(U//FOUO) DHS-FBI Suspicious Activity Reporting Bulletin: Theft/Loss/Diversion


  • 1 page
  • For Official Use Only
  • November 15, 2012


(U//FOUO) Terrorists may attempt to steal or divert precursor materials, uniforms, identification, blueprints, documents, access cards, facility vehicles, or other items–possibly with the help of knowledgeable insiders–for use in pre-operational planning or attacks. Emilio Suarez Trashorras, a Spanish national convicted for his role in the 2004 Madrid train bombings, stole the explosives used in the attack and the vehicles used to transport the explosives from a mining company where he worked.

(U//FOUO) The following SAR incidents from the NSI shared space demonstrate types of behavior terrorists might exhibit during pre-operational stages for attacks. While none were ultimately linked to terrorist activity, they are cited as relevant examples for awareness and training purposes:

— (U) An individual approached a transit authority security officer on a rail platform to report a fight in progress. No fight was found, but the individual continued to engage the security officer with questions, then seized a set of transit keys from the officer’s pocket and fled. Efforts to apprehend the suspect were unsuccessful.

— (U) A powder company that supplies explosives to the mining and construction industries reported in 2011 that the locks to an explosives magazine were cut overnight, and numerous items were stolen, including three 50-lb bags of ammonium nitrate fuel oil, one case of emulsion explosive, two cases of cast boosters, and three 1,000-foot rolls of detonation cord.

(U) Possible Indicators of Pre-Operational Theft/Loss/Diversion

(U//FOUO) The following activities can indicate efforts to illegally obtain materials for use in terrorist pre-operational planning or attacks. Theft is a common criminal occurrence that is not necessarily associated with terrorism. Care should be taken to distinguish crimes of opportunity from those that may indicate a terrorist motive. Depending upon the context, theft, loss, or diversion incidents should be reported to the appropriate authorities, particularly if a terrorism link is suspected.

— (U//FOUO) Theft of chemicals, hazardous substances, weapons, pre-cursor materials, or items that could compromise facility security, such as uniforms, identification, blueprints, vehicles (or components), technology, or access keys or cards.

— (U//FOUO) Receipt, transfer, or delivery of any of the above without legitimate reason, necessary identification, or authorization.

— (U//FOUO) A pattern of losses or irregularities in facility inventory indicating sensitive materials may have been misdirected or are missing.

— (U//FOUO) Employees who frequently requisition extra uniforms, equipment, or other proprietary or sensitive materials, and/or who remove them from the facility without authorization.

(U//FOUO) First Ammendment-protected activities should not be reported in a SAR or ISE-SAR absent articulable facts and circumstances that support the source agency’s suspicion that the behavior observed is not innocent, but rather reasonably indicative of criminal activity associated with terrorism, including evidence of pre-operational planning related to terrorism. Race, ethnicity, national origin, or religious affiliation should not be considered as factors that create suspicion (although these factors may be used in specific subject descriptions).

Share this: