Suspicious indicators can help foil terrorists before they strike
“Response is the traditional role of law enforcement, but protecting your community from terrorist attack requires a different strategy. Being prepared to respond is very different from being proactive. If you have to respond to a terrorist event, that’s a failure.
With those challenging observations, Michael Rozin, an internationally recognized expert on counterterrorism, recently kicked off a daylong police seminar in the Chicago area on the detection and interception of terrorist plots.
His presentation was built around a system developed from Israeli experience called SIRA: Suspicious Indicators Recognition & Assessment. Specifically, it’s how you evaluate people, objects, and vehicles for potential terrorist cues so you can prevent an intended attack, rather than responding to a scene after horrific damage has already materialized.
Rozin, who heads a security consulting firm headquartered in Minneapolis, has a background in defense special ops and facility protection for the government of Israel, a masters degree in security technology from the University of Minnesota, and critical practical experience in the US that includes security responsibility for a highly appealing terrorist target, the country’s largest shopping mall.
In Chicago, his core law enforcement program, sponsored by the Dept. of Homeland Security, the FBI, and the Terrorism Liaison Officer Committee, was augmented with separate presentations adapted for shopping malls, hotels, and entertainment venues.
Force Science News attended the session for cops two days after the Orlando massacre. The timely content included in part:
OFFENDER STRATEGIES. Rozin popped on screen a photo of a pigeon inside a birdcage, which had been seized from a young terrorist at an Israeli border checkpoint. “Where is the danger?” he asked.
Officers in the audience offered possibilities: a bomb had been surgically implanted in the pigeon, the bird was to be used as a “coal mine canary” to test a biochemical weapon before it was released for human devastation, and so on.
Actually, Rozin said, an explosive was concealed inside the bottom of the cage; the pigeon was just window-dressing.
When officers think of terrorism, they tend to think of complex threats, as the audience volunteers had, Rozin explained. In contrast, most of today’s terrorists, especially the increasingly threatening lone wolves, have “two key words by which they think and act: ‘simple’ and ‘easy'”; easy targets and simple means (“get a gun and go kill”). Indeed, they are encouraged to “stay away from complex plots” because failure is most likely when they try to “go beyond their operational ability.”
In any case, “there is always a planning period,” Rozin said, that includes target selection, intel gathering, surveillance, means collection, and rehearsal, before execution.
During this process, which sometimes consumes months, law enforcement with the right mindset “may have a chance” to detect the threat and intervene and at the least convince would-be perpetrators that an intended target is “just too hard” to attack.
HUNTER MENTALITY. “If you have the mentality that ‘It can’t happen to me’ or ‘It can’t happen in our town,’ you’ll never detect a threat before it happens,” Rozin said.
“To be good in the field requires a certain mindset”–a “hunter mentality” such as the Secret Service uses to actively search for and assess potential threat cues when evaluating a crowd along a presidential route. “Making a dedicated effort to search for indicators needs to be part of your culture,” Rozin said.
But knowing what to look for, of course, is essential, and too often cops get focused on the wrong objective. “Looking primarily for the terrorist’s weapon will never put you ahead of the attack,” Rozin asserted.
“Past incidents show that weapons and methods vary.” What remains the same across terrorist events, he said, is the human behavior associated with the intent to do harm. So the terrorist as a person needs to be the primary concern, weapons secondary.
CONTEXTUAL PROFILING. Picking up on “behavioral abnormalities” can be critical in surfacing people who warrant closer scrutiny, Rozin explained. “Contextual profiling” in areas around a potential terrorist target can help you distinguish between people legitimately at a given location and those there to conduct surveillance or a dry run in preparation for an assault, for example.
He recommended closely monitoring activity in: Blue Zones (all entry points into a potential target) and Red Zones (all proximate areas from which the Blue Zone/s can be observed). “A person’s actions, appearance, and belongings all may vary according to their purpose at a given location,” he said.
A terrorist scouting a site will want to determine the normal routines related to the target, timelines, law enforcement and security measures, structural components, and so on that affect his ability to gain access and achieve his mission.
In doing so, he may exhibit noticeable behavioral deviations from what’s customary, such as:
- staying in a Red Zone for a prolonged period without any evident purpose, in contrast to people moving through as they go briskly about their business;
- taking photos or video, possibly in a covert manner, of security cameras, points of concealment, structural elements, etc. (“What makes a picture suspicious is what it’s being taken of,” Rozin said);
- asking questions about operational factors associated with the target;
- placing an item like a package or suitcase, then walking away and watching the response, to test the possibility for positioning a bomb;
- trying to access the targeted building’s HVAC system;
- having visible belongings that don’t seem in context with the individual or the environment.
