(U//FOUO) DHS-FBI Suspicious Activity Reporting Bulletin: Expressed or Implied Threat


  • 1 page
  • For Official Use Only
  • March 1, 2013


(U//FOUO) Expressed or implied threats by an individual or a group communicating intent to commit acts of terrorism or violence or advocating violence against a person, population, or to damage or destroy a facility can be an indicator of pre-operational attack planning. For example, in 2010 a Virginia-based US person pled guilty to communicating threats after he posted a video to the Internet encouraging violent extremists to attack the creators of a television show, including highlighting their residence and urging online readers to “pay them a visit.” He also admitted to soliciting others to desensitize law enforcement by placing suspicious looking but innocent packages in public places, which could then be followed up by real explosives.

(U//FOUO) The following SAR incident reported to the NSI shared space provides an example of an implied threat that could be indicative of pre-operational activity and attack planning. Although it was not ultimately linked to terrorist activity, it is cited as an example for awareness and training purposes:

— (U//FOUO) A courthouse building received an envelope, postmarked out of state, in which a smaller envelope marked “white powder” contained an unknown substance. The incident appeared to be related to 17 other similar suspicious letters containing white substance mailed over a period of several weeks to financial institutions, police departments, state and local government offices, and court facilities.

(U) Possible Indicators of Suspicious Expressed or Implied Threats

(U//FOUO) The following are examples of threats that may constitute warning signs of impending acts of violence. Depending on the context—state of mind of the individual, personal behaviors, and other indicators—expressed or implied threats should be reported to appropriate authorities.

— (U//FOUO) Statements by individuals or groups communicated verbally, in writing, or through video recordings stating the intent to commit violence.
— (U//FOUO) Letters and packages containing suspicious substances accompanied by a note stating that its contents are noxious or intending to communicate threat.
— (U//FOUO) Specific warnings about impending attacks that provide date, time, or place of the threatened attack.
— (U//FOUO) Specific stated threats to individuals or facilities to deter an anticipated action or force compliance with a demand.

(U//FOUO) First Amendment-protected activities should not be reported in a SAR or ISE-SAR absent articulable facts and circumstances that support the source agency’s suspicion that the behavior observed is not innocent, but rather reasonably indicative of criminal activity associated with terrorism, including evidence of pre-operational planning related to terrorism. Race, ethnicity, national origin, or religious affiliation should not be considered as factors that create suspicion (although these factors may be used as specific suspect descriptions).

Share this: