Questioning individuals at a level beyond mere curiosity about particular facets of a facility’s purpose, operations, security procedures, etc., that would arouse suspicion in a reasonable person.
Testing of Security
Interactions with or challenges to installations, personnel or systems that reveal physical, personnel or cybersecurity capabilities.
Building operations teams and contacts, personnel data, banking data, or travel data.
Taking pictures or video of facilities, buildings, or infrastructure in a manner that would arouse suspicion in a reasonable person. Examples include taking pictures or video of access points, personnel performing security functions (patrols, badge/vehicle checking), security-related equipment (perimeter fencing, security cameras), etc. All reporting on photography should be done within the totality of the circumstances.
Demonstrating unusual interest in facilities, buildings, or infrastructure beyond mere casual or professional (e.g., engineers) interest such that a reasonable person would consider the activity suspicious. Examples include observation through binoculars, taking notes, attempting to measure distances, etc.
Acquisition of unusual quantities of precursor materials such as cell phones, pagers, fuel and timers, such that a reasonable person would suspect possible criminal activity.
Acquisition of Expertise
Attempts to obtain or conduct training in security concepts (military weapons or tactics) or other unusual capabilities that would arouse suspicion in a reasonable person.
Discovery of unusual amounts of weapons or explosives that would arouse suspicion in a reasonable person.
Actions associated with a characteristic of unique concern to specific sectors (such as the public health sector) with regard to their personnel, facilities, systems or functions.
Unauthorized personnel attempting to enter or actually entering a restricted area or protected site. Impersonation of authorized personnel (e.g., police/security, janitor).
Presenting false documents, and/or identification to misrepresent one’s affiliation to cover possible illicit activity. Misusing insignias, uniforms, etc.
Stealing or diverting something associated with a facility (e.g., badges, uniforms, identification, emergency vehicles, technology or documents).
Damaging, manipulating or defacing part of a facility/infrastructure or protected site.
Compromising or attempting to compromise or disrupt an organization’s information technology infrastructure.
Operation of an aircraft in a manner that reasonably may be interpreted as suspicious or posing a threat to people or property.
Expressed or Implied Threat
Communicating a spoken or written threat to damage or compromise a facility or infrastructure.