Precursors of Hostile Intent:
Signs of a Potential Terrorist Attack

by John Thompson, President of the Mackenzie Institute
Current as of October 21st, 2005

This document is intended to serve as a guide to experts and average citizens alike of precursor activities and other potential indicators of a terrorist attack. It will never be a finalized document as input from police and security community continues to come in regarding their own experiences from four nations and a half-dozen agencies. The most current edition of this ongoing document will always be available on the Institute’s website (listed above).

This was written for Canadian audience although the list of precursors apply everywhere that Jihadists might attack. In the interests of public safety readers are free to print, post or distribute copies as they see fit, we only ask that the normal conventions of accreditation are observed.

1. Some day, maybe in a few months or perhaps not for a couple of years, Jihadist terrorists will deliver an attack in Canada, or will directly threaten Canadians in some manner overseas. Al Qaeda’s usual style is to attempt to inflict as many casualties as possible, but also to hit targets of economic importance and which may hold some symbolic value.

2. Although many Canadians entertain false hopes that we will be spared from Jihadist attentions; it is already clear that al Qaeda is among the dozens of terrorist groups with a Canadian presence. Numerous al Qaeda members have Canadian connections: These include the Khadr family, and two members who were scooped up in Iraq as members of Ansar al Islam. One of the Jabarah brothers from St. Catharines Ontario was killed in Saudi Arabia while participating in an al Qaeda cell and the other is still in detention in the US after acting as a liaison between Osama bin Laden and Jihadists in Singapore and Indonesia.

3. Other Jihadists are operating in Canada. We recently deported 19 young Pakistani men when their activities (including a 4:00 AM nature hike on the grounds of a nuclear power plant) attracted our police. Two Canadian women of Egyptian origin also got CSIS interested in Kassim Mohamed, likewise of Egyptian origin, in early 2004. Mohamed was busy filming details of Toronto’s subway system, fire exits from the CN tower, Toronto bank towers, and other points of interest.

4. Inside police and security agency circles there are stories of other reconnaissance-style activities at various points in Toronto. From the US, the UK and Australia, there have been press reports of such activities directed towards ambulances, hospitals, military airfields, churches and synagogues, schools (especially, but not limited to, Jewish ones), power stations, government buildings, office towers, fuel tankers, chemical plants and refineries.

5. Over the past four years, Osama bin Laden has directly instructed Jihadists to attack ten nations: The United States, Great Britain, Australia, Spain, Canada and Italy, as well as Morocco, Egypt, Jordan and Saudi Arabia. So far, successful attacks were made against all but Canada, Italy and Jordan. Jordan escaped a massive attack that might have killed up to 20,000 people in its capital with poison gas when they arrested the attackers as they arrived in Amman with their supplies. Canada’s turn is coming soon.

6. The first line of defence against terrorism depends on an alert and aware citizenry – people who are cognizant of what could be precursor activity for an attack and are confident enough to report it.

7. The following should trigger your suspicions:

• The theft or loss of badges, credentials, ID cards, Government/military/emergency vehicles, uniforms, or the discovery of false IDs. Attempts to scout seven hospitals in the US in March and April of 2005 involved fake credentials and ID cards.
• Photographing, sketching or surveillance of buildings and facilities (see paragraph 4).
• Trespassing near key facilities or in supposedly secure areas, particularly by multiple persons.
• The presence of uncommon or abandoned vehicles, packages, or containers.
• Persons who seem to be making careful note of the presence of security cameras, anti-vehicle bollards, and similar security measures around potential target buildings.
• Observing people who are searching trash containers or placing unusual items in them (particularly around transit systems or the lobbies of crowded buildings – but also around the private residences of important people).
• Thefts of sensitive military or government property such as computers.
• Purchases at Government surplus sales of military, police, fire or paramedic vehicles and equipment, particularly if there are indications of an intention to refurbish them to working condition. (Last autumn, it appeared that there was a keen interest in ambulances in several US cities).
• The attempted purchase or theft of large numbers of weapons (including knives).
• The attempted purchase of supplies necessary for the manufacture of explosive devices – this includes an unusual or frequent purchase of fertilizer or cleaning supplies. Acetone and Peroxide are key components in one particularly devastating home-made explosive.
• An increase in cyber attacks/probes and demands for information about facilities, personnel or standard operating procedures through e-mail.
• An increase in the number of threats or false fire alarms to facilities that require evacuation. If a false alarm is rung, watch for onlookers who are observing your reaction.
• Unknown workers trying to gain access to facilities for repairs, installation of equipment, etc.
• Unusual patterns of seemingly unimportant activity: Examples might include increased foot traffic into a little used access tunnel underneath an office tower, or a fisherman who keeps returning to a point close to a nuclear power plant.
• Unknown persons or occupied vehicles loitering in the vicinity of a potential target for an extended period of time.
• Attempts to gain information from janitors, receptionists, and other entry-level employees.

8. While al Qaeda usually prefers attacking with a sequence of bombs (often delivered by suicide attackers), the mail bomb is still a potential hazard. Be suspicious about:

• Mail that has no return address (if there is a return address and you are suspicious about the package, call them and ask if they sent something).
• Mail addressed only to the title of the prospective recipient or that uses an incorrect title.
• Misspelled words or defective addresses.
• Restrictive markings such as "personal for …." or “to be opened only by …”
• Excessive postage – the sender might not have wanted to deal face to face with a postal clerk to get the package weighed and stamped with exact postage.
• Stains, discoloration, oiliness, crystallization, or a strange odor.
• Abnormal size or excessive wrapping, particularly if the package is heavily taped or wrapped with twine.
• Wires, metal foil, string or a cell phone antenna protruding from the package.
• An unusually heavy or unbalanced feel to the package (the mail bomb the Institute received some years ago felt like there was a large ceramic mug inside a box).
• A lopsided or uneven envelope – a hard lump like a watch battery might well be part of a bomb’s triggering circuit.
• A very rigid envelope.
• A springiness in part of the package (which may be part of the trigger – do not keep testing it).
• A suspicious package which was dropped off rather than brought in by your normal method of postal delivery or courier service.

