A critical evaluation of the risk indicators of criminal conduct involving CBRN and explosive materials
(Behavioural and observational analysis in crime detection and investigation)

INTRODUCTORY EXPLANATIONS

CBRN, as well as explosive materials, pose a serious risk to the health of the population, the environment, the economy and the state establishment if they are misused (Benolli, et al., 2021). The theory of terrorism and behavior plays an important role in this research. It is clear there are different aspects influencing the motives and behaviour of terrorists in the terrorist act planning and implementation (Leistedt, 2013). It is also confirmed by Nance (2014). Different criminology theories also help in understanding terrorist behavior, which will also be interesting to investigate in terms of CBRN and explosive crime (Freilich and LaFree 2015). Therefore, the detection of risk indicators of criminal behaviour is an important element in the prevention of planned crime or imminent terrorist attacks, for example when crossing borders or initiating a terrorist act in any public place or critical infrastructure (CPNI, 2020). Law enforcement agencies use their own techniques to detect the potential radicalisation signs or behaviour that from the norm indicating a potential malicious act against the people or infrastructure. However, according to a preliminary review of the literature and internal procedures of several police agencies, the need to cover the CBRN and explosive crime risk indicators more precisely is evident.

According to the literature review, there is a gap in the above field, as there is no publicly available analysis of risk indicators detection methods in practical use by law enforcement agencies.  Another shortcoming is the lack of a list of verified risk indicators that could be regularly updated which would help prevent terrorist attacks or other crimes involving CBRN and explosive materials in a limited edition (not accessible to the public). The research will investigate the risk indicators related to planning a terrorist act using CBRN and explosive material and risk indicators related to suspicious behavior, appearance and use of suspicious items closely before the terrorist attack. 

The benefit of this research will consist in obtaining information on the use of behavioural and observational analysis in the detection of CBRN and explosive crime and in creating a list of possible risk indicators, which will then be verified by practitioners from law enforcement agencies. It will therefore be important to analyse the existing results of the survey on a selected sample of LEAs officers and fill the current gaps.

For more information about the objectives, methodology, risks and benefits for participants, please refer to the participant information sheet (annex 1). 

Note: If you feel some question in the questionnaire is sensitive to answer, leave them unanswered. 

Participation in this survey is anonymous!
Please don’t share the content of this questionnaire publicly. The provided information is sensitive.

Please read all sections and fill in the sections starting with N. 3 and ending with N.7. 

Contact:   [email protected]

1. INTRODUCTION TO PROFILING IN PROTECTIVE SECURITY AND COVERT OPERATIONS (PROPESCO)

According to our experience, when using profiling techniques in practice, and the study of previous real cases, it is impossible to state with certainty that they are one hundred percent efficient in detecting criminal conduct. Some of the indicators or warning signs are not detectable/observable or less detectable/observable, and many depend on other indicators. Likewise, a large number of limiting factors play a role in the detection of risk indicators. It primarily concerns observing and interpreting the observed behavior, communication, and activities of individuals, their appearance and the items they use. However, profiling in protective security and covert operations can be an important tool to detect risk indicators and therefore to stop potential criminal activity. Additionally, the use of technological support in the detection of CBRN and explosive material and related behavior is indispensable.   Since observation as a part of profiling takes place on several levels – through CCTV, first-line officers and second-line officers, it is vital to be aware of all the shortcomings that may arise during this activity and all external and internal factors influencing the observers, i.e. individual subjective judgment and bias.

A wide variety of criminals pass through border crossing points or perform their criminal activities in different places. They primarily include terrorists, smugglers of drugs, dual use and CBRN-E materials, weapons, animals and plants protected by CITES, art objects and artefacts, human traffickers and others.

Each of the mentioned groups can represent specific risk indicators related to their illegal activity, which can be detected. At the same time, however, each individual from these criminal groups may exhibit a different type of behavior due to individual characteristics, personality type, and experience in criminal activity and criminal behavior training.

In ProPeSCO it is crucial to consider the so-called risk indicators and baseline. At the same time, it is obligatory not to use racial profiling, but the approach to avoid discrimination. 

BASELINE CONCEPT 

In the first phase of this research, we studied the baseline concept of the places where terrorist or other criminal acts were conducted and in certain cases the individual or people’s behavior. As a result, the baseline can be characterized as a certain social, infrastructural, economic, climatic, cultural and religious norm generally used and accepted in a given place, in a given country, region or continent. At the same time, we have to take into account the dynamics of processes in a given situation, in a given space and time and the individual natural behavior of a person or a group of persons or a specific contextual assessment of certain items/objects associated with suspects.

RISK INDICATORS´ CONCEPT 

Everything that is out of the above baseline can be considered a risk anomaly or deviation from the norm, natural behaviour or context. When detecting risk indicators, it is important to consider excessiveness and the repetitive manifestation of risk indicators. At the same time, it is necessary to consider that a single risk indicator may not represent suspicious or criminal behavior. Many of the listed risk indicators can represent a person’s normal behaviour due to some stress, illnesses or other individual factors if they are not associated with other detected risk indicators.

In the analyzed criminal acts within this research, it was always a combination of risk indicators that make up a mosaic of observed deviations from the baseline. Some of the indicators may contain discriminatory elements from the first point of view, however, they must be considered in the frame of above mentioned “mosaic” when performing non-discriminatory and non-racist profiling – observation and interpretation of risk indicators. 

The risk indicator is a separate attribute or set of features of behavior, position, physiological manifestations, appearance and related context, use of certain items/objects, indicating a deviation from an existing norm in a given time and space, taking into account the dynamics of processes. It also includes various other elements of suspicious travel, modus operandi and movement to specific places. 

2. IDENTIFIED CATEGORIES AND RISK INDICATORS OF THE CRIME INVOLVING CBRN AND EXPLOSIVE MATERIAL

Based on the literature and previous case studies review – police files, e.g. investigation reports, house searches reports, field missions – operations and arrestation of terrorists before the commitment of planned crime, court decisions, and CCTVs records, we have identified the following categories of risk indicators and individual risk indicators of the crime involving CBRN and explosive material. They represent the behavior of individuals, and groups of people, specific modus operandi, their risk appearance, the transportation and use of certain tools, etc. 

The cases like USA 9/11 attacks (2001), the London bombing (2005), Mumbai multiple attacks (2008), the attack on the flight from Amsterdam to Detroit (2009), the Breivik bombing and shooting in Norway (2011), Stade de France attack in Paris (2015), Brussels Airport, Metro (2016) and Brussels Central Station attacks (2017), the Manchester Arena attack (2017), the Sri-Lanka bombing (2019), the Tbilisi airport Yperite attack (2018), the Hydrogen Sulphide terrorist plot in Australia (2017), London Parsons Green station attack (2017), Radioactive letters case in Slovakia (2016), Dimethylmercury and Abrin criminal act in Czech republic (2018), a Chlorine bomb attack in a Shopping mall Alam Sutera, Tangerand in Indonesia (2015), Thorium oxide plot in Indonesia (2017),  Abrin terrorist plot in Indonesia (2019),  Kuala Lumpur VX attack (2017), Scripal poisoning in Salisbury (2018)  and other similar criminal acts were deeply studied and a wide range of indicators have been identified. They are related to different phases of terrorist or other criminal acts, namely the planning phase – surveillance; travelling and transportation of goods; the imminent phase before the criminal act or during the criminal act. 

Please read risk indicators carefully and provide your professional technical opinion by answering the respective questions under sections 4 – 6. Many identified risk indicators can also be seen in relation to other criminal activities and not only in connection to a crime involving CBRN and explosive materials. This list represents only a sample of the most important indicators. Because of the sensitivity of provided information, the risk indicators are adapted and not fully specified. 

We really appreciate your valuable opinion as your high level of expertise can be very helpful in achieving the results of this study. 

1. Appearance and physiological reactions 

  • Risk indicator 1.1 Body parts that raise the suspicion – intention to hide something or as a part of a ritual or sign of affiliation to a group
    • Unnatural hair on the head
    • Beard untidy, unusually long, in a form representing affiliation to some gangs
    • Beard or head freshly shaved off  
    • Artificial skin colouring attempts to disguise/change the ‘normal’ appearance of the skin, possibly including disguising ethnicity 
    • Nails – dirty/broken/painted/removed/stained, etc.
  • Risk indicator 1.2 Tattoos and other symbols – neo-nazist or ISIS tattoos, CBRN hazard tattoos, etc. 
  • Risk indicator 1.3 Wounds, injuries, amputations, battle or martial arts signs, combat fatigue, loss of vision and hearing etc.
  • Risk indicator 1.4 Body mutilation or modification – cosmetic surgery to some extreme forms of body modification representing affiliation to a specific group, beliefs or a ritual before an attack
  • Risk indicator 1.5 Signs of health problems caused by CBRN agents after contamination or exposure when manipulating them 
    • Visual skin irritation, rashes, blisters, tingling and Itchiness, skin redness (erythema)
    • Swelling caused by a build-up of fluid (edema)
    • Manifestation of symptoms like being disoriented and sick 
    • Nausea, vomiting 
    • Runny nose and coughing, 
    • Tightness in the chest, respiratory distress
    • Small, pinpoint pupils, eye pain, watery eyes
    • Drooling and excessive sweating, drowsiness, increased urination
    • Fatigue and weakness, fever
    • Unconsciousness, coma, etc.
  • Risk indicator 1.6 Other physiological reactions 
    • Sweating
    • Increased heart rate and deep breathing
    • Yawning
    • The release of adrenaline by specific body movements
    • Twinkling/eye blinking 
    • Fidgeting
    • Post-traumatic stress symptoms
    • Different drug use effects, like red eyes, dry mouth, euphoric behavior, increased energy, decreased coordination, extreme anxiety or agitation, violent behavior, hallucination, problem speaking, etc.
  • Risk indicator 1.7 Clothes/dressing in the actual weather, local, religious and cultural context and representing a specific group
    • Clothes with specific signs and symbols of certain gangs, terrorist or criminal groups (neo-Nazis, ISIS, etc.)
    • Winter jacket worn in the summertime, e.g., to hide the explosive vest 
    • Inappropriate dresses comparing the context/baseline 
    • Burn parts of a dress  
    • Military, police or similar uniforms 

2. Body, items or substances smell

  • Risk indicator 2.1 Body smell due to poor hygiene or sudden change of the body smell 
  • Risk indicator 2.2 Items smell after being a long time closed in unventilated premises 
  • Risk indicator 2.3 Parfum containing non-alcoholic oil used in a specific context
  • Risk indicators 2.4 Items, clothes and substances smell related to explosives – chemical precursors. Smell of 
    • Sweet, sweet burning
    • Ammonia or urine-like odor
    • Motor-oil odor, 
    • Fruity like acetone or vinegar smell
    • Faint nitrogen scent
    • Acrid smell, marzipan and almond 
  • Risk indicator 2.5 Objects, clothes and substances smell related to warfare or toxic industrial chemical agents. Smell of 
    • Rotten egg
    • Bleach 
    • Strong suffocating odor like formaldehyde 
    • Bitter almonds, mustard, garlic, onions, horseradish
    • Sweet smell of newly mown hay or grass 
    • Pungent odor like – ex. ammonia or geranium 
    • Mild or sweet odor like benzene 
    • Camphor mothballs
    • Fish
    • Soap
    • Flowers   

3. Items, documents, objects and other belongings detected on the person (radicalisation or criminal activity signs)

  • Risk indicator 3.1 Travel bags, suitcases, boxes and other related items 
    • Visible trigger, safety switch or nozzle spray, wires, 
    • The big backpack is visually out of the baseline – clearly indicating there is a canister or metal box inside because the fabric is not creased, etc.
    • Burn parts of a baggage  
  • Risk indicator 3.2 Body accessories – glasses, earrings, rings, jewellery, caps, etc.
    • Way of wearing watches, rings
    • Visible symbols representing certain terrorist or radicalised groups
    • Hidden camera for surveillance
    • Watches containing a gamma detector, etc.
  • Risk indicator 3.3 Belongings 
    • Exceeding amount of money when passing the border
    • Prepaid cards or SIM cards
    • Various objects or documents representing radicalisation, terrorist act preparation or belonging to certain groups – mugs, badges, books, ISIS marriage documents, CBRN training certificates, military type of pocket litter, information on the creation of bombs and CBRN weapons, etc.
    • Burn marks on objects
  • Risk indicator 3.4 CBRN threat objects and items found on a person, in their luggage or car
    • Personal protective equipment – suit, gas masks, respirators, gloves, boots, cartridges
    • Laboratory equipment – glassware, tubes, pipets, syringes, buffers, infusion hose, etc.
    • Decontamination substances, disinfectants, wipes
    • Detectors, dosimeters and sampling tools
    • Dual use materials without transportation licence
    • CBRN substances in a hidden form – jewellery, simulated medicines
    • Having a plastic bag with the suspicious powder without any official cover or box
    • Specially adapted pen as vaporiser/electronic cigarette/perfume spray containing CBRN agents etc.
  • Risk indicator 3.5 IED, gun, military objects and other dangerous objects 
    • Batteries, wires, etc.
    • 3D printed weapons
    • Bulletproof vests
    • Night vision goggles
    • Drink can be adapted to carry small explosives 
  • Risk indicator 3.6 Information and communication technologies – electronic devices 
    • Solar chargers
    • Several mobile phones
    • Highly encrypted notebooks
    • GPS and other navigation systems, etc.
  • Risk indicator 3.7 Objects from illegal trafficking like artefacts, CITES species, drugs, etc.  
  • Risk indicator 3.8 Pills, medicines, drugs, first aid kit, etc. 
    • Inappropriate amount of pills in the luggage and no medical report or prescription
    • Having plastic bags in the luggage (during the screening) with several small bottles/ampules with the same mark for the same purposes (mouthwash, nose drops, creams, etc. – 100 ml per each) or several small bottles for different purposes not fitting to the context 
    • Medicines and antidotes against CBRN agents present in the luggage 
  • Risk indicators 3.9 Travel and personal documents 
    • Counterfeited, torn-up, burnt or damaged travel documents or documents not corresponding with the face of the traveller
    • Emergency travel documents
    • New documents issued in war or risk country
    • Car, hotel or flight bookings in another name, etc.

