RESPONSE TO SUSPICIOUS BEHAVIOR

AND
BOMBING PREVENTION MEASURES

By:
HARSHRAJ SINGH CCSI® PSM® PSPI® PII® CISA
BTPR® OHSM® EOSH®

Normal Behaviors
You may contribute to the bombing prevention effort by recognizing suspicious actions because many attacks start with a
suspicious person. However, you must first be able to recognize common behaviors in your environment before you can see
any type of questionable behavior. Setting a benchmark for typical behavior and attitude is the first step in this process. The
behaviors that are regularly noticed in your environment are considered normal. They include the appearance and behavior of
people you routinely engage with.
Without this baseline, it is incredibly difficult to recognize a group of behaviors that are unusual and potentially suspicious. It
is easier to establish suspicious actions when one has a clear and thorough understanding of what is typical. Any deviation
from the "normal" baseline should be viewed with suspicion.

Potential Terrorism/Bomber Indicators.

What traits and deeds might be precursors to terrorist or bomber activity? The U.S. Department of Homeland Security, the
Federal Bureau of Investigation, and state, local, tribal, and territory law enforcement partners collaborate on the Nationwide
Suspicious Activity Reporting (SAR) Initiative (NSI). The following probable criminal or non-criminal behaviors are listed by
NSI as potential signs of terrorism.

A. Misrepresentation. Presenting misleading information or misrepresenting one's allegiance by employing insignia,

paperwork, or identity while potentially engaging in unlawful activities.

B. Theft/Loss/Diversion. Stealing or rerouting something that belongs to a facility, infrastructure, or secured protected site
that is exclusive to such entities (such as badges, uniforms, identification, emergency vehicles, technology, or papers, whether
classified or unclassified).

C. Expressed or Implied Threat. Expressing a verbal or written threat to engage in behavior that will endanger the lives of or
cause physical harm to another person or persons, or to harm or undermine a secured protected site.

D. Eliciting Information. Interrogating people or otherwise obtaining information about a public or private event, or specific
aspects of a facility's or building's use, operations, security procedures, etc., in a way that would make a reasonable person
suspect terrorism or other criminality.

E. Testing or Probing of Security. Interactions with or challenges to installations, people, or systems that are intentional and
reveal physical, human, or cybersecurity capabilities in a way that would lead a reasonable person to suspect terrorism or
other criminal activity.

F. Photography. Taking strange or covert photos or videos of people, places, structures, or infrastructure in a way that would
make a reasonable person suspect terrorism or other crime. Examples include taking photos or videos of rarely used access
points, a bridge's superstructure, security personnel performing security tasks (such as patrols, badge/vehicle checking), and
security-related infrastructure (such as perimeter fencing, security cameras), among others.

G. Observation/Surveillance. displaying extraordinary or sustained interest in facilities, buildings, or infrastructure that goes
beyond simple recreational (such as visitors) or professional (such as engineers) attention, and in a way that would make a
reasonable person suspect terrorism or other criminal activity. Binocular observation, taking notes, attempting to mark off or
measure distances are a few examples.
H. Materials/Expertise Acquisition. Acquisition and/or storage of unusual quantities of items in a way that would lead a
reasonable person to suspect terrorism or other criminal activity, such as timers or other triggering devices, fuel, chemicals, or
toxic materials, radio control toy servos or controllers, pagers, cell phones, or pagers. attempts to acquire knowledge or skills
in military weapons or tactics, security ideas, or other extraordinary qualities in a way that would make a reasonable person
suspect terrorism or other criminal activity.

I. Weapons Collection/Storage. A reasonable person would suspect terrorism or other criminal activity if they saw a
collection or discovery of extraordinary quantities or types of weaponry, including explosives, chemicals, and other
destructive items, as well as any evidence, detonations or other debris, wounds, or chemical burns.

Key Suspicious Behavioral Indicators

Suspicious Behaviors.
Those who intend to make bombs frequently exhibit warning characteristics that vigilant store personnel can spot. Physical
symptoms like fidgeting or sweating can be a warning, as can situational ones like buying a certain product in big quantities.
Any general verbal or physical conduct that deviate from the usual could be signs of criminal involvement.

Physical Behavior.

