Protective Security Coordination Division

• Office of Infrastructure Protection
• 57 pages
• For Official Use Only
• At a minimum when unattended, this document is to be stored in a locked container such as a file cabinet, desk drawer, overhead compartment, credenza, or locked area offering sufficient protection against theft, compromise, inadvertent access, and unauthorized disclosure.
• June 2007

SURVEILLANCE OBJECTIVES

These objectives describe the kinds of information that terrorists monitor when planning an attack.

Surveillance and Countersurveillance

• Identity of places where further surveillance can take place

• Identity of places where countersurveillance can be detected

Facility Security

• Presence or absence of security cameras

• Number, location, type, and coverage of security cameras

• Security screening procedures for employees, visitors, and vehicles

• Procedures for changing of the guard

• Opportunities for theft of facility identification (ID) cards or special license plates

• Proximity to first-responder locations

• Security event response times

• Number, gender, ethnicity, location, dress, weapons, and equipment of security/police forces

Facility Access

• Configuration and staffing of control points

• Visitor access procedures

• Availability of tours

• Location of roadways, entrances, parking lots, gates, and access points

Facility Construction

• Construction materials used

• Building shape, height, and setbacks

• Location of vulnerable structural components

• Opportunities for cascading damage effects

• Location of executive offices and employee meeting places

• Location of power and HVAC systems

• Adequacy of emergency exits, escape routes, and fire suppression systems

Target Dynamics

• Opening and closing times

• Lunch and break times

• Shift changes

• Patterns of concentration of people and vehicles; traffic congestion

• Nearby people and vehicle movement throughout the day

• Monitoring of police radio frequencies and recording of emergency response times

Secondary Targets

• Nearby alternative targets

• Nearby collateral targets

…

…

TRANSACTIONAL AND BEHAVIORAL INDICATORS (at or near a postal or shipping facility)

These are indicators of atypical procedures or actions by customers, vendors, or suppliers.

Transactional Indicators

• Approach from a previously unknown vendor, supplier, or customer whose identity is not clear

• Transaction involving an intermediary agent or consignee that is atypical in light of usual business

• An agent or customer associated with a military-related business, such as foreign armed forces

• Unusual request concerning the shipment or labeling of goods

• Packaging that is inconsistent with the shipping mode

• Unusually favorable payment terms (e.g., too good to be true) when compared with the prevailing market

• Request for excessive confidentiality regarding a purchase, sale, or delivery

• Orders for excessive quantities of personal safety/security devices that are outside normal needs

• Requests for normally unnecessary devices/supplies coupled with an unconvincing explanation for the need

• Vendor, supplier, or customer that uses a different name for different transactions

• Equipment, chemicals, or materials stolen or ‘lost’ during shipment or shortly after delivery

• Theft or loss of large amounts of cash

Behavioral Indicators

• Intimidating, harassing, bullying, belligerent, or other inappropriate, aberrant, bizarre, or aggressive behavior by an employee

• Excessive anger and/or bitterness expressed by employee regarding a personnel action by employer

• Delivery that is unexpected, out of the norm, without explanation, or associated with suspicious paperwork

• Excessive request for site access by delivery person or delivery vehicle

• Evasive responses or reluctance to give sufficient explanations for use or purpose of materials

• Reluctance to provide location data, such as business address, delivery point, or shipping origin

• Reluctance to provide clear answers to routine commercial or technical questions

• Reason given for purchase or sale does not match the usual business or technological level

• No offer of, request for, or refusal of technical assistance when such action is generally standard

• Equipment or material is said to be for a use that is inconsistent with its design or normal purpose

• Theft of equipment or material that has no practical use outside a legitimate business practice

• Apparent lack of familiarity with the ‘business’ or its nomenclature or a lack of knowledge of how transactions of this type are handled

• Inconsistency of information that is provided (e.g., phone number or address) with what is known

…

• In March 2006, at a trial in London, a prosecution witness testified that a terror cell planned to smuggle bomb ingredients into the United Kingdom by using shampoo and shaving cream bottles and bags of dried fruit. They would be sent to the UK in a parcel via Federal Express (BBC News 2006).

…

• Also in May 2004, three homemade pop bottle bombs were found in mailboxes in Palatine, Illinois. One had detonated (NBC5.com 2004).

…

For more information about this document, contact:
Protective Security Advisor Duty Desk (703-235-5724 or IPassessments@dhs.gov).

Share this: