Following the bombing of the Boston Marathon, I’ve been reminded of something I heard during a counterterrorism training program I attended in Israel in 2006. The Israelis succinctly compared their strategy to that of American law enforcement:
“You look for the bomb... we look for the bomber.”
That statement struck me like a ton of bricks. As I have pondered this statement, it has become very clear that our efforts in fighting terrorist activity — and even criminal activity — is that all too often, we look for things rather than behaviors.
As has been discovered since the 9/11 terrorist attacks, the methodologies of terrorists continually change. Sure we see patterns of activity (such as the persistent and continuing use of bombs) but components and concealment tactics are continually changing.
Before it actually happened, very few people would have thought that a bomber would place a bomb in a shoe or in their underpants. Few knew that liquid forms of bomb making materials would be a threat, and few had predicted that printer cartridges would be used as a concealment device.
We respond to these changes by adding new (and more restrictive) search procedures, such as removing shoes or not carrying more than three ounces of liquids at our airports.
Our strategy is to hope that we can spot terrorists activity by looking at things rather than the behaviors of the people who commit these acts.
The saying, “Guns don’t kill people, people do” has been ascribed as a right-wing talking point, but the implications of the statement depict the same concept of looking at a thing rather than the behaviors of the people who commit the act.
The Hinky Detector
One of the greatest acts of detection and prevention of a terrorist attack was not focused on things, but the behaviors of an individual. On December 14, 1999, Agent Diana Dean stopped an individual claiming to be Bennie Noris, at Port Los Angeles, Washington as he claimed to be a Canadian citizen who was coming to the United States.
Agent Dean observed the individual’s behavior, which she described as acting “hinky.”
Based on her instincts while observing behavioral cues, the individual was investigated further and found to be Ahmed Ressam. Ressam was transporting bomb-making materials and planned to attack the Los Angeles International Airport.
He later became known as the Millennium Bomber.
Had he been successful, his plan could have been worse than 9/11, but thanks to the observational skills and instinct of a sharp Customs Agent, this act was prevented.
I, too, had an incident when working as a security director for a major corporation. The company I was working for had an extremely high turnover rate. At least weekly I would be called to sit in on terminations of employees that management thought “might go postal.”
During the hundreds of meetings, I continually watched the behaviors of the individual as they lost their jobs. I often observed anger, fear, and/or sadness.
One employee termination stands out in my memory, and is instructive here. To make a long story short, at the human resource representative’s request, I escorted the terminated employee from the building.
I watched his behavior. He made no threats — in fact, he said very little. But still, I knew something was very wrong. There was something extremely suspicious about the way he was reacting.
After watching him depart in his vehicle, I returned to the Human Resources Department and said: “This guy is going to kill someone.”
I immediately began an investigation. I found 30 firearms owner applications in his filing cabinet. One of the applications was filled in and signed by another employee of the company. That employee said the terminated employee believed management to be “against all employees” and he was trying to get other employees to arm themselves and take action.
He further stated his belief that the former co-worker was going to return to kill his manager and others.
I arranged to meet with law enforcement, a psychologist, and the individual’s father.
The situation was successfully mitigated when the individual agreed to go into a treatment facility and get the help he needed.
We prevented what might have been a tragic act of workplace violence.
Normal and Abnormal Behavioral Clues
The calls cops get provide a constant diet of observing negative, aberrant, and abnormal behavior. Cops don’t get called to attend “Mary and Bobby’s 25-year wedding anniversary party.” Cops get called because “Bobby just hit Mary on the head with his golf club.”
We look for (and find) criminal and/or abnormal behaviors, but it’s important to look for and observe normal behavior.
Why? Because when we see and understand what normal behavior looks like, it’s easier to distinguish it from aberrant or abnormal.
So, how can we build up our knowledge base of observed normal behaviors? Where and how can you do this?
One of my favorite training grounds is the airport. Instead of getting upset about a flight delay, I find a comfortable chair and watch the people as they interact. I watch (and even eavesdrop on) what’s going on during interpersonal encounters among the waiting passengers. I watch facial expressions during the exchange.
Another good training ground is the grocery store. I watch the interaction between a grocery store clerk and a disgruntled customer who has to wait because an item does not have a readable UPC code. Is this interaction “normal” frustration or is it something else?
Conclusion
To be more effective in our efforts to prevent acts of terrorism or criminality, we need to develop a strategy that includes a concerted effort to look at behaviors which can provide significant cues for further investigation or immediate action. To refine this observational skill, we need to observe and understand the “normal” opposite behavior.
Assessing behaviors is non-prejudicial — it doesn’t matter if you’ve got a soccer mom or a Middle Eastern male, behavior is behavior!
In the prophetic words of Yogi Berra, “We can observe a lot by watching.”
