WEBVTT

1
00:00:00.179 --> 00:00:05.670
Identifying Behaviors and Indicators. How

2
00:00:03.990 --> 00:00:07.919
do you identify behavior that is

3
00:00:05.670 --> 00:00:09.809
reasonably indicative of pre-operational

4
00:00:07.919 --> 00:00:12.690
planning related to terrorism or other

5
00:00:09.809 --> 00:00:15.900
criminal activity? The key to the SAR

6
00:00:12.690 --> 00:00:18.390
process is not to focus on who; the race,

7
00:00:15.900 --> 00:00:20.010
ethnicity, gender, or religious beliefs of

8
00:00:18.390 --> 00:00:22.380
those we think might be involved in

9
00:00:20.010 --> 00:00:24.420
suspicious activities, but rather to

10
00:00:22.380 --> 00:00:27.269
focus on identifying suspicious

11
00:00:24.420 --> 00:00:29.429
behaviors. Suspicious Activity Reporting

12
00:00:27.269 --> 00:00:31.920
focuses on observed behaviors and

13
00:00:29.429 --> 00:00:33.750
incidents, reasonably indicative of

14
00:00:31.920 --> 00:00:35.790
pre-operational planning, related to

15
00:00:33.750 --> 00:00:38.309
terrorism or other criminal activity.

16
00:00:35.790 --> 00:00:40.920
When observing behaviors that may seem

17
00:00:38.309 --> 00:00:43.110
suspicious, frontline personnel need to

18
00:00:40.920 --> 00:00:46.530
take into account all known facts and

19
00:00:43.110 --> 00:00:47.700
circumstances, such as what, where, when,

20
00:00:46.530 --> 00:00:49.410
and how.

