q Reports of logistical activities (thefts, purchases, ü Training data for members

discoveries of): ü Other Linked Data Sources

ü Arms ü Regional and National Alerts and status

Terrorist
ü Explosives
ü Vehicles Collection patterns
ü Safehouses
q Car stops/FI/subject ID checks:
ü Radios
ü Check for multiple sets of ID/ check passport name,
ü Passports
spelling, evidence of pages being removed
ü Medicine
ü Look for forgeries or copies with different physical
ü Storage facilities appearances, identities
q Reports of training activities: ü Examine vehicle for training manuals, radical
ü Military maneuvers literature, GPS units, maps, hotel receipts, photos
ü
ü
Unconventional warfare
Explosives/demolition
ü Any cameras? What type? What is on them, any
videotape? Content?
Pre-Incident Indicators
ü Where has the subject been, outside the USA? Any
ü Weapons (shooting/tactics)
target countries or identified group locations? (i.e.
ü Self-defense Hamburg, Canada, Belgium, Spain, Italy, Germany,
ü Technical (commo/operations) Algeria, Pakistan, Afghanistan, Indonesia, Malaysia,
Philippines, Yemen, Somalia)
ü Political
ü Airline tickets with multiple stops, unusual routes
q Intelligence collection
ü Who else is in the vehicle?
ü Surveillance
ü Feints/ trial runs/ analogous acts q Residence/subject checks
ü Maps/ diagrams/ photos found ü What is inside of the residence?
q Reports of Threat activities: ü Identify any associates that also live there or associate
with the principal
ü Anonymous death threats
ü Radical literature?
ü Threat warnings
ü Training manuals, police manuals, ham operator
ü Assaults guides, scanners?
ü Foreign language documents or CDs from target
Collection Sources areas
ü Reuters® & news-wire services ü Disguises/hair dyes
ü Radical web sites, terrorist, support-group pages ü Travel documents
ü Web Usenet groups and “chat rooms” ü What education or trade schools are evident
ü Radical meetings, rallies, and demonstrations ü Weapons? Type?
ü Flyers, posters, leaflets, graffiti, underground press ü Check for unusual chemicals in or around residence
ü Politicization of social causes, changes in leadership ü Communications equipment, short wave radios
ü Law Enforcement reports ü Check phone bills for overseas phone calls
ü Support group members ü Does the subject use pay phones instead of his
personal phone?
ü College and university campus sites, kiosks
ü Has the subject ever been to a training camp?
Government Message Traffic Traveled to Afghanistan? Somalia? Indonesia?
Malaysia? Philippines? If so identify camp names
ü FBIS- Terror group traffic and locations
ü Current event reporting data ü Any foreign military training? What type?
ü Group threat data ü Is the subject a member of “Takfir wal-Hijra”
(Society of Muslims) or Salafist Group for Call and
ü Name search capability Combat
ü Link Analysis and VIA analysis
ü Related government sites linked
ü Reporting capability
ü Real time traffic monitoring
Introduction PRE-INCIDENT INDICATORS q Reports of stolen items:
ü Firearms
Today’s intelligence professional faces a more violent WILL EXIST IN EVERY TERRORIST ü Explosives/ Chemicals
and sophisticated breed of terrorist, who may be INCIDENT ü Vehicles
operating alone or in concert with narcotics cartels, ü ID documents
insurgent organizations, or state sponsors. · Incidents do not occur in a vacuum. They are q Violence against:
planned, organized, and carried out by
ü Persons
individuals acting alone or in groups. The
Overview nature of the group will determine the nature ü Property
of the incident, its target, the level of force q Discovery of:
The terrorist attack on America of September 11,
used, the number of people involved, and the ü Weapons caches
2001, changed the world, and life, as we know it in
behavior of the perpetrators before, during, ü Explosives caches
the United States. It is more important than ever for and after the operation.
local agencies to be able to detect, interdict and q Open attacks on:
prosecute threats to United States security. The ü Police
PII’s focus on more than just the incident,
threat of terrorism must be addressed locally, at e.g; ü Military
home. Law enforcement agencies at the local, state ü Other symbols of authority
and federal level need new ways to collect, evaluate, q Support groups
q Reports of intelligence activities:
organize, analyze and disseminate information. q Planning
ü Surveillance
q Recruitment
ü Penetrations (break-ins)
Twenty years ago the United States Government q Training
sponsored groundbreaking research into terrorist ü Photography
q Logistics acquisition
groups and their modus operandi. Techniques were q Intelligence collection
ü Recruitment
developed to recognize groups early in their
q Travel and movement
development; to detect and understand Pre-Incident
Specific Conditions that may indicate a potential for terrorist
Indicators that exist in every incident, and to activities in your area: THREAT ASSESSMENT MODEL
develop effective interdiction methods to stop group
activities. q Public demonstrations by support groups GROUP
q Information of new groups forming RELEVANT
DATA
Focusing on the terrorist group has revealed a q Reports of theft or stockpiling weapons or explosives
GROUP
SPECIFIC
ACTIVITY LEVEL
pattern of activity—actions that typically precede q Dissident meetings, rallies, demonstrations
TERRORIST GROUP OPERATING
CHARACTERISTICS
ASSESSMENT

incidents (e.g., evidence of recruitment, training, q Reports of group training (home and overseas)
STRUCTURE
CAPABILITIES TARGET/TIME
logistics, intelligence collection, movement of MOTIVATION
SPECIFIC
q Appearance of anti-government: FORECASTS

personnel, weapons, finance, propaganda, staging, IDEOLOGY

ü Posters/ Leaflets / Graffiti GOALS

etc.). Coupled with knowledge of group ideology and TARGETING
ü Underground press publications, CDs TARGET
stated goals, pre-incident indicators provide insight PROPAGANDA
SPECIFIC
VULNERABILITY
ü Politicization of social, religious causes
into group behavior and plans. They provide a TARGET
ASSESSMENT

framework to monitor and analyze group activities ü Increased recruiting by known groups RELEVANT
DATA

and to assess potential threats against U.S. citizens q Increased unrest at colleges, universities, worksites, places
of worship
and facilities.
q Speeches advocating violence
Advances in information storage, analysis, and q Influx of foreign operatives
dissemination have increased our capabilities to q Threats against:
track, record, analyze and share critical threat data ü Public buildings or utilities
in real time. ü Businesses
ü Personalities
The PII’s in this handout are a sample of indicators
q Agitation/organizing in:
that a terrorist incident may be about to take place.
ü Refugee communities
ü Minority communities
ü Foreign communities
ü Religious communities