4. Digital indicators 

  • Risk indicators 4.1 Applications detected by covert operational activities in phones, computers and other electronic devices utilised often by criminal groups to cover their activities 
    • Chats, social media, e.g. affiliation to radicalised groups 
    • Games – virtual simulation of an attack 
    • Anonymous browsers like TOR – Darknet
    • Encryption technology and VPN
    • Unusual applications for financial transactions, cryptocurrency applications  
  • Risk indicator 4.2 Application or browser searches detected by operational covert activities 
    • On the description of the health effects of CBRN agents
    • Information on protection from the CBRN agent’s effects, calculation of lethal radiation doses
    • Facts sheets on chemical agents and precursors for explosives
    • Production of CBRN agents and explosive improvised devices etc.
  • Risk indicator 4.3 Videos containing terrorist propaganda and information on CBRN and explosive materials

5. Behavior and communication

  • Risk indicator 5.1 Travel arrangement -the way of booking the travel and hotel, means of payment, destinations – risk countries, sudden change of destination, etc.
    • The way of booking the travel and hotel
    • Means of payment
    • Destinations – risk countries, sudden change of destination, etc.
  • Risk indicators 5.2 General travel and transportation behavior 
    • Arriving at the airport the day before departure
    • Travelling with a small handbag on a long-distance flight
    • Walking from one to another place, a specific way of border crossing in a group/separately
    • Travelling with several passports – dual citizenship, e.g., EU and non-EU 
    • Having only a few clothes in the luggage but travelling for a long time
    • Having different objects in the luggage indicating previous travel to other destinations not logically connected to the next one
    • Using the same hotel when travelling several times (only in case of unskilled criminals)
    • Traveling with a ticket for a football match between two national teams of country A but having the citizenship of country B and having nothing in common with country A (no working, no language skills, etc.) 
    • Traveling with a ticket for a theatre performance in a country where they speak a different language like a traveller can speak and the performance is in the language of the country 
    • Traveling to close destinations via other long-distance countries – suspicious route
    • Not cooperating during the screening at the border, e.g., not answering all questions related to their travel 
    • Not having the knowledge of carried/purchased items 
  • Risk indicator 5.3 CBRN and explosive threat-related behavior before the attack 
    • 5.3.1 Target Place and CBRN agent selection 
      • Collecting information by observing the place – reconnaissance of the target place 
      • Questioning people and trying to obtain information 
      • Searching on the Internet and other sources for the health effects of CBRN agents, characteristics, way of dissemination, ease of acquisition, etc. 
    • 5.3.2 Looking for and contacting experts in the CBRN field
    • 5.3.3 Procuring, developing or attempting to acquire CBRN and explosive material, e.g., buying legally or illegally, taking from nature or from illegally dumped waste stealing from specific premises, transportation vehicles, storages, industrial and medical facilities, laboratories, landfill for hazardous waste or production of CBRN and explosive material: 
      • Precursors needed to develop explosives, e.g., fertiliser, acetone, peroxide, and sulphuric acid in excessive quantity
      • Raw material, e.g., radioactive material – Americium 241 in old fire/smoke alarms or developed CBRN agents
      • Simulants needed for testing purposes 
      • Chemicals needed for the neutralisation process in case of accidental dispersion of a CBRN agent in the production, weaponization and testing phase
      • Chemicals for decontamination of places, tools and terrorist group members 
      • Antidots for treatment to prevent the effects of contamination during the production, weaponization, testing and attack phase 
      • Material extracted dual-use equipment once found lost or stolen 
    • 5.3.4 Procuring, developing or attempt to acquire laboratory items, weaponization tools, storage items, transportation and delivery/dispersion mechanism
      • Items needed to build CBRN dispersion/delivery devices 
      • Items and devices needed to build an improvised laboratory, e.g., eggs incubator, glassware, etc.
      • Items needed to build improvised explosive devices
      • Items needed to develop CBRN agents 
      • Items needed to weaponize CBRN material, e.g., grinder, glassware, filters, strainer, certain chemicals like acids, etc 
      • Items needed for the storage of CBRN agents, e.g., explosion-proof and anti-flammable material refrigerators, classic refrigerator, ultra-low freezer, or even in cryogenic conditions, etc
      • Items and devices needed for the transportation of CBRN agents, e.g. shielding containers for radioactive sources, refrigerators in the vehicles to maintain the biological or chemical agents stable and functional, etc.
      • Detection devices
      • Personal protective equipment 
    • 5.3.5 Weaponizing CBRN Material
      • Cutting or adapting to needed size (particles, …), 