21
00:00:47.700 --> 00:00:50.940
Although these behaviors do not

22
00:00:49.410 --> 00:00:52.710
necessarily mean that someone is

23
00:00:50.940 --> 00:00:54.780
definitely engaged in criminal or

24
00:00:52.710 --> 00:00:56.850
terrorist activity, they may warrant

25
00:00:54.780 --> 00:01:00.149
further follow-up to ensure that SAR

26
00:00:56.850 --> 00:01:02.010
documentation is justified. The following

27
00:01:00.149 --> 00:01:04.500
types of suspicious activity are

28
00:01:02.010 --> 00:01:06.659
examples of behaviors and indicators of

29
00:01:04.500 --> 00:01:09.150
potential terrorism related activity and

30
00:01:06.659 --> 00:01:11.250
criminal activity, as well as potential

31
00:01:09.150 --> 00:01:13.470
criminal and non-criminal activity, and

32
00:01:11.250 --> 00:01:15.270
therefore must always be viewed in the

33
00:01:13.470 --> 00:01:17.100
context of all known facts and

34
00:01:15.270 --> 00:01:19.830
circumstances, at the time of your

35
00:01:17.100 --> 00:01:21.600
observation. Your SAR documentation

36
00:01:19.830 --> 00:01:23.729
should include the behavior observed, as

37
00:01:21.600 --> 00:01:25.619
well as the context of all known facts

38
00:01:23.729 --> 00:01:28.020
and circumstances surrounding your

39
00:01:25.619 --> 00:01:29.939
observation. Breach or attempted

40
00:01:28.020 --> 00:01:31.950
intrusion of a restricted area by

41
00:01:29.939 --> 00:01:34.020
unauthorized persons, such as

42
00:01:31.950 --> 00:01:36.119
impersonating authorized personnel

43
00:01:34.020 --> 00:01:38.250
through the use of false credentials to

44
00:01:36.119 --> 00:01:40.290
access government buildings, military

45
00:01:38.250 --> 00:01:43.729
installations, or other protected

46
00:01:40.290 --> 00:01:45.840
critical infrastructure, or key resources

47
00:01:43.729 --> 00:01:47.640
misrepresentation, or presentation of

48
00:01:45.840 --> 00:01:50.220
false insignias, documents, or

49
00:01:47.640 --> 00:01:52.140
identification to cover illicit activity,

50
00:01:50.220 --> 00:01:54.420
such as stolen or counterfeit

51
00:01:52.140 --> 00:01:57.030
identification, fraudulent warrants,

52
00:01:54.420 --> 00:02:00.930
subpoenas, or liens, or attempts to pose

53
00:01:57.030 --> 00:02:03.090
as common-law marshals, theft, loss, or

54
00:02:00.930 --> 00:02:05.340
diversion of materials associated with a

55
00:02:03.090 --> 00:02:08.039
facility or structure, such as stolen

56
00:02:05.340 --> 00:02:10.520
badges, uniforms, or emergency vehicles

57
00:02:08.039 --> 00:02:13.470
that are proprietary to a facility,

58
00:02:10.520 --> 00:02:15.930
tampering with, or sabotage, or vandalism

59
00:02:13.470 --> 00:02:17.790
of a facility or a protected site, such

60
00:02:15.930 --> 00:02:20.780
as arson, or damage committed at a

61
00:02:17.790 --> 00:02:23.100
research or industrial facility,

62
00:02:20.780 --> 00:02:24.720
cyberattacks to compromise, or attempt

63
00:02:23.100 --> 00:02:26.850
to compromise or disrupt an

64
00:02:24.720 --> 00:02:28.770
organization's information technology

65
00:02:26.850 --> 00:02:30.930
infrastructure, such as attacks on

66
00:02:28.770 --> 00:02:33.630
servers, tracking software on group

67
00:02:30.930 --> 00:02:36.750
websites, or efforts to clog or overwhelm

68
00:02:33.630 --> 00:02:38.790
communication lines, expressed or implied

69
00:02:36.750 --> 00:02:41.160
threat to damage, or compromise a

70
00:02:38.790 --> 00:02:43.260
facility or a structure, such as written

71
00:02:41.160 --> 00:02:47.370
or verbal threats against individuals,

72
00:02:43.260 --> 00:02:49.500
groups, or targets, aviation activity or

73
00:02:47.370 --> 00:02:51.270
operation of an aircraft in a manner

74
00:02:49.500 --> 00:02:53.670
that reasonably may be interpreted as

75
00:02:51.270 --> 00:02:56.070
suspicious, or posing a threat to people

76
00:02:53.670 --> 00:02:57.570
or property, such as requests for pilot

77
00:02:56.070 --> 00:02:59.580
training that is inconsistent with

78
00:02:57.570 --> 00:03:02.070
normal flight training procedures, or

79
00:02:59.580 --> 00:03:03.570
flying in restricted areas near military,

80
00:03:02.070 --> 00:03:06.570
or government facilities, or

81
00:03:03.570 --> 00:03:08.160
entertainment venues. These suspicious

82
00:03:06.570 --> 00:03:10.310
activities are crimes.

83
00:03:08.160 --> 00:03:12.510
If you observe these activities,

84
00:03:10.310 --> 00:03:14.730
appropriate law enforcement action

85
00:03:12.510 --> 00:03:16.830
should be taken, and you should file a

86
00:03:14.730 --> 00:03:19.670
suspicious activity report in addition

87
00:03:16.830 --> 00:03:22.350
to other reports required by your agency.

