Often during the course of a terrorist planning cycle, an attack plot combines multiple activities. Misrepresentation and theft/loss/diversion are often seen in tandem and should be reported, regardless of whether or not you have knowledge of any other coordinated activity.
Outside North America, terrorists remain interested in impersonating first responders, including through the acquisition of authentic or fraudulent uniforms, equipment, vehicles and other items that may be associated with government, military, law enforcement and fire and emergency service personnel.
Terrorists could use this tactic here to conduct an attack, perform surveillance for target selection or conduct preoperational planning, as it can facilitate access to restricted or secure locations, including emergency scenes.
These items can be acquired through theft, counterfeit manufacture and local or online purchases. We’ve seen this many times with law enforcement and the military, but the fire and emergency service, or those posing as fire service or EMS personnel, possess a less-defensive posture when on service calls. This could lead to less scrutiny on the scene of an incident, and thus, better access for an attack.
Example of Misrepresentation of Fire Personnel
Subject Unaffiliated with Fire/EMS Department Seen Wearing Official Uniform: In November 2014, a Fairfax County (Va.) police officer observed a male subject wearing a Prince George’s County Fire/EMS Department turnout coat. The subject said he was previously employed with the Prince George’s County (Md.) Fire/EMS department as a firefighter, but resigned when he sustained injuries to his neck.
He added that he was permitted by the department to retain possession of the turnout coat. However, the subject’s girlfriend advised that he purchased the turnout coat from an unidentified firefighter for $200.
The police officer contacted Prince George’s County and was told that the subject was never employed with the department, either as a paid or volunteer firefighter. Prince George’s also indicated that its policy is to never provide turnout coats to individuals unaffiliated with the department.
Indicators: Observed behavior reasonably indicative of preoperational planning associated with terrorism or other criminal activity includes:
- Theft of first-responder uniforms, credentials, equipment and vehicles
- Use of vehicles, uniforms or equipment inconsistent with those in service within a particular jurisdiction
- Visible identifiers, such as phone numbers, license plates or call numbers that are inconsistent with an operating area or mission
- Interest in or attempted purchase of authentic service uniforms and equipment
- Vehicles or equipment that appears to be in a poor mechanical or cosmetic state or appear to be loaded beyond capacity
- Elicitation or probing questions regarding response practices, personnel or standard emergency-response procedures and guidelines
Terrorists and HVEs may seek to obtain from first responders, through theft or purchase, uniforms, badges and credentials to further their attack planning. With access to specialized clothing and equipment, nefarious actors could increase their accessibility to emergency scenes or secured areas with little or no resistance.
Attempts to acquire these items should be reported immediately, along with information about any items stolen or lost. Additionally, effectively reporting and sharing information about such loss and thefts may help mitigate this tactic and strengthen first-responder safety and awareness.