      • Working to needed form (aerosol, powder), odour and colour (chemical processing), etc. 
      • Adding additives to increase the flow of particles  
      • Introducing into a delivery device 
      • Attaching to IED if an explosive device is used
    • 5.3.6 Behavior Related to Training
      • Visiting known terrorist training camps
      • Testing of the weaponized system            
      • Dry run at the target place or a similar place to a target
      • Interaction with staff of a target place
      • Testing the security system and procedures before the attack e.g., putting in or taking the objects out of the pocket
  • Risk indicator 5.4 CBRN and explosive threat-related behavior close to or at the beginning of the attack (transportation and use of CBRN-E material), during or after performing criminal act 
    • Putting on a uniform/accessory for working in target place
    • Sticking some suspicious objects under the seats in the metro, bus, train, and aeroplane (potential radioactive sources/pellets)
    • Monitoring the time or radiation level on a watch/gamma detector 
    • Repetitively checking inside a backpack
    • Passing a backpack or other carrying tool to another person in a suspicious way
    • Leaving a backpack and box (a hidden remote-control mechanism) or opened bottle in a public space 
    • Ignition of a suspicious object, chemical 
    • Carrying a CBRN hazard in the plastic bag, bottle, or box in a suspicious way (trying to avoid touching other parts of the body – a bit away from their body)
    • Opening a backpack with a delivery system (different types of backpacks: routine one without any possibility to visually detect the inside threat or adapted one with visible outgoing spraying tube)
    • Opening a box or bottle with liquid in a way raising suspicion (visible outgoing spraying tube)
    • Holding a remote control in the hand or trigger switch connected by wires with the backpack or other carrying tool
    • Starting to spray liquid/aerosol from the bottle (e.g. perfume flacon), vaporiser/pen to people or to certain places (e.g. door handles, handrail, toilet papers in a public toilet, etc.)
    • Suspicious manipulation of devices regulating chlorine in public swimming pool facility 
    • Taking out a gas mask or protective gloves from a bag
    • Putting a cap or hood on head
    • Piercing or shooting balloons filled with CBRN agents
    • Coughing on other people in a suspicious way
    • Running from a place where suspicious items were left
    • Running into a building
    • Small crystals dropping down from the clothes – sweater (potentially some crystallised hazardous chemicals to be transported through security screening and used at the airport or in the plane after mixing with water or other substances
    • Manipulating with a sanitizer at public places, soft targets, hotels, etc. (opening, putting or spilling there some substances) or replacing it with another one/similar one
    • Manipulating liquids in 5D cinema (artificial rain, snow) or with smoke/fog machines in disco places 
    • Suspicious activity around a floor scrubbing machine using liquids without authorisation
    • Suspicious activity around an air humidifier, e.g., in a flower shop 
    • Replacing perfume testers in the shop with similar flacons filled by CBRN agents 
    • Monitoring the time on a watch after the covert release of hazardous substances
    • Emptying the contents of the salt and pepper casters in a restaurant and filling them with other content (CB material) or replacing similar spice or salt casters with CB material 
    • Spilling or spraying a liquid into a salad bar or adding a toxic powder in to spice present at the salad bar
    • Using preventive medicine before manipulating CBRN materials or antidotes after manipulation
    • Leaving pillboxes, syringes and ampules with preventive medicines and antidotes in some places after taking them
    • Repetitive walking and seating e.g., in the airport hall to observe the airport or targeted place live 
    • Carrying a heavy backpack/tired/difficulty walking/leaning forward
    • Seating at the bus/subway station with the backpack on the back without taking it off because of wires connected between the trigger under the jacket and explosives in the backpack
    • Avoiding talking to people when seating at the train station
    • Changing the subway stations several times and seating places
    • Coming to the target place and leaving it to come back later
    • Hesitation when approaching a target
    • Specific behavior in the lift (watching the camera or doing a check for explosive items when a hidden camera is not detected)
    • Religious or other suspicious rituals at the places where it isn’t supposed to be performed or in a suspicious context, e.g., praying, putting oil on the body, cleaning some parts of the body, 
    • Checking the wires under the jacket, etc.
    • Suspiciously watching the CCTVs – avoiding eye contact
    • Observing other people close by to check if somebody is monitoring them or not
    • Using shorts with big pockets to hide CBRN material in a box or small bottle
    • Pouring a liquid on a  table 
    • Chaotic coming into toilets or leaving them (thrilled, partly dressed)
    • Going to toilets before and after the attack (to check the place to hide items before the attack, to leave items/CBRN remaining agents after the attack and/or to wash hands) 
    • Spending a long time in toilets 
