THREAT IDENTIFICATION/CHARACTERISTICS OF SUSPICIOUS PERSONS

Predictive profiling is a method of threat assessment designed to predict and

categorize the potential for criminal and/or terrorist methods of operation based on
an observed behavior, information, a situation and/or objects. [1]

Contents

[show]

Description[edit]

Predictive Profiling offers a unique approach to threat mitigation that begins from
the point of view of the aggressor/adversary and is based on actual adversary's
methods of operation, their modus operandi. This method is applicable to securing
virtually any environment and to meeting any set of security requirements.

In Predictive Profiling, one uses only the operational profile (not racial or statistical
profile) of a terrorist or criminal as the basis for identifying suspicion indicators in a
protected environment. When predictively profiling a situation, person or object one
identifies suspicion indicators that correlate with an adversary's method of
operation. For example, if a security officer observes a person walking with an
empty suitcase in an airport (the suitcase appears very light; it bounces off the
floor) he may identify this suspicious behavior as an indication of a possible terrorist
or criminal method of operation because:

The person may be involved in theft or shop lifting (using the empty suitcase
to stash what he would steal)

The person may be involved in surveillance activities (the suitcase is only a

prop to fit the airport environment)

The person has dropped a bomb somewhere in the airport and is now exiting
Predictive Profiling differs from racial profiling which uses race and ethnicity as the
only factors against which to evaluate potential threat. In fact, proponents of
Predictive Profiling would dismiss the use of racial profiling as ineffective in counter
terrorism or security because focusing on one part of the population as a tool for
identifying potential threat can be illegal and it can also be counterproductive. [2]

Indeed, a terrorist or criminal can use security measures which are solely based on
racial profiling against a security system by choosing an identity and appearance
that is not associated with the targeted race or ethnicity. Once, on May 30, 1972,
three members of the Japanese Red Army, on behalf of the Popular Front for the
Liberation of Palestine (PFLP), attacked an Israeli Airport (Lod Airport massacre). The
Japanese attackers took advantage of the fact that at the time, the Israeli border
security system was geared towards focusing on Arab and Muslim populations as
potential terrorist threats.

Predicting profiling is proactive in nature, used to prevent and/or mitigate threat

before it evolves into an attack or criminal event. Putting resources into emergency
response is of course prudent, but clearly preventing an event from occurring is
preferable both in terms of public safety and often, security costs.

What we need to do better is be predictive. We have to be proactive. We

May 30, 2002, FBI Director Robert S. Mueller

Adversarial Methods of Operation (AMO)[edit]

Predictive Profiling uses the method of attack and its correlating Suspicion
Indicators as the basis for threat assessment. The method of attack, from a
pickpocket to a terrorist, remains constant and it includes the Marking to Getaway
stages:

Marking of the target

Intelligence Gathering

Surveillance

Planning

Tooling Up

Rehearsing and Training

Execution and

Getaway
Knowing the method of attack or method of operation of the terrorist or criminal, we
can be more threat-oriented in protecting our environment. It allows us to be able to
identify situations, objects or people as suspicious in a context of the method.
Sometimes Predictive Profiling is referred to as conducting a situational threat
assessment.

Suspicion Indicators[edit]

Suspicion Indicators

A suspicion indicator is an indication based on known (or predicted) terrorist or

criminal methods of operation or deviation from a typical profile that may lead one
to believe that an observed situation (persons and/or objects) may have the
potential for harming the protected environment and its inhabitants.

These indicators are derived from any aspect that relates to what we broadly term
behavior. This would include among other things attire, accent, affect, identity both
as reflected in an individual's documentation and by who they say they are, their
'cover story'.

Because suspicion indicators correlate directly with the AMOs associated with a
given protected environment, there is no single definitive list. There are infinite
examples of suspicion indicators, and perhaps the most poignant are those
associated with the testimony of U.S. Airways agent Michael Tuohey, as regards the
events of 9/11. Tuohey, who had worked for the airlines for over 30 years, 18 of
which in Portland, checked in Mohamed Atta and Abdulaziz al-Omari who were flying
from Portland, ME to Boston, MA. He noticed the following suspicion indicators in
Atta and al-Omaris actions and behavior on the morning of 9/11:

The terrorists arrived to check in only 30 minutes before departure.

Atta and Omari were meandering in the checkin area although their flight was
due to depart in 30 minutes.

Omari never responded verbally to questions asked by Mr. Touhey; he just

shook his head.

Atta was looking at Mr. Touhey with anger.

Both terrorists carried a full fare business class ticket.

