According to the National Fire Incident Reporting Systems, fire departments across the country are being dispatched on more than 30 million emergency requests for service a year. This doesn't include other public contact, such as fire inspections, fire or code complaint investigations, home safety checks, special events, welfare checks and EMS calls from non-fire based agencies.
What are fire service members seeing in the course of their routine duties that could be of value to the intelligence community? Are firefighters, paramedics and EMTs provided with the knowledge and training to recognize situations that appear outside the realm of normal?
Does your department have a policy or process to report suspicious activity that ensures notification to local law enforcement? Most importantly, are your front-line personnel familiar with it?
The landscape of the fire service is constantly evolving, and we must adapt and expand with this changing environment. Like it or not, terrorism has reached the fire department beyond just response, and it impacts our daily duties. Terms like improvised explosive device, weapon of mass destruction and secondary attack have become part of our vernacular.
Our personnel are uniquely positioned in our communities and are a critical component of homeland security with the ability to recognize and disrupt potential attack plots, but they must be paying attention, recognize the significance of what they're seeing and have the knowledge to equate that to a possible terrorism nexus.
It's time to add terms like precursor materials, preoperational surveillance, acquisition and storage and elicitation to the fire service's common language.
The IAFC's committee on Terrorism and Homeland Security (THS) is following up on material presented at the Fire-Rescue International in August 2014 by providing Suspicious Activity Reporting (SAR)-specific information each month in IAFC On Scene, highlighting one aspect of the Nationwide SAR Initiative. When combined with the knowledge of the attack-planning cycle, these indicators can promote increased situational awareness for recognizing and reporting suspicious activities while protecting the rights of our community's residents.
It's a fact that certain kinds of activities can indicate terrorist plans in the works, especially when they occur at or near high-profile sites or places where large numbers of people gather—government buildings, military facilities, utilities, bus or train stations and major public events.
Suspicious activities, like those listed below, may occur in several stages of plot development. The IAFC's THS Committee will highlight one criterion each month and provide case studies from departments across the country to emphasize the importance of reporting situations encountered during your regular duties that appear out of the norm.
Potential Activities that May Indicate Nefarious Intentions
- Breach/Attempted Intrusion: Unauthorized personnel attempting to or actually entering a restricted area or protected site. Impersonation of authorized personnel (such as police or security, janitor)
- Misrepresentation: Presenting false or misusing insignia, documents or identification to misrepresent one's affiliation to cover possible illicit activity or gain access to sensitive areas.
- Theft/Loss/Diversion: Stealing or diverting something associated with a facility or infrastructure, such as badges, uniforms, identification, emergency vehicles, technology or documents—classified or unclassified—that are proprietary to the facility.
- Sabotage/Tampering/Vandalism: Damaging, manipulating or defacing part of a facility or infrastructure or a protected site.
- Cyber Attack: Compromising, attempting to compromise or disrupting an organization's IT infrastructure.
- Spoken or Written Threat: Communicating a spoken or written threat to damage or compromise a facility or infrastructure.
- Eliciting Information: Questioning individuals at a level beyond mere curiosity about particular facets of a building's or facility's purpose, operations, security procedures, etc., that would arouse suspicion in a reasonable person.
- Testing or Probing of Security: Deliberate interactions with or challenges to installations, personnel or systems that reveal physical, personnel or cyber-security capabilities.
- Photography: Taking pictures or video of facilities, buildings or infrastructure in a manner that would arouse suspicion in a reasonable person. Examples include taking pictures or video of infrequently used access points, personnel performing security functions (patrols, badge- or vehicle-checking), security-related equipment (perimeter fencing, security cameras), etc.
- Observation/Surveillance: Demonstrating unusual interest in facilities, buildings or infrastructure beyond mere casual or professional (e.g., engineers) interest that a reasonable person would consider suspicious. Examples include observation through binoculars, taking notes, attempting to measure distances, etc.
- Materials Acquisition/Storage: Acquisition or storage of unusual quantities of materials, such as cell phones, pagers, fuel, chemicals, toxic materials and timers, such that a reasonable person would suspect possible criminal or terrorist activity.
- Acquisition of Expertise: Attempts to obtain or conduct training in security concepts, military weapons or tactics, or other unusual capabilities that would arouse suspicion in a reasonable person.
- Weapons Discovery: Discovery of unusual amounts of weapons or explosives that would arouse suspicion in a reasonable person.
- Sector-Specific Incident: Actions associated with a characteristic of unique concern to specific sectors (such as the public health sector), with regard to their personnel, facilities, systems or functions.
Note: These activities are generally First Amendment-protected activities and shouldn't be reported in a SAR or Information Sharing Environment-SAR, absent articulable facts and circumstances that support the source agency's suspicion that the behavior observed isn't innocent, but reasonably indicative of criminal activity associated with terrorism, including evidence of preoperational planning related to terrorism. Race, ethnicity, national origin and religious affiliation should not be considered as factors that create suspicion, though these factors may be used as specific suspect descriptions.