    • Using scales to weigh himself (scale for luggage – illogical behaviour, sometimes it can happen, but it is an indicator of clearing suspicion) 
    • Splitting into groups in case of several attackers
    • Running from the airport 
    • Changing clothes (different for the attack compared to the reconnaissance and the after-attack time)
    • After attack observation
    • Questioning people and trying to obtain information after the attack 
  • Risk indicator 5.5 Vehicle driving-parking-related behavior
    • Driving a car fast in an area where it is not expected or allowed
    • Driving a car slowly alongside the sidewalk full of people where it is not expected
    • Vehicle is freshly painted or multiple painted brand marks are not consistent with the place of driving/parking
    • Parking a car in an area where usually cars don’t park in relation to time and a specific infrastructural context
    • Parking a truck in the area where usually trucks don’t park in relation to time and a specific infrastructural context
    • Sitting in a vehicle close to a specific place for an extended period of time and observing the environment – potential reconnaissance of the target
    • Driving a van in which pressurised gas cylinders are present (toxic gas)
    • Driver´s uniform is inconsistent with a company name on a vehicle or the uniform is not worn 
    • Vehicles seem overloaded 
    • Vehicle models and marks do not fit the context of delivery 
  • Risk indicator 5.6 UAV – unmanned aerial vehicles, UGV – unmanned ground vehicles and UWV – unmanned water vehicles, etc. using related behavior
    • Navigate the drone/robot, flying/driving over a place and spraying some hazardous substance 
    • Using remote control vehicles to observe the places or persons 
  • Risk indicator 5.7 Infrastructure related-behaviour 
    • Visual monitoring of the presence of CCTVs 
    • Using specific gear of military equipment needed for observation, e.g., binoculars
    • Installing and using hidden cameras or listening device
    • Repeated observation of places and routine running of systems 
    • Remaining in a specific place for an extended period of time (public transportation buildings, public squares, etc.)
    • Fake access badge used to enter some facilities or changing a badge with another person
    • Seeking for another access to a building in a restricted area 
    • Attempt to access a restricted area
    • Remaining in a place close to specific infrastructure for an extended period of time and speaking to other persons face to face or by phone or making notes
    • Taking pictures or recording video of the infrastructure in a suspicious way or personnel working in the facility 
    • Testing of security measures related to infrastructure 
    • Pretending reparation works – approaching the reparation team 
    • Trying to obtain the official uniforms or clothes or vehicles of a targeted facility 
    • Suspicious activity around the air-conditioning system 
    • Renting premises
    • Permanent changes of residents in rented apartments/premises or their long-term absence
    • Using abandoned industrial, health care facilities, residential buildings or old laboratories
    • Using a permanent residential house (lone wolf) 
    • Rebuilding some parts of infrastructure including air-conditioning or ventilation systems 
    • Fire in an abandoned building and people running out
    • Using malware or other cyber activities to monitor the security systems of relevant infrastructures or people
  • Risk indicator 5.7 Non-verbal cues 
    • Gestures, postures, haptics, proxemics, mimics, and facial expression cues out of the individual and contextual baseline, e.g. expressing the increase of fear or hostility, movements indicating carrying weapons
    • Martial art movements 
    • Specific sign language – hidden communication 
  • Risk indicator 5.8 Paralinguistic cues  
    • Tone, pitch, speed of the voice, break in speaking
  • Risk indicators 5.9 Verbal cues and written text
    • The content of the speech including deception during questioning/interview, e.g., the way of answering the questions, baseline story and critical storytelling, inconsistency in response  
    • indicators versus non-verbal – incongruence
  • Risk indicators 5.10 Affiliation to groups through specific approach – behavioural radicalisation sign 
    • Salutation with an intention to send the message to other people representing affiliation to a group, e.g., Hitler’s salutation
    • Using certain tools or items to support an ideology during a public event
  • Risk indicators 5.11 Communication and interaction with other people – using symbols/putting them on buildings, infrastructure or various objects
    • Rapid change in behavior when a person is approaching or asking questions
    • Criminals may attempt to artificially connect and communicate with other passengers while travelling to conceal an existing relationship and interaction or to pretend to be a part of a group
    • Radicalisation signs (if other indicators have been observed): misprising of authorities, temper, disrespectful attitude towards others
    • Avoiding eye contact when passing the security screening
    • Hiding behind other people when observing the surroundings
    • Being on guard for potential monitoring or any danger, feeling depressed and suddenly being panic-stricken, 
    • Using radio for communication with others in a suspicious way

