What constitutes suspicious behavior? And what do you do about it?
One of the things that we have puzzled about recently is the instruction to employees and the man-on-the-street to report suspicious behavior. We encourage that attitude of alertness on the part of every citizen. However, those instructions need to be accompanied by some explanation of what constitutes “suspicious behavior” to allow the uninitiated to correctly recognize it! Suspicious behavior falls into three categories.
Suspicious things
One is the appearance of things in places where they should not be. As an extreme example, some time ago someone in Bogotá noticed a heavily laden (and driverless) truck sitting in an area where trucks don’t usually sit. This was reported to a police officer, who asked himself if there were anything happening in the area which should cause him to be concerned about the truck. He remembered that the head of F-2 (a government security service) would be driving past there. He called the bomb squad who found the truck to be filled with explosives.
Other objects that might be obviously suspicious would be things unaccountably left near an air intake in a building, or packages, boxes, or other containers in places where they shouldn’t be. As an example, a friend of ours was walking by an Israeli bank in Manhattan one evening and noticed a large paper bag sitting next to the wall outside the bank. He tapped on the window to attract the attention of a cleaning person and pointed to the package. The cleaner turned a bit pale, thanked him, and told him they would follow up on it. While it was probably someone’s abandoned Chinese takeout, our friend did the right thing: He saw something, he told someone, and they did something.
Even when it turns out to be nothing bad, that doesn’t matter. A friend in EOD (Explosive Ordinance Devices, also known as the bomb squad) tells us that no matter what he may say in the moment, he would much rather be called out every night on a false alarm than pick up body parts because someone didn’t call for fear of looking silly.
Suspicious people
Besides objects that are suspicious, we need to deal with people who are suspicious. In this case, suspicious generally means one of three things.
Strange Behavior
The first and most obvious suspicious person is someone behaving strangely. Strangely may mean that someone is doing something unexpected, such as working in an area where work is not generally done. (Remember that wearing a uniform or carrying a clipboard does not mean the people are who they appear to be.) Or it can mean that you open the door at your local Stopand- Rob (er, convenience store) and notice that all the customers are standing still, which could well be a clue that you shouldn’t go in while the place is being robbed. Or it could mean that you observe, as did ferry operators inSan Francisco, someone described as a Middle Eastern man who boarded a ferry toAlcatraz, but did not leave the boat when it reached the island. Instead, the man videotaped boat traffic and used a stopwatch to time the route. A suspicious person can also mean someone whom you don’t know somewhere that only people you do know should be. Thus, if you see a stranger working at a terminal in your office, you should ask who they are, what they are doing, and tell someone about it. As an example, one company hired us to test their security. We observed the people going in and out. We then dressed much as they did, walked into the facility, signed onto their computer system using the default system passwords which had never been removed, and sent ourselves a lot of their critical customer data. Nobody asked who we were or what we were doing.
Correlation over time
Repeated sightings of the same individuals is the second thing that should also send your antenna up. For example, if you see the same people in or near the same place over time. You see people sitting on a bench in front of your office one day. The next day, you see them sitting in a car near the office. The day after that, you see them at a newsstand near your office. This should be reported to someone.
Correlation over distance
The third variant on this theme is to see the same people in different places. You might see people working near your home in the morning. Later, you see them in a car near your office. Later still, you see them sitting in the same restaurant in which you are eating.
Is it, by definition, suspicious if you see people behaving oddly, or the same people in different places or at different times? Yes! In the intelligence world, coincidence is seeing something or someone once, perhaps twice; three times is no longer a coincidence. It an alert. Why? Because in order to do bad things, whether they be acts of terrorism, kidnappings, robberies, or almost anything else, there are at least two early stages in which the bad guys have to come out of the woodwork and look to see what is happening in the world they wish to enter and disrupt. In general there is a preliminary effort at surveillance in which unsuitable or uninteresting target are eliminated. This is often done by low-level, relatively inexperienced people who are likely to be a bit obvious if you are alert. This is followed by a second period of surveillance, often by more experienced people, to firm up plans, establish routes and patterns of the target and identify opportunities. If you see people behaving strangely, or the same people in different places or at different times are they, by definition, bad guys? No, but they are suspicious, and it is better to find out one way or the other, and as early as possible, if they are a threat.
Suspicious feelings
The final category of suspiciousness is a gut feeling that something is wrong. If something seems wrong, then there is a good (albeit not infallible) chance that something is wrong. We have, as civilized people, developed extremely sophisticated mechanisms for rationalizing these feelings away, but those protective animal instincts are still there and we unconsciously note and process signals that put our antenna up when something bad is going on. Ignoring these feeling can lead, literally, to disaster. Don’t ignore your feelings.
In the end, the process of dealing with suspicion is a straightforward threestep process:
1. See something
2. Tell someone
3. Do something
In the wake of almost every disastrous event, when the pieces are put together, we discover that we had enough information to deal with the problem in advance, if only all the suspicious activity that had been seen by people had been reported and followed-up on. Sometimes, of course, this doesn’t work, either because all the relevant information is not reported, or because it is not all in one place, or worst of all, simply because it is not followed-up on.
Mort Sahl, on one of his records, had a story about the FBI interviewing people in the apartment building in Greenwich Village where Colonel Abel lived (and yes, we do know he really lived in Brooklyn). If memory serves, the conversation always went something like:
“Did you know the man who lived in 301?”
“Oh, you mean Colonel Abel, the Russian spy?”
“How did you know he was a Russian spy?”
“Well, when he moved in we asked who he was and what he did, and he said he was Colonel Abel, and that he was a Russian spy.”
“Why didn’t you report it?”
“Well, we figure, that’s the Village for you….”
We should be able to do better than this in today’s world., especially if we
1. See something
2. Tell someone
3. Do something
