Warning Signs of Terrorism

 Stay Alert – Report Suspicious Action



Terrorists may observe a chosen target during the planning phase of an operation to determine the strengths, weaknesses and number of emergency personnel that might respond to an incident. Suspicious actions during this phase may include:

  • Recording or monitoring activities (mobile or fixed target).
  • Photography of targets, creation of maps and diagrams.
  • Attempts to obtain blue-prints of government buildings and utility facilities.
  • Using Binoculars or Night Vision Devices.
  • Vehicles appearing repeatedly without an obvious purpose (i.e., repair vans that do not repair anything).


Targets could include financial institutions, government or military facilities, shopping malls, or critical infrastructure – power plants, ports, and bridges.


Asking Suspicious Questions (Elicitation)

Terrorists gather information by requesting information about a place, person, or operation pertaining to the target. . Elicitation attempts may be made by mail, email, telephone, or in person. Do NOT give out sensitive information unless you know the party you are talking to and they have a need for that information

Suspicious Questions include:

  • A telephone request at work asking about the security system.
  • Questions about the habits of your company’s executives, employees, visitors.
  • A mail survey asking for comments on the habits of personnel.
  • Attempts to place “key” people in sensitive work areas.


Tests of Security

Terrorists may also test a target’s security to gather data. This can include:

  • Driving into prohibited zones or attempts to enter doors that should be secured just to see how well security procedures are enforced or to gauge response time.
  • Attempts to gain legitimate employment to observe goings on at target.
  • Unexplained break-ins and tampering of security systems.


Acquiring Supplies

  • Terrorists may steal identification badges, vests, or uniforms to gain admission to restricted areas.
  • Terrorists may purchase or steal explosives, weapons, ammunition, or attempt to store large quantities of harmful chemicals.
  • Terrorists may try to obtain flight passes, flight manuals, passports or other pieces of identification.


Suspicious/Out-Of-Place Behavior

Profiling individuals is wrong, however, profiling behaviors may indicate suspicious behavior. Focus on:

  • Behaviors that just don’t seem to fit within the “norm”.
  • Persons in the workplace or neighborhood who don’t fit because of demeanor, self-imposed seclusion, or anti-social behavior.
  • Presence of training manuals and anti-U.S. propaganda literature



Before executing the final operation or plan, terrorists may engage in a practice session, or “dry run,” to work out flaws or unanticipated problems. This may include:

  • Mapping out routes.
  • Monitoring of police frequencies.
  • Determining timing of traffic lights.
  • Measuring emergency response times by police and fire fighters.


Deploying Assets/Getting Into Position

The deployment assets, or getting into position stage, is an individual’s last chance to alert authorities before the terrorist act occurs. The following types of activity could be indicators of impending terrorist activity:

  • Parking in a restricted zone and exiting the area on foot.
  • Unloading boxes from a van and leaving them.
  • Leaving a suit case, purse, or bag in a public building and rapidly exiting the area.



In order to fund an attack, terrorists will seek financial resources. Suspicious transactions involving large cash payments, deposits or withdrawals are common signs of terrorist funding. Other scenarios to look for include:

  • Credit card fraud.
  • Defrauding the elderly.
  • People asking for donations to legitimate organizations but in peculiar ways.