In 2000, the British police found a handbook in a Manchester home during raid on an al Qaeda (AQ) member. The main mission outlined in the book was the overthrow of godless regimes. The number one task listed is the gathering of information about the enemy. Businesses and organizations must be increasingly cognizant of potential hostile surveillance activity conducted to further the ends of terrorist organizations such as Al Qaeda.
Hostile Surveillance Targets
Hostile actors aim to obtain the following information to determine potential areas of
exploitation:
- Building access area, egress points, or vulnerabilities
- Security protocols or equipment
- Pedestrian and vehicular traffic and spikes in activity
- Employee work schedules, breaks and lunches, visitor check-ins, and supply deliveries
Hostile Surveillance Detection
In order to detect this type of surveillance activity, be on the lookout for:
- Suspicious persons out of place
- Photography or video recording not tourist in nature
- Binoculars
- Note taking, drawing diagrams
- Writing on or drawing maps
- Elicitation
- Probing, tests of security
Suspicious Persons & Photography
Situational awareness in the work environment allows employees to be able to identify persons out of place. Characteristics that may be noted could be:
- Nervousness and fidgeting
- Unfamiliarity with the area or building, looking around with no sense of purpose
- Lingering too long at a café, sitting beyond the time of a typical work break or lunch hour
- Someone situated at a bus stop and not boarding any of the buses
- Suspicious photography which appears clandestine or not aimed at typical tourist subjects, for example, capturing doorways or security measures like guards or bollards.
Drawings and Maps
The AQ manual included directions for members on how to collect information through diagrams. Drawing maps or pathways, pacing areas, counting steps and making notations may be indications of an illicit collection.
“The Drawing: The brother should draw a diagram of the area, the street, and the location which is the target of the information gathering. He should describe its shape and characteristics. The drawing should be realistic so that someone who never saw the location could visualize it. It is preferable to also put on the drawing the directions of traffic, police stations, and security centers.”
Elicitation & Probing
Probing is done to test existing security measures, possibly by leaving an abandoned package or bicycle to measure the time it takes for security to notice and react. Hostile actors will then observe the security protocols in action.
Elicitation is countered by the old adage “Loose Lips Sink Ships.” Everyone, from security staff to civilian personnel, should understand operational security (known as OPSEC). Anyone questioning security personnel or employees on security measures in place should be reported. Additional information that may be gathered through elicitation includes times of operation and even times when areas are busy with pedestrians, deliveries or vehicular traffic.
Suspicious Activities Reporting
Method
There should be a clear method for all employees to report suspicious activity. All personnel should know how and whom to notify of incidents.
Anonymous
Personnel should know that they can make a report anonymously. This will prompt those who are unsure of what they may have observed, or possibly those who have seen an insider threat involving a coworker.