“Knowing what’s ‘normal’ in each of the zones will help you spot any aberration,” Rozin said. As he demonstrated with footage from security cameras, if you understand the kind of deviations you’re looking for, they can be readily recognized even in crowded, busy locations with many potential distractions.
SECURITY INTERVIEWING. Something that piques your interest is only a start. What Rozin termed a “security interview” can then be key in determining whether a potential terrorism suspect gets a “green light” (at least temporarily) or raises a “red flag” that elevates him or her to a higher level of scrutiny.
In essence, this exploratory, consensual conversation mirrors the pattern of questioning customarily used by officers on traffic stops and field contacts when screening for possible narcotics possession or other criminal activity.
In contrast to a grilling interrogation, Rozin explained, the apparent mood should be casual and non-authoritative, sprinkled with friendly comments. But under this disarming veneer, the person of interest is probed for the purpose of his presence at the location, his point of origin and intended destination that day, his personal/professional background, and other information that can be followed with more detailed questions in pursuit of inconsistencies, unlikely stories, and an absence of what should be fundamental personal knowledge.
“The answers you get may allow you to start building reasonable suspicion or probable cause,” he said. “Your questions should be short and simple, designed to elicit information that can be verified or refuted.”
His presentation included full transcripts of interviews with seemingly unremarkable males and females who were ultimately exposed as dangerous terrorists because they were unmasked as clumsy liars in a matter of minutes by officers’ skillful conversation.
“It’s easy to lie when the stakes are low,” Rozin noted. “But the higher the stakes, the harder it is to produce a cohesive lie and to be convincing.”
BEHAVIORAL PROFILING. Trying to profile by race, ethnicity, or gender doesn’t work, Rozin emphasized. But building suspicion from behavior observed during an interview is another matter.
Human beings tend to react to danger in certain detectable ways, he explained, and for someone planning a terrorist act, an officer’s interest is a very stressful danger. “Once they’re in that high-stakes situation, their body reacts in ways they can’t control,” Rozin said.
In the physical realm, telltale cues may begin surfacing even a few seconds into a contact and may include, among others:
- sweating, especially on the forehead, upper lip, and under the chin
- increasingly manipulating clothing or possessions such as a cellphone
- rapidly blinking the eyes
- touching or rubbing the face, neck, torso, or limbs * covering the mouth when speaking
- swallowing frequently
- signaling a “hidden connection” by trying to communicate with someone else nearby through body movements
- leaning away or moving the feet away after being asked a question.
As a contact continues, Rozin said, verbal indicators of stress and possible deception may become evident, such as:
- hesitant answers
- attempts to change the subject
- answering a question with a question
- expressing a failure to understand detailed questions
- repeating the question asked
- using “integrity qualifiers,” like “Frankly…” or “To be honest…”
- offering “derailing” statements, like “I’m so happy you asked that….”
- attacking the interviewer, or, in contrast, being overly polite or cooperative.
“You look for clusters–two or more–of these indicators,” Rozin said.
“Do any of these mean you’re talking to a terrorist? No. But they should make you inquisitive enough to probe deeper.”
ACTION. “Suspicion is a threat until it is refuted,” Rozin said. “A doubt in your mind should be a threshold for action,” even if you’re able to do nothing more than bring a subject or a situation to the attention of a federal agency that’s tasked with fighting terrorism.
“Prevention is a combination of having the awareness to recognize indicators and having the courage to act. If you want to stop terrorism, you have to act on the basis of small indicators. You can’t wait for the hard evidence of a violent event.”
NOTE: Although Rozin’s presentation concentrated on terrorism, he pointed out that “if you forget about motives and goals and just focus on tactics, there is a lot of similarity between terrorists and active shooters.” Only a minority of active shooters act spontaneously,” he claimed, while 80%, like terrorists, follow a “well-designed plan.”
After an active shooting, he noted, people tend to talk about gun control, mental health, and emergency response. “None of these can affect the next attack,” he said, “but the principles of the SIRA system can.”
Through his firm, Rozin Security Consulting, LLC, Michael Rozin teaches three- and five-day courses on suspicious indicators and threat detection. For more information, he can be reached at: michael@rozinconsulting.com or through the company’s website: www.rozinconsulting.com.
Reprinted with permission from Force Science Institute Ltd, News: June 21, 2016, Chuck Remsberg editor-in-chief (www.forcescience.org) – (c) 2016: Force Science Institute, www.forcescience.org. Reprints allowed by request. For reprint clearance, please e-mail: editor@forcescience.org