➢ Profuse sweating: One of the body's many physiological responses to anxiety is excessive sweating.
➢ Nervous or evasive behaviors - Shows signs of internal conflict or uneasy behaviors, ex frequently checking your
shoulders, for instance.
➢ Aggressive/Agitated - Displays physically aggressive actions. For instance, pacing or hand ringing are erratic
motions.
➢ Nervous - Displays internal conflict or nervous behaviour. Frequently checking your shoulders, for instance.
Guarded/Antisocial: Displays aloof and reserved conduct. For instance, avoiding social interaction and eye contact.

Verbal Behaviors.

➢ Aloof - Disengaged in conversation. For example, quick and short nondescript responses when questioned.

➢ Argumentative/Defiant - Verbal disagreement using foul language.

➢ Manipulative/Scheming - For example, using loud tones, cursing, yelling and screaming.

➢ Odd, detailed questions about product of security procedures - For example, questions not relevant to lawful or
proper use of product.

Reacting to Suspicious Activity

Be vigilant to spot suspicious incidents so you can write up a thorough and useful report. Pay close attention to what the
customer does, says, and says. Most essential, believe in your gut.

o Do not be confrontational.

o Be vigilant and observe.

o Do not give the impression that you are detaining the subject.

o If You See Something, Say Something. ↓

▪ Who or what you saw.

▪ When you saw it.

▪ Where it occurred.

▪ Why it is suspicious.

Incident Details

The following questions can help you ensure you are noting, remembering, and reporting adequate details.

A. WHO did I observe? Be as detailed as possible in describing the individual, including appearance, physical characteristics,
clothing, and any identification you can obtain.

B. WHAT specifically did I see? What occurred that was suspicious regarding the individual’s behavior, appearance,
mannerisms, what was said, items purchased, and missing or stolen inventory.

C. WHERE did I observe the suspicious behavior? Be specific as to where the incident took place, which may include
multiple locations, or which took place over a period or dates.

D. WHEN did I observe the suspicious behavior? Be sure to document when the suspicious behavior or incident occurred.
This may include several visits to the retailer, or incidents over a period that has developed into a suspicious pattern.

E. WHY do I think the behavior is suspicious? Articulate why the incident or behavior is suspicious. Describe a typical
customer vs what you observed to help explain your suspicions.
Vehicle Description (if known)

Reporting Vehicles. Additionally, almost just as important as the individual is the reporting of a suspicious individual’s
vehicle. When reporting a vehicle, include:

o Year, make and model.

o Body type (2 door, 4 door, van, SUV, etc.).

o Passengers (number of people in vehicle).

o License plate (most important).

o Damage or anything unusual (logos, etc.).

o Accessories.

Individual(s) Description

Reporting Physical Characteristics

The more details witnesses can about the physical characteristics of
people behaving suspiciously, the better.

Physical Characteristics. (What They Look Like).

a) General description. Height, Weight, Race, Gender, Age, and Body Type are some examples of general physical
descriptions of an individual. These are a good starting point but do not always provide a detailed enough
description to be able to identify the specific individual(s).

b) Detailed Observations. Be aware of specific items that may distinguish one individual from another. These can often
include identifying items that can vs. cannot be easily changed.

Physical characteristics that can NOT be easily changed include the following.

a. Teeth and facial features (teeth and facial features are very diverse. Consider people that are well known for
their type of teeth or distinct features. Teeth can be changed using props).

b. Height, weight, and body build (these are not easily changed without theatre grade props).

c. Gender (it is difficult but possible to change).

d. Race (it is unchangeable).

e. Age (age is possible to alter; however, it is not easily or effectively done).

f. Skin tone (it can be altered to a degree).

g. Skin texture (e.g., pores, pockmarks, acne) (they can be covered with makeup).

h. Moles and birthmarks (they can be disguised or added).

i. Ear size and shape (they are not easily altered).

j. Lip size and shape (they are not easily altered).

k. Forehead height (e.g., receding hairline, balding) (the brow, especially when a person makes certain facial
expressions, is impossible to change without theater- level makeup).

l. Cheeks/chin (e.g., dimples, cleft) (they are not easily altered).

m. Scars, tattoos (size, color, location on the body) (they can be hidden, or temporary ones can be added. There
are exceptions, like Mike Tyson’s facial tattoo).

n. Body piercings (piercings can be added or removed; some leave distinct holes).

o. Visible physical handicaps such as walked with a limp, etc.

Physical characteristics that can be easily changed, and disguises and items that can change someone’s features include
the following.

a) Fake moles and tattoos (temporary stick-on).

b) Facial hair (beards/moustaches).

c) Hair (dyed or cut to different styles).

d) Wigs (different styles and colors).

e) Glasses/sunglasses (different styles, shapes, colors can change the appearance of the face).

f) Hats (caps, floppy, hoody, colors).

g) Clothing (color, pattern, logos, layers, reversible, interchangeable).

D. Clothing and Accessories. Describe items that stand out and may be worn or used on a regular basis. These may include
items such as wedding rings, other body jewelry, name brand accessories, etc.
Suspicious or Unattended?

Suspicious or Unattended?
To assist decide whether a package is suspicious or merely unattended, utilize the abbreviation HOT. You should always approach
any unattended items with extreme caution. It might be an unsettling object, such a cloaked improvised explosive device (IED). Do
not touch it until you have determined whether it is suspicious. Threats, placement, and how close an item is to people or valuable
goods are all potential signs. Unusual sounds, vapors, mists, or scents are a few examples. Other visible bomb-like components,
unexplained wires, electronics, or other components are another.

Generally anything that is (HOT) should be deemed suspicious.

a) Hidden.

b) Obviously suspicious.

c) Not Typical.

You may also look around the surrounding area and ask yourself the following questions:

a) Is the item at or near a facility feature that would be considered a potential target? (e.g., high occupation area, critical
manufacturing output, infrastructure components, or symbolic icon)

b) Have there been any bomb threats or intelligence regarding a bomb threat?

c) Has there been any recent suspicious activity?

d) Was the item hidden or attempted to be hidden?

e) Is it located near a high traffic or queuing area?

Reaction if Suspicious

Response if Suspicious
Based on the aforementioned factors, if you think the item is questionable, you should proceed with extreme caution because
response time is crucial. Due to the inherent risk and possibility of detonation or cross-contamination with any chemicals you may
have in your facilities, caution and timing are required.

Response to Suspicious Items. If certain characteristics about the item lead you to believe that it is suspicious, follow the RAIN
steps and procedures.

R is for Recognize. Recognize that there is something suspicious.

a) Be prepared to provide a description of the item and its location.

A is for Avoid. Avoid contact with the suspicious item.

b) Leave the item exactly where it is.

c) Do not disturb or touch the suspected item. Doing so could accidentally set off a detonation, if the item is, in fact, an IED.

d) Do not alter the surrounding environment. This is because any change in the chemicals in the environment could potentially
lead to a chemical reaction within the suspicious item, leading to a detonation.

e) If lights or other electrical or mechanical devices are on in the area, leave them in the state they are currently in. For example,
if the lights are on, leave them on. If they are off, leave them off.

I is for Isolate. Isolate the item and do not allow anyone to approach it.

a) Be aware of the potential for a secondary device.

b) Avoid using cell phones or radios near the object. Radiation could trigger a detonation.
c) Monitor the item.
d) Witnesses to the initial discovery of the item should be kept in a safe area.

N is for Notify. Notify a higher authority.

a) Immediately notify your supervisor and law enforcement.

After you’ve followed the RAIN procedures regarding a suspicious item, follow your local bomb threat management plan for your
workplace. If you are not at your workplace, stand at a safe distance until first responders arrive.

Reaction if Unattended

Response to Unattended Items

Based on the aforementioned factors, you should nevertheless proceed with extreme caution if an item is left unattended even
though it doesn't appear odd. Avoid touching the object. Try to identify the owner if there are any labels on it. If identified, ask the
owner to reclaim it. Report the item to your supervisor, business security experts, or police enforcement if the owner cannot be
located or cannot be reached..
Suspicious Letters and Packages

Suspicious Packages. Package bombs, which contain letters, packages, and anything else delivered by postal or courier service, are
not a novel tactic; terrorist and anarchist organizations have utilized them. Although they can be started in other ways, many of
these explosives are set off when victims handle or open the parcels.

Package bombs can appear innocent and come in a range of sizes and shapes. You might be wary of a letter or parcel if it exhibits a
number of traits. It's crucial that you are able to spot questionable correspondence. Shape, appearance, address, and packaging are
characteristics to which particular attention should be paid.

A. Shape – Is it lopsided or uneven? Is it rigid or bulky?

B. Look – Are there oily stains, discolorations, or crystals on the wrapper? Does it have a strange odor?
C. Address – Is there a return address? Are there restrictive markings? Are there misspelled words? Is it addressed to a title rather
than to an individual? Is it an incorrect title? Is it poorly typed or written?
D. Packaging – Is it sealed with tape? Is there excessive tape? Is there excessive postage?