6. Sound

  • Risk indicators 6.1 Suspicious or abnormal sounds of explosive devices 
    • Ticking or hissing sounds in a package, box, or backpack, may indicate the presence of an explosive device etc. 
    • Sound of nails or other metallic objects clattering on some glass bottle, lighter ignition, etc.
    • Walking/shoes on certain surfaces if some explosive is hidden inside
    • Popping noise
    • Detonation
  • Risk indicators 6.2 Suspicious or abnormal sounds of CBRN dispersal devices
    • Sound of bubbles, vapours, buzzing, lighter ignition, spraying from suspicious items, luggage
  • Risk indicators 6.3 Other suspicious sounds 
    • Music, video, singing or specific prayer before the terrorist act in the suspicious context as a ritual
    • Sound of drones or other unmanned vehicles in the suspicious context 
    • Sound of the car approaching rapidly 

7. Specific indicators of previous radicalisation, suspicious or criminal activities obtained from Data mining

  • Risk indicators 7.1 Data on the travelling of suspects obtained from travel databases 
    • Travel itinerary
    • Travel means used
    • Face of the suspect and the information in travel documents don’t match the information in the face recognition system (Interpol, Private, State) Interpol SLTD database (travel and identity documents), PNR/API systems, Visa, ETIAS information
    • Documents have signs of counterfeit and must be verified within the Frontex INTERPOL Electronic Library Document System (FIELDS) – counterfeit or forged documents
  • Risk indicators 7.2 Data on diseases or chemical and biological incidents obtained from industrial, health and environmental databases (outbreak – spreading of certain diseases in certain regions, presence of certain diseases close to the chemical facility, etc.)
    • Outbreak – spreading of certain diseases in certain regions
    • Presence of certain diseases close to the chemical facility, etc.
    • Historic biological and chemical incidents
  • Risk indicators 7.3 Data on incidents with nuclear and other radioactive materials obtained from Radiation/Nuclear authorities or IAEA 
    • Reported incidents with nuclear and other radioactive material (theft, trafficking in certain regions, etc.)
  • Risk indicators 7.4 Data on wanted terrorists/criminals obtained from international or EU organisations/bodies, e.g., Advance information – Terrorist watch list, Interpol Red Notices, Stolen Administrative Documents database, (SAD), Europol CBRN incident database and European Bomb Data System (EPE/EBDS), Europol information system, etc. 
  • Risk indicators 7.5 Data on monitored suspects obtained from other sources, e.g., Darkweb, Websites and social media analytical tools, CCTVs analytical tools, Operational activities of Law enforcement and Intelligence agencies 
    • Extremist posts or videos on social media
    • Visits of radicalised worship places

8. Technological Detection/Air sampling alarm risk indicators 

  • Risk indicators 8.1 Chemical detector alarm indicating the presence of the chemical hazard on the person or their belongings (must be verified by confirmatory analysis) 
    • Potential chemical hazard in the luggage, carried bootless, etc.  
    • Potential chemical hazards on the body, clothes or other items
  • Risk indicators 8.2 Biological detection technology alarm indicating the presence of the biological hazard on the person or their belongings (must be verified by confirmatory analysis) 
    • Potential biotoxins in the luggage, carried bootless, on the body, clothes or other items etc.  
    • Potential bacteria, viruses and other pathogens in the luggage, carried bootless, on the body, clothes or other items etc
  • Risk indicators 8.3 Explosive detection technology alarm indicating the presence of the explosives or precursors on the person or their belongings (must be verified by confirmatory analysis/screening) 
    • Potential explosives in the luggage, carried bootless, on the body, clothes or other items etc.  
  • Risk indicators 8.4 Radiation detector alarm confirming the presence of the nuclear and other radioactive materials on the person or their belongings, eventually inside the body of the person 
    • Radioactive source in the luggage, carried bootless, etc.  
    • Radioactive source on the body, clothes or other items
    • Radioactive source introduced into the body to irradiate people around the perpetrator
    • Radioactive source inside the body of a person after radiotherapy – radiation treatment of cancer by radiopharmaceuticals
  • Risk indicators 8.5 Non-ionizing Radiation Scanning Equipment alarm showing the presence of a forbidden metal item 
    • Metal scanner alarm indicating the presence of metal objects 
    • Millimetre wave machines alarm indicating threat such as guns and knives
  • Risk indicators 8.6 Ionizing Radiation Scanning Equipment alarm showing the presence of a forbidden item 
    • Backscatter passenger scanners alarm indicating the threats such as weapons or explosives 
    • X-ray systems indicating the threat in screened luggage and carry-on items
  • Risk indicators 8.7 Radio Frequency (RF) based Drone Detection System alarm indicating the drone threat in combination with the observation of a person manipulating the Remote-Control device 

9. Insider threat risk indicators in connection to facilities or transportation dealing with CBRN and explosive materials

  • Risk indicators 9.1 Extensive monitoring of facility procedures or transportation vehicles and gathering needed information or tools from inside 
    • Extensive monitoring of colleagues or security guard working schedule 
    • Extensive monitoring of truck or other vehicles drivers
    • Excessive monitoring of suppliers and delivery services schedule and behavior
    • Questioning colleagues on aspects that don’t belong to his/her responsibility
    • Use of personal cameras or a mobile phone to record certain situations at the work premises
  • Risk indicators 9.2 Change in professional behavior
    • Expression of anger, disloyalty
    • Physical or verbal violence
    • Loss of social interaction with colleagues 
    • Attempts to violate security measures or to get colleagues’ passwords from their digital devices or from access to restricted areas
    • Neglected duties, errors in performing duties  
    • Extensive use of copy machine or scanner 
    • Using often working overtime in the office/laboratory/premises, e.g., night shifts
    • Bringing home certain files
    • Leaving the facility with a bigger handbag than normally 
    • Not reporting foreign contacts and travels during their security clearance check 
    • Taking more personal protective equipment, decontamination solution or laboratory tools from the stock than usually 
    • Taking preventive medicines or measures that are not connected to the performed duties with CBRN agents
    • Trying to often substitute colleagues during certain types of duties
    • Unauthorised manipulation with CBRN agents and/or explosives, tools or items – laboratory tests, development of agents, etc.
    • Authorised manipulation with CBRN agents and/or explosives, however more frequently than is needed 
    • Using private laptops and USB sticks when not permitted at the working premises
    • Unauthorised business trips and meetings 
    • Having suspicious visitors 
    • Damaging or destroying some mechanism or parts of the facility 
    • Disrupting or trying to disrupt the IT systems of the facility 
  • Risk indicators 9.3 Change in his personal life
    • Unexpected divorce
    • Regular travelling to risk or war zones
    • Change of hobbies – becoming a martial arts student, firearms use, flight pilot training, etc.
    • Starting to use cryptocurrencies 
    • Having a big amount of cash
    • Gambling 
    • Taking drugs
    • Visiting radical groups websites and anonymous browsers
    • Loss of contact with his family or neighbours 
    • Change in dressing 

End of Document

Thank you very much for your participation and valuable contribution!

PLEASE READ THIS PARTICIPANT DEBRIEF SHEET AFTER COMPLETING THE QUESTIONAIRE!

  • Human Plague Infection

References:

Benolli, F., Guidotti, M., & Bisogni, F. (2021). The CBRN threat. Perspective of an interagency response. International Security Management: New Solutions to Complexity, 429-448

Centre for Protection of National Infrastructure – CPNI (2020) Behavioural Detection. Guidance on the role and use of behavioural detection – a method of detecting individuals with hostile intentions by observing their behaviours and activities Available at: https://www.cpni.gov.uk/system/files/documents/03/73/CPNI0068_Behavioural_Detection_Brochure_DIGITAL_V8.pdf

Freilich, J.D. & LaFree, G. (2015). Criminology Theory and Terrorism: Introduction to the Special Issue, Terrorism and Political Violence, 27:1, 1-8, DOI: 10.1080/09546553.2014.959405

Leistedt, S. J. (2013). Behavioural aspects of terrorism. Forensic science international, 228(1-3), 21-27.

Nance, M.W. (2014). Terrorist recognition handbook.  Taylor and Frencis Group. ISBN 978-14665-5457-3.