Suspicious Activity

Scott Koenig is bemused by those who believe that dated attack plans are somehow evidence that counter-terrorist intelligence is bad or, worse, politically motivated.

We know that al Qaeda operatives typically spend several months or even years surveiling a potential target, probing for weaknesses. By increasing security of likely targets on the basis of the slightest intelligence (or even at random), we can disrupt their planning process, and possibly force them to abandon a plan altogether.

The easiest time to thwart a potential terrorist plan is during this critical planning period. If the surveillance can be detected, it may be possible to track the movement of the reconnaissance elements, and ultimately bust an entire terrorist cell.

But typically, the critical piece of information that thwarts an attack won̢۪t come from captured documents, or even trained security personnel. It generally comes from an alert civilian who witnesses suspicious activity, and reports it to authorities.

In a discussion that ensues in his comments section, he defines “suspicious”:

First, let’s dispense with the BS: ethnic profiling works. I don’t mean to offend anyone, but Middle Eastern men in their 20s and 30s are much more likely to be terrorists than say, an elderly Scandanavian woman.

What you’re typically looking for is someone who is taking numerous photos of high-profile buildings or other vital infrastructure beyond what a tourist might want for his scrapbook. They would be paying particular attention to critical structural elements, like support beams, etc. Anyone who is spending an unusual amount of time observing people (especially security or delivery personnel) entering and leaving a building is obviously suspicious. Even more suspicious if he is taking notes. Anyone observing from a distance with a telescope or binoculars should raise your attennae.

But mainly, it’s just any behavior that strikes you as unusual for a person going about their business, but which could easily be consistent with scoping out a potential target.

Clearly, this isn’t rocket science. The bottom line is that if you have a gut feeling about someone, don’t ignore it. Observe their behavior, but don’t confront them directly. Make sure you can give a good description, and report the incident to the proper authorities.

Ethnic profiling isn’t foolproof. While al Qaeda operatives are mainly young, male, and Arab, not all are. Still, one has to start somewhere. And it’s not simply the presence of people who “look” like the people who staged the 9/11 attacks. The phones would ring off the hook in the DC area if people called the police to report every sighting of a “Middle Eastern man in their 20s and 30s.” Or, for that matter, people taking pictures of buildings. But, certainly, people can develop a sense of what is “normal” for their part of the country and figure out what constitutes “suspicious.”

FILED UNDER: Intelligence, Terrorism
James Joyner
About James Joyner
James Joyner is Professor and Department Head of Security Studies at Marine Corps University's Command and Staff College and a nonresident senior fellow at the Scowcroft Center for Strategy and Security at the Atlantic Council. He's a former Army officer and Desert Storm vet. Views expressed here are his own. Follow James on Twitter @DrJJoyner.


  1. Kathy K says:

    Unless they are dressed in their culture’s clothing, around here they’d likely be mistaken for Hispanics. So we look for odd behavior, not specific types.

  2. Jim Henley says:

    Scott makes some good points, as does James (and Kathy re faux hispanics). Question, though. Has this:

    But typically, the critical piece of information that thwarts an attack won’t come from captured documents, or even trained security personnel. It generally comes from an alert civilian who witnesses suspicious activity, and reports it to authorities.

    been demonstrated to be true? To justify the whole passage alert civilians reporting suspicious activity to authorities need to have resulted in the thwarting of many attacks. (Thus, “typically.”) What is our data source for this?

  3. Uncle Vic says:

    We’re doing it again, people. Ridge makes a political speech for Bush — check out his praise for the president amidst his warning — and we fall for it. We even spend time discussing peripheral issues like this one.

    We have to be vigilant — we know that. We have to watch out for suspicious people — we know that. We have to alert the police when we see something unusual — we know that. Let’s not pretend Ridge is doing this for our benefit. This is political, pure and simple, and it’s meant to distract us from the real issues, one of which is the administration’s failure to put all our resources to work to crush Al-Qaeda.

    P.S. For Koenig it’s either Middle Eastern men in their 20s or 30s or elderly Scandanavian women. That’s fairly simple minded, isn’t it? If ethnic profiling were only that easy and no more sinister. Which is why Kathy’s point is more sensible that Koenig’s entire piece.

  4. vdibart says:

    I agree with Uncle Vic. I have no problem with the alert if there is evidence of an imminent threat. Ridge/Bush have not demonstrated to me that this threat is any more imminent than other threats they’ve learned about via the “chatter” they seem so keen on referencing.

    Yes, al-Qaeda takes years to go from planning to operational. We also know they are very flexible and will drop or change plans very quickly (and may have done so in this case months or years ago). Seems to me that if you understand that much you would want to be a little more careful about raising red flags unless you knew that it was imminent.

  5. vdibart says:

    P.S. Here’s an example. I work in Manhattan. My wife was near tears on Sunday begging me not to go to work on Monday because of these terror warnings. And every time one of these warnings comes out, she inevitably brings up the topic of why we live here at all – why not move somewhere less targeted. This is just me, but on a large scale it’s a huge morale problem. My wife doesn’t care about men with guns outside Wall Street protecting us against some unknown enemy. That involves too much rational thought, and terrorism is not intended to prey on our reason. It’s intended to prey on our fear.

  6. FetchDawg says:

    Agree that the terrorists must be delighted that millions of us are terrified to go to the office. Bush blew this, big time. These warnings are a reminder of how his war on terror increases our risk.

  7. lady c says:

    From inside the beltway — Ethnic profiling wouldn’t work very well around the targets alQueda was casing in Washington DC. Both the World Bank and IMF have staff and visitors in vast numbers from around the world. Both organizations are proud that their management and staff include a very large number of people (many young men) from the Middle East, North Africa and the sub-continent, especially Pakistan. Being only two blocks from the White House, you’ll also see lots of folks from around the country and world with cameras strolling in the area. George Washington University’s campus is in the middle of the Bank/Fund area, and again they have lots of young men from around the world “hanging out” because they’re students. So it would take some really peculiar behavior for a civilian, who was familiar with the area, to label something as “suspicious.” And being on hyper-alert would be destructive of staff morale and effectivenss — these institutions are extremely multicultural and function only if there is a high degree of mutual respect for people whose appearance and demeanor is somewhat different from “American.”

    We’re much better off having security do their job — controlling ingress and egress to the buildings and garages, patrolling areas that may be vulnerable, securing alleys where cars or trucks could be brought, fortifying entrances and sidewalk areas. Having citizens on “orange” or “red” alert is just going to generate a lot of diversionary calls to security and police from well-meaning people who don’t know what they’re talking about but are scared to death.

  8. LJD says:

    Are we talking about politicization of the terror alerts here, or ethnic profiling? Either way, the comments posted show clear misunderstanding of the war on terror. Knowing about an imminent threat sounds great on paper, but we don’t have that luxury, or the complete information to execute such a decision. We get bits and pieces; hopefully enough of the picture to thwart an attack.

    Certainly there are issues with the alert system, but it does not stand up as evidence that it being used to motivate politics. There is no evidence that the alerts even influence politics one way or the other at all. I suppose it could be argued either way. We know that few voters are undecided. We know that those who have already chosen are unlikely to be swayed.

    So what about these warnings? With the coming election, the war on terror, direct threat of attack from terror groups, etc., when else should we be more vigilant? If threat is not imminent now, then when is it? Vdibart thinks the President has to “convince” the public that threat is imminent- Since when? The war on terror could not possibly be won, ever, while notifying the public of every theory, every bit of intelligence, that some people demand. On the contrary, many are saying that they don’t want to know about the threat, so why tip our hand to the enemy? How ironic would it be, (may it never happen), for the doubters to be interrupted with an explosion?

    Many don’t like the alert system, but how has the Bush Administration failed? There have been no attacks in the U.S. post 9-11. Why throw dirt in the faces of the thousands of Americans working very hard every day and night to protect us? It’s not just the administration being criticized.

    In closing, I don’t know why any one would live in New York either. Maybe I’m just not a City person. My wife is going shopping there this weekend, although I asked her not to. I’m going to go fishing with some friends. To my knowledge, there have been no alerts for killer bass as of yet.

  9. American Cuban in Miami says:

    Ethnic profiling is profiling and profiling works. It’s amazing to hear people complain how this is political. If a bomb goes off at the Citibank building next week I guarantee that these people would be calling for an impeachment of Bush if not an outright Coup if this information had not been released.
    The ones politicizing this are those so desperate to retain some shred of power that they are willing once again to sacrifice American lives by downplaying the world war we are caught in with these Islamic Terrorists. With “Patriots” like these the terrorists have to only work 1/2 as hard.

  10. vdibart says:

    “Either way, the comments posted show clear misunderstanding of the war on terror.”

    Sounds familiar…where did I hear this almost exact wording before…Oh yea, Republican talking points.

    “Vdibart thinks the President has to “convince” the public that threat is imminent- Since when?”

    You show a clear misunderstanding of my post. I said that an “alert” should imply some imminent threat, otherwise we’re using the “Fox News Alert” trick, which displays 24/7 on their channel regardless of whether it’s “news” or something that I should be “alert”ed to. I deserve to know when I should be truly concerned and when they just want to stroke the CIA’s pride after getting bruised all summer, which I think is marginally more likely the explanation for these alerts than the political gain argument.

    “The war on terror could not possibly be won, ever, while notifying the public of every theory, every bit of intelligence, that some people demand”

    Exactly. And I believe this alert falls squarely into that category. This alert was for something that was not imminent, therefore its usefulness is questionable. Regarding the source of the information this alert was based on, if “old” doesn’t equate to “invalid”, then certainly “specific” and “credible” don’t equate to “likely” and “imminent”.

  11. Eric Akawie says:

    Announcing that we know of these plans, and that we are increasing security at these buildings even if the attack may or may not be imminent may not prevent any attack from happening, but it will likely cause AQ to abandon those specific plans. It announces that these buildings are no longer “soft targets” or at least not as soft as when the surveillance took place.

  12. vdibart says:

    Yes, but that assumes they had in fact continued plans on these targets. They likely have plans on dozens of targets, so I don’t think it unreasonable to asssume they abandon some of them from time to time, or put them on the shelf for a later date.

    So where does it get us? AQ plans attacks on other building/places, we desparately try to shore up security on anything that even hints at being a target while our budgets and security forces are thinned to the breaking point, and scaring the h*** out of the population to the point where they’re afraid to go to work. All to deter an attack that might not have been in the works?

    Granted, and this is a big concession, I don’t know what the solution is. But I have to think that our precious resources would have been better spent on something more pressing.

  13. LJD says:

    Republican talking points, Hmmm…. So they were correct in their assertion that the Left still doesn’t get it? We are in a war that was not, as some would believe, a war of choice. Some are still operating with a pre-9/11 attitude about this country’s security.

    Some want to know the minute detail; that which they cannot, or do not need to know, and do not have the capacity or willingness to understand. It is shameful, that such information would fuel criticism of those on the front lines, for political ends. We agree that this would also sacrifice critical information to the enemy. Perhaps only the terrorists themselves know for sure what their plans are… But I would rather err on the side of caution.

    Has it already been demonstrated that the recent alerts are not imminent in nature? Is it just political mudslinging from those dissatisfied with the impact of their National Convention? Has any one asked a terrorist if we were right?

    We may never know if an attack was averted because of our action. Every warning from the Department of homeland Security should be considered imminent. It bothers me that you don’t think so. Whether people choose to freak out about them or not is their own business. (Refer to my earlier comment about living in N.Y.)

    So, how about considering a hypothetical? What criticism will be made if we make it to January 1st, 2005 with no terror attack in the U.S.? First, does this sound feasible to any one? Second, will it be because there was no threat, or because the response is working?

  14. vdibart says:

    “Has it already been demonstrated that the recent alerts are not imminent in nature?”

    What proof has been presented that they are? What did Tom Ridge say that could be used to show that they are? How does it serve the purpose of the war on terror to issue alerts without any solid reason for doing so?

    Are you satisfied just that Tom Ridge says that the alerts are warranted? I am not, and don’t insult my intelligence by saying that I don’t have the capacity or willingness to understand anything. You’ll excuse me if I find it a little cynical that we live in a supposed free society where we are apparently not deserving of the information that threatens our way of life.

    You’ll also excuse me if I find it cynical to suppose that because I question the leaders that are trusted to secure my way of life that I am mudslinging. That, to me, is the American way.

  15. LJD says:

    What proof has been presented that they are (imminent threats)? To my previous point, no one but the terrorists know for sure. I believe we’re doing our best with what we have. Conspiracy theory aside, the proof is in the pudding, and Bill Cosby is nowhere to be found.

