary are the key elements to successful
surveillance detection.”
“A persistent stream of reported suspicious incidents requires an
understanding of the purpose of terrorist surveillance, to know what
terrorists look for, and how they conduct surveillance operations,”
DHS’s advice states.
DHS states “terrorists conduct surveillance to determine a target's
suitability for attack by assessing the capabilities of existing
security and discerning weaknesses in the facility. After identifying
weaknesses, they plan their attack at the point of greatest
vulnerability.”
“Because terrorists must conduct surveillance-often over a period of
weeks, months, or years-detection of their activities is possible,” DHS
continued, noting, “regardless of their level of expertise, terrorists
invariably make mistakes. The emphasis of surveillance detection is to
key in on indicators of terrorist surveillance activities."
DHS states “successful surveillance detection efforts require immediate reporting of incidents similar to the following:
- Multiple sightings of the same suspicious person, vehicle, or activity, separated by time, distance, or direction;
- Individuals who stay at bus or train stops for extended periods while buses and trains come and go;
- Individuals who carry on long conversations on pay or cellular telephones;
- Individuals who order food at a restaurant and leave before the food arrives or who order without eating;
- Joggers who stand and stretch for an inordinate amount of time;
- Individuals sitting in a parked car for an extended period of time;
- Individuals who don't fit into the surrounding environment because they are wearing improper attire for the location or season;
- Individuals
drawing pictures or taking notes in an area not normally of interest to
a tourist or showing unusual interest in or photographing security
cameras, guard locations, or watching security reaction drills and
procedures; and - Individuals who exhibit suspicious behavior,
such as staring or quickly looking away from individuals or vehicles as
they enter or leave facilities or parking areas
Other activity which should cause a heightened sense of suspicion include:
- Suspicious or unusual interest;
- Surveillance (suspicious in nature);
- Inappropriate photographs or videos;
- Note-taking;
- Drawing of diagrams;
- Annotating maps; and
- Using binoculars or night vision devices
“Terrorists may also employ aggressive surveillance techniques, such as
making false phone threats, approaching security checkpoints to ask for
directions, or ‘innocently’ attempting to smuggle nonlethal contraband
through checkpoints,” DHS’s advice states. “The terrorists intend to
determine firsthand the effectiveness of search procedures and to gauge
the alertness and reaction of security personnel.”
Karen Morley, senior director of TerraGo Technologies, Atlanta, Ga.,
who began her career in the geospatial industry in the US Air Force as
a target intelligence specialist, told HSToday.us that terrorists need
to conduct careful surveillance of a potential target in order to be
confident that they can pull off a successful attack.
In 2004, RAND developed the book, “Mapping the Risks: Assessing Homeland Security Implications of Publicly Available Geospatial Information,”
for the National Geospatial-Intelligence Agency, determined that
“potential attackers, such as terrorist groups or hostile governments,
are more likely to [utilize] reliable and timely information … such as
through direct access or observation. In addition, many types of
attacks, such as those by ground parties, are likely to require
detailed information for attack planning purposes (depending on the
target type and mode of attack). This type of information, which mostly
comes from such nongeospatial sources as engineering textbooks or human
expertise on the operations of a particular type of industrial complex,
is essential for attackers to have a high confidence in their plan.”
But according to John Bumgarner, an 18-year veteran of special
operations who has worked with most of the three-letter intelligence
agencies at one time or another and is now research director for
security technology at the US Cyber Consequences Unit, a non-profit
research institute, because of training like that promoted by Howes it
has become more and more difficult for terrorists to physically recon
targets, especially in the US.
“To actually start planning very detailed reconnaissance of a
building, and all the streets that go into it, and all the alleyways
and everything else, that could require a lot of physical
reconnaissance on the ground - it’s not something that you can actually
just easily do anymore,” Bumgarner stressed, especially in the
post-9/11 environment where conspicuous photographing, videoing and
other apparent physical surveillance can, and has - repeatedly across
the nation - caused people to be detained and questioned about their
activities.
“In other words,” said Bumgarner, “it’s gotten a whole lot harder
for a terrorist to conduct the kind of conspicuous physical
surveillance of a target that’s necessary for conducting a large-scale
or mass casualty attack.”
Consequently, more sophisticated terrorists are utilizing easily
accessible geospatial information, which was examined in the April HSToday cover report, “Every Eye a Spy.”
| 
