Without exception, any emerging threat displays warning signs before becoming a resilient crime problem. If such a threat surprises law enforcement agencies, it is because they did not recognize these signals or their significance. Anticipatory knowledge allows officers to take preemptive action to disrupt or suppress an emerging criminal or terrorist threat. Thus, helping investigators avoid surprise is one of the most important functions of strong intelligence.

Often, this anticipatory knowledge results from analyzing signals known as indicators and warnings. Lists of indicators and warnings exist for a wide array of criminal and terrorist acts. While becoming familiar with this information can prove helpful, simply memorizing a list of indicators and warnings will not suffice to prevent emerging threats or help investigators keep up with changing tactics of both criminals and terrorists. Further, the sheer number of criminal groups makes studying their tactics daunting. The list of recognized terrorist groups at one time included over 100 entries.

Additionally, the adversary will not remain static. When law enforcement agencies employ new investigative techniques or crime suppression measures, criminals respond by changing their tactics. Criminal enterprises seek efficiency to maximize profits, and efficiency improvements may drive operational changes. New methods replace the old, new personalities replace previous ones, alliances and rivalries shift, and opportunities and challenges arise. These internal and external changes will foster new indicators and warnings for each threat. The list never will be complete, and, therefore, depending on the list alone leaves law enforcement officers vulnerable.

Agencies will develop better intelligence at an earlier stage of investigations if officers learn other tactics of intelligence gathering. These include identifying new indicators and warnings, deconstructing criminal or terrorist acts, learning how crime and terrorism tactics evolve, placing events and actions in context, analyzing the specific components of a threat, and using all of these tools to develop sound threat assessments. This helps law enforcement personnel develop a dynamic, intellectual framework for assessing current threats, as well as identifying the next worst possibility before it occurs.

Identifying the Signals

Gathering and analyzing indicators and warnings comprise crucial intelligence collection techniques. Indicators are discrete events or series of events, and warnings occur when the indicators reach a critical mass and an imminent threat looms. Investigators identify indicators and warnings by scanning the environment for actions that may or must occur prior to a criminal or terrorist act. Scanning encompasses an ongoing, holistic process that employs all of the tools and techniques of information collection, including reviewing citizen complaints, field interviews and contact reports, suspicious activity reports, community contacts and informants, and the results of ongoing investigations. 

For example, a subject takes his family on a road trip from New York to California, with a northern route to Los Angeles and a southern route coming home. Prior to the trip, an investigator sees the subject engage in a series of actions that provides clues about his plans. When examined individually, each event presents several possible interpretations. When taken as a group, however, they point more definitively in one direction. The subject:

• has his car serviced, possibly suggesting good stewardship of his automobile, a mechanical problem with the vehicle, the anniversary of a required service date, or preparation for a car trip;
• purchases a GPS device, maybe indicating a poor sense of direction, a need to find local addresses efficiently, the purchase of a gift, or preparation for a car trip;
• searches the Internet for hotel options, perhaps suggesting that the subject needs a hotel room for an upcoming trip or that he wants to inquire about hotel rates in a particular city for future reference;
• makes the first night’s hotel reservation, possibly showing that the subject and his family intend to spend the night in a particular city;
• writes a note to his children’s school about an anticipated absence, perhaps suggesting the children will miss school on those days due to a trip, a family event, or other circumstances;
• requests a vacation, maybe indicating that the subject plans to be absent from his job for a specified period of time for any number of reasons; and
• purchases a roof-mounted luggage carrier, possibly showing the subject will use his vehicle for a trip at some point in the future or that he desires additional storage space in his vehicle.

When examined individually, any one of these actions does not provide strong clues to lead an investigator to a definitive hypothesis. However, analyzing them as a group provides context and allows the investigator to logically predict the subject’s plans.

One way to develop context is to categorize events or actions according to the questions they answer. This provides insights and suggests a course of action (figure 1). In this example, even after analyzing the actions in context, questions remain unanswered (e.g., the subject’s final destination and planned routes). But, with a high degree of certainty, the investigator can conclude that the subject plans to embark on a road trip, most likely with his children, for a specific period of time, and at the city where he reserved a hotel room. With this initial hypothesis, the investigator can employ other tactics to determine the final destination. As this example demonstrates, indicators and warnings rarely give a complete view of a subject’s plans, but they can point the investigator in the right direction.

Deconstructing Threats

After a criminal or terrorist incident, investigators can gather lessons learned from the event though a process called “deconstruction,” which provides another preventative technique for investigators to amass intelligence about a threat. Many patrol officers carry out this process intuitively, but applying it logically gives them a sense of how they can discover new indicators and warnings.

Deconstructing criminality or terrorism involves working backward to identify the indicative behaviors or actions that preceded the event. For example, if terrorists want to execute a truck bombing using ammonium nitrate/fuel oil of a building in a major city, they must take certain prior steps in a specific sequence (figure 2).

As the diagram illustrates, terrorists cannot detonate an explosive device without first acquiring and assembling the needed components. Each of these actions also may link to its own precursor events that investigators can identify through further deconstruction. Some actions are specific, while others apply to multiple events (figure 3).

Law enforcement personnel can use deconstruction to analyze precursor events at a deeper level and pinpoint new indicators and warnings. This framework allows investigators to reexamine behaviors, place them in a logical construct for informed speculation, and articulate why they may be suspicious. Also, deconstruction encourages officers to view intelligence gathering as a prevention technique, which facilitates earlier interventions of criminal and terrorist threats.

Examining Past Performance

Though criminal techniques evolve, past behavior remains a reliable predictor of future actions. Many terrorist acts show the hallmarks of a particular group because even when tactics progress, often, some historical behaviors endure. These patterns provide a starting point and direction for analysis. Many terrorist and criminal groups, like other enterprises, repeatedly use their tried-and-true tactics until they no longer are effective. When investigators recognize clues from these past behaviors, their investigation likely will proceed down the correct path.

Linking Indicators and Warnings

Indicators and warnings prove most useful for intelligence collection when they contribute to a threat assessment. A threat is a potential for harm, while a threat assessment measures the likelihood of that harm occurring. The threat assessment model includes five components: presence, capability, history, intention, and targeting (figure 4). The first three are predictive (observable statically), while the last two are reactive (require action). The intention to harm is the most critical factor of the five.

Intention also is the least tangible because it represents thoughts and motivations. However, once subjects develop firm intentions, they quickly may acquire the means to act because capability may require nothing more than picking up a gun.