(U//FOUO) DHS-FBI Suspicious Activity Reporting Bulletin: Observation/Surveillance


  • 1 page
  • For Official Use Only
  • October 15, 2012


(U//FOUO) Terrorists often conduct physical surveillance to identify suitable targets, determine vulnerabilities, plan attack methods, or assess the target’s security posture.  In March 2010, David Coleman Headley pled guilty for his role in the November 2008 terrorist attacks in Mumbai, India by conducting video and photographic surveillance of potential targets, as well as later surveilling Danish newspaper offices–the target of another attack plot.

(U//FOUO) The following SAR incidents from the NSI shared space demonstrate types of behavior terrorists might exhibit during planning or actual attacks. Although none were linked to terrorist activity, we consider the examples relevant for situational awareness and training:

– (U//FOUO) A city utility company reported suspicious surveillance activity at a hydroelectric plant.  On six occasions within a three-day period, two vehicles of the same color, make, and model (but with different license plate numbers) were observed traveling slowly on the road adjacent to the plant, stopping at specific posts on the property, turning around, and slowly returning in the other direction.
– (U//FOUO) A prominent hotel in a major metropolitan area reported a male and a female photographing the hotel entrances from a vehicle with Canadian license plates.  Security camera footage showed the vehicle moved at lease twice to different locations around the hotel while the passenger took photos of the hotel and surrounding restaurants and the driver on a clipboard.  No additional information regarding this incident is available.

(U) Possible Indicators of Observation/Surveillance

(U//FOUO) The following may indicate suspicious observation/surveillance activity and should be reported to appropriate authorities, but context (time, location, personal behaviors, and other indicators) should be carefully considered to rule out legitimate, non-suspicious activities:

– (U//FOUO) Unusual, repeated, or prolonged observation of infrastructure (for example, with binoculars or video cameras);
– (U//FOUO) Taking notes or measurements, counting places, sketching floor plans, maps, or diagrams;
– (U//FOUO) Scrutinizing security personnel, shift changes, or facility activities; or
– (U//FOUO) Extended loitering without explanation, particularly in concealed locations with optimal visibility or potential targets.

(U//FOUO) First Ammendment-protected activities should not be reported in a SAR or ISE-SAR absent articulable facts and circumstances that support the source agency’s suspicion that the behavior observed is not innocent, but rather reasonably indicative of criminal activity associated with terrorism, including evidence of pre-operational planning related to terrorism. Race, ethnicity, national origin, or religious affiliation should not be considered as factors that create suspicion (although these factors may be used in specific subject descriptions).

Share this: