(U//FOUO) DHS-FBI Suspicious Activity Reporting Bulletin: Terrorists Eliciting Information

Suspicious Activity Reporting (SAR) Eliciting Information

1 page
For Official Use Only
February 7, 2012

(U//FOUO) Terrorist or criminals may attempt to identify critical infrastructure vulnerabilities by eliciting information pertaining to operational and security procedures from security personnel, facility employees, and their associates. Persistent, intrusive or probing questions about security, operations or other sensitive aspects of a facility by individuals with no apparent need for the information could provide early warning of a potential attack. Notable examples of suspicious elicitation:

– (U//FOUO) May 2011: A gas station attendant asked an employee of a nearby chemical manufacturing plant a series of questions about the types of chemicals produced at the plant, whether any were explosive, and whether employees were allowed to take chemicals home. The attendant also asked if the plant employee worked with chemicals, whether certain chemicals become explosive when combined, and whether the plant was hiring.

– (U//FOUO) February 2011: An individual asked a security officer at a train station about station security practices including shift times and changes for security personnel, the number of guards on duty, location of me security company, and whether security continues after midnight. He also asked if the security officer had a key to the electrical room, contact instructions for security personnel in the event of an emergency, the time most people exit trains, and the purpose of little black balls’ (closed-circuit cameras) mounted at points around the station.