Recognize Suspicious Activity

Threatening to commit a crime that could harm or kill people or damage a facility, infrastructure, or secured site.

A prolonged interest in or taking pictures/videos of personnel, facilities, security features, or infrastructure in an unusual or covert manner.

Stealing or diverting items—such as equipment, uniforms, or badges—that belong to a facility or secured site.

Investigating or testing a facility’s security or IT systems to assess the strength or weakness of the target.

Operating or interfering with the operation of an aircraft that poses a threat of harm to people and property.

Unauthorized people trying to enter a restricted area or impersonating authorized personnel.

Gaining skills or knowledge on a specific topic, such as facility security, military tactics, or flying an aircraft.

Questioning personnel beyond mere curiosity about an event, facility, or operations.

Presenting false information or misusing documents to conceal possible illegal activity.

Disrupting or compromising an organization’s information technology systems.

Funding suspicious or criminal activity or recruiting people to participate in criminal or terrorist activity.

Damaging or destroying part of a facility, infrastructure, or secured site.

Acquisition and/or storage of unusual materials such as cell phones, radio controllers, or toxic materials.

Collection or discovery of unusual amounts of weapons including explosives, chemicals, or other destructive materials.

Actions which raise concern to specific sectors (e.g., power plant) with regard to their personnel, facilities, systems, or functions.