Surveillance - Recording or monitoring activities. May include the use of cameras, note-taking, drawing diagrams or maps. 

Elicitation -Attempting to gain information about operations, infrastructure, or people by mail, email, phone or in person.

Tests of Security - Attempts to measure reaction times to security breaches, penetrate physical security barriers, or monitor procedures in order to assess strengths and weaknesses.

Acquisition of Supplies - Purchasing or stealing explosives, weapons, ammunition, etc.  May include acquiring uniforms, decals, flight manuals, passes or badges. 

Suspicious Persons Out of Place - People who don’t seem to belong in the workplace, neighborhood, or in a particular building or area.

Rehearsal -  Putting people in position and moving them around according to their plan without actually committing the terrorist act.

Deployment - People and supplies getting into position to commit the act.  This is a person’s last chance to alert authorities before the terrorist act occurs.

Funding - Suspicious transactions involving large cash payments, deposits, or withdrawals are common signs of terrorist funding.

If you see suspicious behavior, do not confront the individuals involved.

Take note of the details:

S - Size (Jot down the number of people, gender, ages, and physical descriptions)

A - Activity (Describe exactly what they are doing)

L - Location (Provide exact location)

U - Uniform (Describe what they are wearing, including shoes)

T - Time (Provide date, time, and duration of activity)

E - Equipment (Describe vehicle, make, color etc., license plate, camera, guns, etc)

Suspicious activity is often recalled after an event. We must train ourselves to be on the lookout for things that are out of the ordinary and arouse suspicions.