The below is an nonexhaustive list, but enough information to assist in understanding what is and can be suspicious
• Engages in suspected pre-operational surveillance (uses binoculars or camera or cell phones, takes notes, measurements, draws diagrams, etc.).
• Appears to engage in counter-surveillance efforts (doubles back, changes appearance, evasive driving, etc.).
• Engages security personnel in questions focusing on sensitive subjects (security information, hours of operation, shift changes, what security cameras see, etc.)
• Takes measurements (counts footsteps, measures building entrances or perimeters, distances between security locations, distances between cameras, etc.).
• Takes pictures or video footage (with no apparent esthetic value, i.e., camera angles, security equipment, security personnel, traffic lights, building entrances, etc.).
• Abandons suspicious package or item (suitcase, backpack, bag, box, package, etc.). (This could be to see the reaction).
• Abandons vehicle (in a secured or restricted location, i.e., the front of a office building, synagogue, theatre, etc.).
• Attempts to enter secured or sensitive premises or area without authorization (i.e., “official personnel,” closed off areas of secured areas at significant events such as appearances by politicians, consulate members, celebrity, etc.).
• Engages in test of existing security measures (i.e., “dry run,” security breach of perimeter fencing, security doors, etc., creating false alarms in order to observe reactions.).
• Attempts to acquire sensitive or restricted items or information (plans, schedules, passwords, etc.).
• In possession of multiple passports, identifications or travel documents issued to the same person.
• Engages in suspected coded conversations or transmissions (e-mail, radio, telephone, etc., i.e., information found during a private business audit is reported to police).
• In possession of, or solicits, sensitive event schedules (i.e., Organization Major Event, Fund Raiser, Community Event.).
• In possession of, or solicits, security schedules.
• In possession of, or solicits, blueprints to sensitive locations.
• In possession of, or solicits, evacuation plans.
• In possession of, or solicits, security plans.
• In possession of, or solicits, other sensitive materials (passwords, access codes, secret information, etc.).
• In possession of coded or ciphered literature or correspondence.
