Posted on: Sun, February 19 2006 - 10:49 am
Precursors of Hostile Intent:
Signs of a Potential Terrorist Attack
by John Thompson, President of the Mackenzie Institute
Current as of October 21st, 2005
This document is intended to serve as a guide to
experts and average citizens alike of precursor activities and other potential
indicators of a terrorist attack.
It will never be a finalized document as input from police and security
community continues to come in regarding their own experiences from four
nations and a half-dozen agencies.
The most current edition of this ongoing document will always be
available on the Institute’s website (listed above).
This was written for Canadian audience although the list of
precursors apply everywhere that Jihadists might attack. In the interests of public safety
readers are free to print, post or distribute copies as they see fit, we only
ask that the normal conventions of accreditation are observed.
1. Some day, maybe in a few months or perhaps not for a couple
of years, Jihadist terrorists will deliver an attack in Canada, or will
directly threaten Canadians in some manner overseas. Al Qaeda’s usual style is to attempt to inflict as many
casualties as possible, but also to hit targets of economic importance and which
may hold some symbolic value.
2. Although many Canadians entertain false hopes that we will be
spared from Jihadist attentions; it is already clear that al Qaeda is among the
dozens of terrorist groups with a Canadian presence. Numerous al Qaeda members have Canadian connections: These include the Khadr family, and two
members who were scooped up in Iraq as members of Ansar al Islam. One of the Jabarah brothers from St.
Catharines Ontario was killed in Saudi Arabia while participating in an al
Qaeda cell and the other is still in detention in the US after acting as a
liaison between Osama bin Laden and Jihadists in Singapore and Indonesia.
3. Other Jihadists are operating in Canada. We recently deported 19 young Pakistani
men when their activities (including a 4:00 AM nature hike on the grounds of a
nuclear power plant) attracted our police. Two Canadian women of Egyptian origin also got CSIS
interested in Kassim Mohamed, likewise of Egyptian origin, in early 2004. Mohamed was busy filming details of Toronto’s
subway system, fire exits from the CN tower, Toronto bank towers, and other
points of interest.
4. Inside police and security agency circles there are stories
of other reconnaissance-style activities at various points in Toronto. From the US, the UK and Australia, there
have been press reports of such activities directed towards ambulances,
hospitals, military airfields, churches and synagogues, schools (especially,
but not limited to, Jewish ones), power stations, government buildings, office
towers, fuel tankers, chemical plants and refineries.
5. Over the past four years, Osama bin Laden has directly
instructed Jihadists to attack ten nations: The United States, Great Britain, Australia, Spain, Canada
and Italy, as well as Morocco, Egypt, Jordan and Saudi Arabia. So far, successful attacks were made against
all but Canada, Italy and Jordan.
Jordan escaped a massive attack that might have killed up to 20,000
people in its capital with poison gas when they arrested the attackers as they
arrived in Amman with their supplies.
Canada’s turn is coming soon.
6. The first line of defence against terrorism depends on an
alert and aware citizenry – people who are cognizant of what could be
precursor activity for an attack and are confident enough to report it.
7. The following should trigger your suspicions:
theft or loss of badges, credentials, ID cards,
Government/military/emergency vehicles, uniforms, or the discovery of false
IDs. Attempts to scout seven
hospitals in the US in March and April of 2005 involved fake credentials
and ID cards.
sketching or surveillance of buildings and facilities (see paragraph 4).
near key facilities or in supposedly secure areas, particularly by
presence of uncommon or abandoned vehicles, packages, or containers.
who seem to be making careful note of the presence of security cameras,
anti-vehicle bollards, and similar security measures around potential
- Observing people who are searching
trash containers or placing unusual items in them (particularly around transit
systems or the lobbies of crowded buildings – but also around the
private residences of important people).
of sensitive military or government property such as computers.
at Government surplus sales of military, police, fire or paramedic
vehicles and equipment, particularly if there are indications of an
intention to refurbish them to working condition. (Last autumn, it appeared that there
was a keen interest in ambulances in several US cities).
attempted purchase or theft of large numbers of weapons (including knives).
attempted purchase of supplies necessary for the manufacture of explosive
devices – this includes an unusual or frequent purchase of
fertilizer or cleaning supplies.
Acetone and Peroxide are key components in one particularly devastating
- An increase
in cyber attacks/probes and demands for information about facilities,
personnel or standard operating procedures through e-mail.
- An increase
in the number of threats or false fire alarms to facilities that require
evacuation. If a false alarm
is rung, watch for onlookers who are observing your reaction.
workers trying to gain access to facilities for repairs, installation of
patterns of seemingly unimportant activity: Examples might include increased foot traffic into a little
used access tunnel underneath an office tower, or a fisherman who keeps
returning to a point close to a nuclear power plant.
persons or occupied vehicles loitering in the vicinity of a potential
target for an extended period of time.
to gain information from janitors, receptionists, and other entry-level
al Qaeda usually prefers attacking with a sequence of bombs (often delivered by
suicide attackers), the mail bomb is still a potential hazard. Be suspicious about:
- Mail that has no return
address (if there is a return address and you are suspicious about the
package, call them and ask if they sent something).
- Mail addressed only to the title
of the prospective recipient or that uses an incorrect title.
- Misspelled words or
- Restrictive markings such
as "personal for …." or “to
be opened only by …”
- Excessive postage –
the sender might not have wanted to deal face to face with a postal clerk
to get the package weighed and stamped with exact postage.
- Stains, discoloration,
oiliness, crystallization, or a strange odor.
- Abnormal size or excessive
wrapping, particularly if the package is heavily taped or wrapped with
- Wires, metal foil, string or
a cell phone antenna protruding from the package.
- An unusually heavy or
unbalanced feel to the package (the mail bomb the Institute received some
years ago felt like there was a large ceramic mug inside a box).
- A lopsided or uneven
envelope – a hard lump like a watch battery might well be part of a
bomb’s triggering circuit.
- A very rigid envelope.
- A springiness in part of
the package (which may be part of the trigger – do not keep testing it).
- A suspicious package which
was dropped off rather than brought in by your normal method of postal
delivery or courier service.
9. One should also be
suspicious about other unusual activities, including:
- A large group of men (particularly,
but not exclusively, ‘Middle Eastern’ looking men in their 20s or 30s) who
occupy a house, apartment, or motel rooms with no apparent purpose; and
who have no apparent patterns of arrival/departure consistent with
commuting to work or school.
- If there is a smell of chemicals
coming from the above site, call it in immediately!
They may be cooking up explosives.
- A similar group that is
interested in renting (especially for cash) office space or an apartment
yet seem to perform no apparent function with it.
- People who are in possession
of large amounts of cash for no apparent reason.
- People who attempt to purchase
or lease vehicles or boats with cash, and who seem evasive about the
Regarding suicide attackers, look out for these indicators:
A shaved head or short haircut. A short haircut or
recently shaved beard or moustache may be evident by differences in skin
complexion on the head or face.
May smell of herbal or flower water, as they may have
sprayed perfume on themselves and clothing to prepare for Paradise.
Suspects have been seen "praying fervently, giving
the appearance of whispering to someone.”
Others have been described as agitated or very nervous.
Recent suicide bombers have raised their hands in the
air just before the explosion to prevent the destruction of their fingerprints.
They have also placed identity cards in their shoes because they want to be
praised and recognized as martyrs.
Suicide bombers often look furtive and may be having a
hard time ‘fitting in’ with the normal street scene. LTTE suicide attackers at the Colombo Airport in Sri Lanka
approached their targets by acting as a picnic party on the runways. Palestinian attackers had often been
identified by Israeli civilians as they approach to attack.
Additionally, bulky clothing, which may be
inappropriate for the weather and circumstances, can conceal a vest bomb
(though many have used backpacks instead of vest bombs, particularly in the
Suicide bombers often try to avoid coming near security
or into contact with any authority figure until it is time to launch their
Male suicide bombers often wear multiple sets of
underwear (as many as ten in some cases) and a protective cup over their
genitals to protect these in anticipation of the 72 Virgins they believe will be
accorded a ‘Martyr’ in the afterlife.
An odd fit to the pants may be another indicator.
11. Vehicle bombs are one of the most
common forms of attack for modern terrorists, be suspicious of:
Vehicles that have a strong chemical smell, or the
scent of something burning coming from them.
Signs of recent body work, especially of poor quality,
or with patches welded to the cab or body of the truck.
Extra fuel tanks or extra antennas, or recent signs of
a reinforced suspension.
Inappropriate license plates or misspelled artwork or
badly executed stencil painting.
Heavily tinted windows, particularly if used in an
unusual manner (for example, if the front screen of a delivery truck is
Signs that the vehicle is heavily over-loaded on its
12. Custom and immigration workers, as well
as police, should also be alert for:
People with chemical burns and/or shaved chests (one
arrival in Canada tried to explain that the burns were so that he could match
his passport photo!).
False documents, especially from visa-exempt countries
such as EU nations, the US in Canada (and vice versa), Australia, Singapore,
etc. If in doubt ask your subject
about the national anthem, currency, landmarks, etc. from the country he claims
to be from.
Persons who come via another country than the one that
issued his passport. For example,
someone traveling on a forged Spanish passport might arrive in Canada via the
UK, as his forgery could be easily spotted if he arrived directly from Spain. The al Qaeda manual advises Jihadists
to use this indirect approach when traveling.
Is this person trying to enter during a weekend or
holiday, when it might be assumed there would be fewer and/or less attentive
staff at the airport?
What currency has he got in his pockets? Coins can be very revealing: ATMs and money exchanges never give or
accept coinage, and these would be especially telling about where the subject has
been – particularly if there is a discrepancy between his story and the
contents of his pockets.
Are there any duty free stamps on his cigarettes? From where? Or his toiletries?
Is he carrying matches or a lighter and no cigarettes?
Is he carrying maps and photographs, diagrams,
something coded (like phone numbers), or a list of temporary/casual e-mail
addresses (hotmail and yahoo accounts particularly)? Are there CD disks that are plain and unmarked, especially
if they are tucked in the case or jacket of a commercial product?
Is there an album or disc of photographs? Are any missing? Remember that digital cameras put a
sequence stamp on each photo.
What books or magazines is he carrying? In what languages, and where were they
If entering the country on a student visa, does the
school actually exist? Is it
legitimate? Can this registration
13. Should you notice any of the above
points, don’t be afraid to quickly
let your local police know about them.
Canadians, if calling the police, should phone their city/regional HQ
and ask for the Intelligence Section or INSET (Integrated National Security
Enforcement Team). If calling 911,
ask for a supervisor as most of them will know where to forward your call.
14. Make sure your report is
clear and factual, share your suspicions but emphasize the reasons why they
arose in the first place. Record
your observations as quickly as possible, while your impressions are still
15. If something or someone
attracts your notice, take no action other than to report it immediately. Do not attempt heroics – this may
deter a possible attack, but not the broken neck that a startled Jihadist might
deliver to you personally if you grab him (or the assault charges or lawsuit if
you grabbed an innocent party). Besides, terrorists are skittish about discovery and the
impression that they have kindled your suspicions may be enough to send them
scuttling off elsewhere.
John Thompson is President of the Mackenzie Institute which studies political instability and terrorism. He can be reached at: firstname.lastname@example.org.