9. One should also be suspicious about other unusual activities, including:

• A large group of men (particularly, but not exclusively, ‘Middle Eastern’ looking men in their 20s or 30s) who occupy a house, apartment, or motel rooms with no apparent purpose; and who have no apparent patterns of arrival/departure consistent with commuting to work or school.
• If there is a smell of chemicals coming from the above site, call it in immediately! They may be cooking up explosives.
• A similar group that is interested in renting (especially for cash) office space or an apartment yet seem to perform no apparent function with it.
• People who are in possession of large amounts of cash for no apparent reason.
• People who attempt to purchase or lease vehicles or boats with cash, and who seem evasive about the paperwork.

10. Regarding suicide attackers, look out for these indicators:

A shaved head or short haircut. A short haircut or recently shaved beard or moustache may be evident by differences in skin complexion on the head or face.

May smell of herbal or flower water, as they may have sprayed perfume on themselves and clothing to prepare for Paradise.

Suspects have been seen "praying fervently, giving the appearance of whispering to someone.” Others have been described as agitated or very nervous.

Recent suicide bombers have raised their hands in the air just before the explosion to prevent the destruction of their fingerprints. They have also placed identity cards in their shoes because they want to be praised and recognized as martyrs.

Suicide bombers often look furtive and may be having a hard time ‘fitting in’ with the normal street scene. LTTE suicide attackers at the Colombo Airport in Sri Lanka approached their targets by acting as a picnic party on the runways. Palestinian attackers had often been identified by Israeli civilians as they approach to attack.

Additionally, bulky clothing, which may be inappropriate for the weather and circumstances, can conceal a vest bomb (though many have used backpacks instead of vest bombs, particularly in the summer).

Suicide bombers often try to avoid coming near security or into contact with any authority figure until it is time to launch their attack.

Male suicide bombers often wear multiple sets of underwear (as many as ten in some cases) and a protective cup over their genitals to protect these in anticipation of the 72 Virgins they believe will be accorded a ‘Martyr’ in the afterlife. An odd fit to the pants may be another indicator.

11. Vehicle bombs are one of the most common forms of attack for modern terrorists, be suspicious of:

Vehicles that have a strong chemical smell, or the scent of something burning coming from them.

Signs of recent body work, especially of poor quality, or with patches welded to the cab or body of the truck.

Extra fuel tanks or extra antennas, or recent signs of a reinforced suspension.

Inappropriate license plates or misspelled artwork or badly executed stencil painting.

Heavily tinted windows, particularly if used in an unusual manner (for example, if the front screen of a delivery truck is tinted).

Signs that the vehicle is heavily over-loaded on its suspension.

12. Custom and immigration workers, as well as police, should also be alert for:

· People with chemical burns and/or shaved chests (one arrival in Canada tried to explain that the burns were so that he could match his passport photo!).

· False documents, especially from visa-exempt countries such as EU nations, the US in Canada (and vice versa), Australia, Singapore, etc. If in doubt ask your subject about the national anthem, currency, landmarks, etc. from the country he claims to be from.

· Persons who come via another country than the one that issued his passport. For example, someone traveling on a forged Spanish passport might arrive in Canada via the UK, as his forgery could be easily spotted if he arrived directly from Spain. The al Qaeda manual advises Jihadists to use this indirect approach when traveling.

· Is this person trying to enter during a weekend or holiday, when it might be assumed there would be fewer and/or less attentive staff at the airport?

· What currency has he got in his pockets? Coins can be very revealing: ATMs and money exchanges never give or accept coinage, and these would be especially telling about where the subject has been – particularly if there is a discrepancy between his story and the contents of his pockets.

· Are there any duty free stamps on his cigarettes? From where? Or his toiletries?

· Is he carrying matches or a lighter and no cigarettes?

· Is he carrying maps and photographs, diagrams, something coded (like phone numbers), or a list of temporary/casual e-mail addresses (hotmail and yahoo accounts particularly)? Are there CD disks that are plain and unmarked, especially if they are tucked in the case or jacket of a commercial product?

· Is there an album or disc of photographs? Are any missing? Remember that digital cameras put a sequence stamp on each photo.

· What books or magazines is he carrying? In what languages, and where were they printed?

· If entering the country on a student visa, does the school actually exist? Is it legitimate? Can this registration be confirmed?

13. Should you notice any of the above points, don’t be afraid to quickly let your local police know about them. Canadians, if calling the police, should phone their city/regional HQ and ask for the Intelligence Section or INSET (Integrated National Security Enforcement Team). If calling 911, ask for a supervisor as most of them will know where to forward your call.

14. Make sure your report is clear and factual, share your suspicions but emphasize the reasons why they arose in the first place. Record your observations as quickly as possible, while your impressions are still fresh.

15. If something or someone attracts your notice, take no action other than to report it immediately. Do not attempt heroics – this may deter a possible attack, but not the broken neck that a startled Jihadist might deliver to you personally if you grab him (or the assault charges or lawsuit if you grabbed an innocent party). Besides, terrorists are skittish about discovery and the impression that they have kindled your suspicions may be enough to send them scuttling off elsewhere.

John Thompson is President of the Mackenzie Institute which studies political instability and terrorism. He can be reached at: jt@mackenzieinstitute.com.