 The tickets for both terrorists were one way.
[3]

Threat vs. Risk[edit]

Sometimes the terms "threat" and "risk" are used as though synonymous. But in
fact these two ideas are very different, and that difference is reflected in Predictive
Profiling methods.

Risk is measurable, it has levels. For example, car insurance premiums are
calculated based on measurable, past behaviors and events. Threat, on the other
hand, is not measurable. It either exists, or it doesn't. This is why the Homeland
Security Alert Systems that many countries have adopted are not really meaningful.

Following this logic, the goal of predictive profiling is to determine whether or not a
person, object or situation represents a real threat. The logic of predictive profiling
continues insofar as our security efforts are confined to real threats versus a larger,
random sampling of threats in the form of people or objects. Why, for example,
should we waste time screening everyone, or a random sampling of a larger set,
when we could rather focus our attention on those suspicion indicators that reflect
actual, potential threat?

Another way to define threat is as suspicion that has not been refuted.

Detect - Determine - Deploy[edit]

The proactive security process that is employed using Predictive Profiling consists of
three steps:

Detect suspicion (technology or human)

Determine method of operation (human)

Deploy against the AMO (human)

Predictive Profiling relies heavily on the human element in security. While detection
can be accomplished with technology, the determination or analysis required to
identify a suspicion indicator and its related AMO is something only a trained human
can do. This general kind of analysis is actually natural to us; we make similar
determinations in our lives all the time. A husband arrives home later than usual
and smelling of a scent not familiar to his wife. She observed suspicion indicators
(tardy and unusual scent) and automatically seeks to determine whether or not they
correlate to the AMO (that he is cheating on her) by asking probing questions
(where have you been?) to decide if the threat is refutable (his story pans out).

Use of Technology in Profiling[edit]

In security and homeland security management, a strong emphasis is placed on
technology: CCTV cameras, detection devices, scanners and the like. And while
technology has its place, note that there are no known instances of a terrorist being
caught using detection technology alone. Predictive Profiling is more concerned with
identifying intent than a weapon. A well trained and motivated criminal or terrorist
is capable of death and destruction using improvised weapons. Just as an individual
with a potentially lethal weapon who has peaceful intentions, does not pose a
threat.

History of Profiling[edit]

The methodology is based primarily on methods used by El Al Israel Airlines Ltd,

and other Israeli security agencies. In Predictive Profiling, these methods have been
adapted to western cultural, social and economic conditions that differ from those of
Israel.[4]

Methods similar to that of Predictive Profiling, focused on assessing threat

contextually, have been in use by a wide variety of agencies, around the world.
Border and Custom agents have been using profiling for decades as a means of
targeting those individuals or cargo that might be involved in smuggling, trafficking
or criminal operations.[5]

This kind of targeting has proven very effective and has resulted in the prevention
of many illegal activities. The sheer number of people and freight passing through
borders requires that the focus be on identifying indicators of intent. This is
accomplished via targeting and behavioral observation.

Hindawi affair[edit]

The Hindawi affair was the attempted bombing of an El Al flight from London to Tel
Aviv in April 1986 and its international repercussions.

On the morning of April 17, 1986, at Heathrow Airport in London, Israeli security
guards working for El Al airlines found semtex explosives in one of the bags of Anne
Mary Murphy, a pregnant Irishwoman attempting to fly on a flight with 375 fellow
passengers to Tel Aviv. In addition, a functioning calculator in the bag was found to
be a timed triggering device. She was apparently unaware of the contents, and had
been given the bag by her fianc, Nezar Hindawi, a Jordanian. He had sent her on
the flight for the purpose of meeting his parents before marriage. A manhunt
ensued, resulting in Hindawi's arrest the following day after he surrendered to
police. Hindawi was found guilty by a British court in the Old Bailey and received 45
years imprisonment, believed to be the longest determinate, or fixed, criminal
sentence in British history.

This section does not say how predictive profiling was used in this case. The
connection to the main article needs to be explained.
Edit: racial/ethnic/religious profiling may not have been useful in this case, unless
there was a putative connection from the Irish passenger to the IRA. Behavioral
profiling would likely not have yielded any results as the passenger was unaware of
the presence of the IED.

Racial Profiling[edit]

Racial Profiling is the use of ethnic or racial characteristics to identify and associate
an individual with a (typically criminal) behavior. Legal cases have been brought
against law enforcement officers who allegedly focused disproportionately on
members of minority races. It is a hot button issue, and often a point of contention
in Homeland Security policy discussions. [6]

After a terrorist event, media attention and public debate on counter terrorism
methods spike. After the Christmas Day attempt to blow up a plane in midair, ABC
News covered the issue of 'Predictive' versus Racial Profiling. [7]

Criminal Profiling[edit]

Criminal Profiling attempts to associate a criminal's attributes and methods of

operation to a specific crime. The main difference is the profiling occurs after the
crime, in an attempt to find the criminal. It's not usually used to prevent a crime,
except in the case of a serial offender. [8]

Where Predictive Profiling is Used[edit]

Predictive Profiling as a security method is applicable to a wide range of

environments.

Aviation[edit]

Predictive Profiling is a particularly useful component of an aviation security toolbox.

Given the success of the El Al model, and the events of 9/11, there has been a good
deal of interest in this methodology. As for any densely populated, open area,
Predictive Profiling lends itself to effectively securing everything within an aviation
environment.

The U.S. Transportation Security Administration (TSA) has been perusing a variety of
security models and methods, especially in the aftermath of 9/11. CAPPS and SPOT
are examples of profiling programs the TSA has adapted as part of its mandate to
make aviation more secure.

Maritime[edit]

The Diplomatic Conference on Maritime Security held in London in December 2002

adopted new provisions in the International Convention for the Safety of Life at Sea,
1974 and the ISPS Code (International Ship and Port Facility Security Code) to
enhance maritime security. These new requirements form the international
framework through which ships and port facilities can co-operate to detect and
deter acts which threaten security in the maritime transport sector. Following the
tragic events of 11 September 2001, the twenty-second session of the Assembly of
the International Maritime Organization (IMO), in November 2001, unanimously
agreed to the development of new measures relating to the security of ships and of
port facilities for adoption by a Conference of Contracting Governments to the
International Convention for the Safety of Life at Sea, 1974 (known as the
Diplomatic Conference on Maritime Security) in December 2002. Preparation for the
Diplomatic Conference was entrusted to the Organization's Maritime Safety
Committee (MSC) on the basis of submissions made by Member States,
intergovernmental organizations and non-governmental organizations in
consultative status with the Organization. Predictive Profiling was one of the new
requirements adopted by the ISPS Code: "recognition of characteristics and
behavioural patterns of persons who are likely to threaten security"

Mass transportation[edit]

Whether it be a train station, bus depot, or airport terminal, these mass transit hubs
are desirable targets for terrorists. Attacking areas where large numbers of people
congregate results in higher fatalities and disabling public transportation causes
commercial losses, all of which enhances the terror effect.

The character of mass transit, and the fact that it represents an open environment,
makes protecting against this kind of terrorist attack a major challenge. Physically
conducting a complete check of every traveler and passenger is infeasible, given
the numbers. And spending time checking the 99.9% of people who do not present
a threat is a waste of time and resources. Screening a random sample of a given
population for example, passengers passing through a checkpoint ignores the
subject of "threat" altogether, whereas using predictive profiling, screening activity
is focused only on those people, objects or situations that draw suspicion because
they may reflect a real threat.
[9]

Law Enforcement[edit]

Law enforcement agencies around the globe have been and continue to use
elements of Predictive Profiling in their daily activities. Any officer 'on the beat'
understands suspicion indicators, and how certain behavior, objects or situations
stand out from the norm with which the officer is intimately familiar. Law
enforcement officers make situational assessments and conduct behavioral
observation all the time. The main point of departure from predictive profiling is that
an officer's primary mission is to enforce the law, which means that he is foremost
concerned with proving a case that will play out in court. This necessitates focus on
finding a weapon and fingerprints(evidence), and less so finding intent. [10]
Open Environments[edit]

Large retail malls, private and governmental office buildings, recreational centers
and stadiums are open environments that are particularly enticing targets for a
terrorist. These are areas where large numbers of people congregate and they often
symbolic of something that can be politicized by an opponent. The World Trade
Center represented the financial dominance of the United States in the world, for
example.

Military Applications[edit]

For soldiers fighting against insurgent populations and terrorism, Predictive Profiling
is an extremely effective tool. Military personnel appreciate the ability to prevent or
mitigate an attack by assessing and acting against possible threats before they
occur.

U.S. Army units preparing for deployment have turned to Predictive Profiling as
another tool in their arsenal for identifying threat in the field. [11]

The U.S. military is vulnerable for being a training ground for terrorists, be they
homegrown, independent or working for foreign agencies. Given the pressure to
recruit to fill ranks, and the fact that troops are operating in foreign, unfamiliar
cultures, effective vetting of personnel needs to take into consideration the
operational profile of a would be terrorist. Predictive Profiling can be applied not
only to individuals but to procedures, for example - military recruitment activities. [12]

See also[edit]