88
00:03:19.670 --> 00:03:23.970
Other potentially criminal or non-criminal

89
00:03:22.350 --> 00:03:26.489
activities that may be

90
00:03:23.970 --> 00:03:28.280
considered suspicious activity, some of

91
00:03:26.489 --> 00:03:31.320
which may be constitutionally protected,

92
00:03:28.280 --> 00:03:33.090
include eliciting information or

93
00:03:31.320 --> 00:03:35.580
questioning individuals at a level

94
00:03:33.090 --> 00:03:38.400
beyond curiosity about a facility's or

95
00:03:35.580 --> 00:03:40.709
building's purpose, operations or security

96
00:03:38.400 --> 00:03:42.750
such as attempts to obtain specific

97
00:03:40.709 --> 00:03:45.150
information about personnel or occupants,

98
00:03:42.750 --> 00:03:47.910
equipment or training related to the

99
00:03:45.150 --> 00:03:50.310
security of a facility, testing or

100
00:03:47.910 --> 00:03:52.860
probing of security to reveal physical

101
00:03:50.310 --> 00:03:55.709
personnel or cybersecurity capabilities,

102
00:03:52.860 --> 00:03:57.900
such as repeated false alarms, intended

103
00:03:55.709 --> 00:04:00.989
to test emergency services response time,

104
00:03:57.900 --> 00:04:03.150
and rehearse procedures, recruiting or

105
00:04:00.989 --> 00:04:06.090
building operations teams and contacts,

106
00:04:03.150 --> 00:04:08.820
personnel data, banking data, or travel

107
00:04:06.090 --> 00:04:11.100
data, material acquisition or storage of

108
00:04:08.820 --> 00:04:13.470
unusual quantities of materials, such as

109
00:04:11.100 --> 00:04:16.640
weapons, cell phones, pagers, fuel,

110
00:04:13.470 --> 00:04:19.320
chemicals, toxic materials, and timers,

111
00:04:16.640 --> 00:04:21.180
acquisition of expertise, or attempts to

112
00:04:19.320 --> 00:04:23.880
obtain or conduct training in security

113
00:04:21.180 --> 00:04:26.099
concepts, military weapons or tactics, or

114
00:04:23.880 --> 00:04:27.180
other unusual capabilities that would

115
00:04:26.099 --> 00:04:30.360
arouse suspicion

116
00:04:27.180 --> 00:04:31.919
in a reasonable person. Discovery of

117
00:04:30.360 --> 00:04:33.960
unusual amounts of weapons or explosives

118
00:04:31.919 --> 00:04:36.810
that would arouse suspicion in a

119
00:04:33.960 --> 00:04:38.639
reasonable person, incidents or actions

120
00:04:36.810 --> 00:04:40.860
that could threaten the safety of places

121
00:04:38.639 --> 00:04:42.449
or events, such as entertainment venues,

122
00:04:40.860 --> 00:04:44.850
public health facilities, or the

123
00:04:42.449 --> 00:04:47.039
agricultural sector, with regard to their

124
00:04:44.850 --> 00:04:50.220
personnel, facilities, systems, or

125
00:04:47.039 --> 00:04:52.590
functions, photography, observation, or

126
00:04:50.220 --> 00:04:54.150
surveillance of facilities, buildings, or

127
00:04:52.590 --> 00:04:56.850
critical infrastructure and key

128
00:04:54.150 --> 00:04:59.100
resources, beyond casual, tourism, or

129
00:04:56.850 --> 00:05:01.560
artistic interest, to include facility

130
00:04:59.100 --> 00:05:05.520
access points, staff, or occupants, or

131
00:05:01.560 --> 00:05:06.960
security measures. Photography, asking

132
00:05:05.520 --> 00:05:09.330
questions, and other similar activities

133
00:05:06.960 --> 00:05:12.060
are protected under the First Amendment

134
00:05:09.330 --> 00:05:13.949
of the US Constitution. If you report on

135
00:05:12.060 --> 00:05:15.479
these types of activities, you will need

136
00:05:13.949 --> 00:05:17.520
to gather or assess additional

137
00:05:15.479 --> 00:05:19.440
information, taking into account all of

138
00:05:17.520 --> 00:05:21.210
the circumstances, before making a

139
00:05:19.440 --> 00:05:23.099
decision on whether this activity is

140
00:05:21.210 --> 00:05:25.289
reasonably indicative of criminal

141
00:05:23.099 --> 00:05:28.020
activity, associated with terrorism, or

142
00:05:25.289 --> 00:05:29.840
other criminal activity. Race, ethnicity,

143
00:05:28.020 --> 00:05:32.310
national origin, or religious affiliation

144
00:05:29.840 --> 00:05:33.360
should not be considered as factors that

145
00:05:32.310 --> 00:05:35.639
create suspicion.

146
00:05:33.360 --> 00:05:38.550
Although these factors may be used as

147
00:05:35.639 --> 00:05:40.620
specific suspect descriptions, it is

148
00:05:38.550 --> 00:05:42.840
important to recognize that a single

149
00:05:40.620 --> 00:05:45.659
suspicious behavior or act by a person

150
00:05:42.840 --> 00:05:47.520
does not make him or her a terrorist, but

151
00:05:45.659 --> 00:05:49.530
reporting the behavior or incident you

152
00:05:47.520 --> 00:05:51.419
observe so that analysts can compare

153
00:05:49.530 --> 00:05:53.250
with other pieces of information is

154
00:05:51.419 --> 00:05:55.919
critical to understanding whether

155
00:05:53.250 --> 00:05:57.599
additional action is appropriate. When

156
00:05:55.919 --> 00:06:01.699
you observe something that you think is
suspicious, you should report it.