    How does it serve the purpose of the war on terror to issue alerts without any solid reason for doing so? “Without any solid reason” is your assumption, based on reports specifically designed to discredit the Administration in an election year. Absolutely nothing has been substantiated, ever, that a single alert was unwarranted.

    Sorry you are upset and feel your intelligence was insulted. I never singled out YOU. I only referred to “some people”. I made reference to “the Left” and “those dissatisfied”, both in the context of either a question, or comments made by others.

    Further, I did not say that YOU do not have the capacity or willingness to understand. I stated that SOME suffer from this problem. Regardless of how many attacks, how many WMDs are found, how much evidence turns up, SOME people will never get it. Their minds are made up no matter where the facts point. Pieces of information that do not fit their ideology are simply discarded. If you associate yourself with this group, then my comments apply to you, however, I never directed them towards you.

    “Supposed” free society? I believe ours is THE example of a free society for the word. I hope you agree. I do not equate a free society with knowing every bit of privileged information that our ELECTED officials are privy to. Yes, I feel the average person is not entitled to the information that threatens their way of life. The general public would not be responsible with such information. This is exactly why there are security clearances for this access.

    I never charged YOU with mudslinging for questioning our leaders. I asked the question-Could the response to the alerts could be considered mudslinging? But, way to go with the Democratic sound bite!

    It is truly ironic, that we can agree on many things and disagree on but a few. But, Oh what a few disagreements! Try to lighten up, we are very fortunate to live the “American Way” as you put it. We have a common enemy, whether we choose to accept it or not.

  16. vdibart says:

    All the rest being water under the bridge (I didn’t really think you were attacking me personally), here’s what I think the crux of the argument is (correct me if I’m wrong):

    You seem to believe that the words/actions of Ridge et. al. should be taken at face value and feel that the warnings are warranted until proven otherwise.

    I feel that I do deserve enough information to convince me that this specific threat was imminent enough to warrant me being scared to go to work in the morning. I’m not saying they don’t exist, I’m not saying I don’t believe them, I’m saying that they were not revealed and I have a right to know. It doesn’t have to violate national security, I don’t need to know *everything* that was found, but it has to be believable. How about this: “The documents indicate a desire to strike sometime during the presidential campaigns”. I’ll take that much. We haven’t even gotten that.

    And btw, I do consider myself on the Left, although I’m not sure why that should matter. This is a discussion about “life, liberty, and the pursuit of happiness.” We both believe in that, the difference is how we get there.

  17. Joseph Marshall says:

    Let’s assume for the moment that the measures we have taken have prevented an attack against the buildings we have surrounded. It’s not a bad assumption, though inherently unprovable.

    Now what? Do we keep them ringed with police indefinitely? Do we hire even more police to wrap up the next set of buildings while we still guard the first?

    And when we finally take the police away, will the intelligence Al Queda has collected be so out of date as to not be useful in re-targeting these buildings? Can we bank on their not having backed up the disks and given them to someone else?

    They put a bomb underneath the WTC back in the Clinton Administration, remember? Were we imaginative enough to defend it from attack later?

    From an analytical point of view what is most important is the principle that, from New York to Bagdhad, the successful attacks have always occured at the places we’re not seriously defending.

    This means that the model of “watch for all suspicious activity” cannot be realisticly entertained. Watch for every stray backpack or non-Nordic person using binoculars in the whole BosWash corridor? Or the entire country? Get serious.

    Even the most vigorous ethnic profiling has serious limits. The largest group of Muslims in my town are Somali, not Middle Eastern. And there’s even been a terrorist arrest among them recently. What do we do here? Scrutinise minutely every black face?

    The key issue in this sort of “homeland security” is what targets are so important we MUST protect them, because we cannot put a ring of police indefinitely around every potential target in the country.

    Those vital targets are the ones that should receive the New York Terror Police treatment we’ve been seeing.

    After that, the next issue is controlling entry. We have to work on the overseas cargo containers, the borders, and the passports.

    Finally, and in the long term this will be the equivalent of the nuclear submarine in strategic warfare, we have to render ALL non-cash transactions transparent to government scrutiny. Control the money flow and you control the terrorist product. Finacial “privacy” has to disappear. It’s that simple.

    But fat chance of it happening soon, and some of the people who will be least in favor of it are those in the buildings currently surrounded with police.