Precursors of Hostile Intent:
Signs of a Potential Terrorist Attack

by John Thompson, President of the Mackenzie Institute
Current as of May 1st, 2007

This document is intended to serve as a guide to experts and average citizens alike of precursor activities and other potential indicators of a terrorist attack. It will never be a finalized document as input from police and security community continues to come in regarding their own experiences from four nations and eight agencies. The most current edition of this ongoing document will always be available on the Institute’s website (listed above).

This was written for Canadian audience although the list of precursors apply everywhere that Jihadists might attack. In the interests of public safety readers are free to print, post or distribute copies as they see fit (or amend the reporting information in other nations), we only ask that the normal conventions of accreditation are observed.

1. Some day, maybe in a few months or perhaps not for a couple of years, Jihadist terrorists will deliver an attack in Canada, or will directly threaten Canadians in some manner overseas. Al Qaeda’s usual style is to attempt to inflict as many casualties as possible, but also to hit targets of economic importance and which may hold some symbolic value.

2. Although many Canadians entertain false hopes that we will be spared from Jihadist attentions; it is already clear that the Jihad movement is in Canada. Numerous al Qaeda members have Canadian connections, including the Khadr family, the Jabarah brothers from St. Catharines Ontario, and dozens of others.

3. Police in Ontario arrested 18 accused ‘homegrown’ Jihadists over a truck bomb plot in 2006. Two Canadian women of Egyptian origin also got CSIS interested in Kassim Mohamed, likewise of Egyptian origin, in early 2004. Mohamed was busy filming details of Toronto’s subway system, fire exits from the CN tower, Toronto bank towers, and other points of interest. We also deported 19 young Pakistanis in 2003 for acting suspiciously

4. Inside police and security agency circles there are stories of other reconnaissance-style activities in various places in Canada. From the US, the UK and Australia, there have been press reports of such activities directed towards ambulances, hospitals, military airfields, churches and synagogues, schools, power stations, government buildings, office towers, fuel tankers, chemical plants and refineries.

5. Over the past five years, Osama bin Laden has directly instructed Jihadists to attack ten nations: The United States, Great Britain, Australia, Spain, Canada and Italy, as well as Morocco, Egypt, Jordan and Saudi Arabia. So far, successful attacks were made against all but Canada and Italy. Canada’s turn is coming soon.

6. Almost all successful terrorist attacks involve reconnaissance and intelligence gathering (often by those who actually plan attacks rather than those who deliver them), and the attackers themselves might stage some dry-runs to rehearse their attack before delivering it. Therefore, the first line of defence against terrorism depends on an alert and aware citizenry – people who are cognizant of what could be precursor activity for an attack and are confident enough to report it.

7. The following should trigger your suspicions:

• The theft or loss of badges, credentials, ID cards, Government/military/emergency vehicles, uniforms, or the discovery of false IDs. Attempts to scout seven hospitals in the US in March and April of 2005 involved fake credentials and ID cards. This includes theft of uniforms from dry-cleaning shops -- report such incidents assiduously.
• Photographing, sketching or surveillance of buildings and facilities (see paragraph 4).
• Trespassing near key facilities or in supposedly secure areas, particularly by multiple persons.
• The presence of uncommon or abandoned vehicles, packages, or containers.
• Persons who seem to be making careful note of the presence of security cameras, anti-vehicle bollards, and similar security measures around potential target buildings.
• Observing people who are searching trash containers or placing unusual items in them (particularly around transit systems or the lobbies of crowded buildings -- but also around the private residences of important people).
• Thefts of sensitive military or government property such as computers.
• Purchases at Government surplus sales of military, police, fire or paramedic vehicles and equipment, particularly if there are indications of an intention to refurbish them to working condition.
• The attempted purchase or theft of large numbers of weapons (including knives).
• The attempted purchase of supplies necessary for the manufacture of explosive devices -- this includes an unusual or frequent purchase of fertilizer or cleaning supplies. Acetone and Peroxide are key components in a particularly devastating home-made explosive.
• An increase in cyber attacks/probes and demands for information about facilities, personnel or standard operating procedures through e-mail. These may include 'surveys' from supposed security professionals, requests from students, etc.
• An increase in the number of threats or false fire alarms to facilities that require evacuation. If a false alarm is rung, watch for onlookers who are observing your reaction.
• Unknown workers trying to gain access to facilities for repairs, installation of equipment, etc.
• The installation of unauthorized surveillance cameras from an unknown source.
• Unusual patterns of seemingly unimportant activity: Examples might include increased foot traffic into a little used access tunnel underneath an office tower, or a fisherman who keeps returning to a point close to a nuclear power plant.
• Unknown persons or occupied vehicles loitering in the vicinity of a potential target for an extended period of time.
• Attempts to gain information from janitors, receptionists, and other entry-level employees.
• The loss or theft of large quantities of toxic industrial chemicals such as chlorine, ammonia, bromine or nitric acid -- as these may be used for improvised chemical weapons, sometimes in association with a vehicle-sized bomb.
• Any attempts to purchase quantities of the above with cash and/or by unusual customers.

8. While al Qaeda usually prefers attacking with a sequence of bombs (often delivered by suicide attackers), the mail bomb is still a potential hazard. Be suspicious about:

• Mail that has no return address (if there is a return address and you are suspicious about the package, call them and ask if they sent something).
• Mail addressed only to the title of the prospective recipient or that uses an incorrect title.
• Misspelled words or defective addresses.
• Restrictive markings such as "personal for...." or "to be opened only by..."
• Excessive postage -- the sender might not have wanted to deal face to face with a postal clerk to get the package weighed and stamped with exact postage.
• Stains, discoloration, oiliness, crystallization, or a strange odor.
• Abnormal size or excessive wrapping, particularly if the package is heavily taped or wrapped with twine.
• Wires, metal foil, string or a cell phone antenna protruding from the package.
• An unusually heavy or unbalanced feel to the package (the mail bomb the Institute received some years ago felt like there was a large ceramic mug inside a box).
• A lopsided or uneven envelope -- a hard lump like a watch battery might well be part of a bomb's triggering circuit.
• A very rigid envelope.
• A springiness in part of the package (which may be part of the trigger -- do not keep testing it).
• A suspicious package which was dropped off rather than brought in by your normal method of postal delivery or courier service.

9. One should also be suspicious about other unusual activities, including:

• A large group of men (particularly, but certainly not exclusively, 'Middle Eastern' looking men in their 20s or 30s) who occupy a house, apartment, or motel rooms with no apparent purpose; and who have no apparent patterns of arrival/departure consistent with commuting to work or school.
• If there is a smell of chemicals coming from the above site, call it in immediately! They may be cooking up explosives.
• A similar group that is interested in renting (especially for cash) office space or an apartment yet appear to perform no apparent function with it.
• People who are in possession of large amounts of cash for no apparent reason.
• People who attempt to purchase or lease vehicles or boats with cash, and who seem evasive about the paperwork.

10. Regarding suicide attackers, look out for these indicators:

• A shaved head or short haircut. A short haircut or recently shaved beard or moustache may be evident by differences in skin complexion on the head or face.
• May smell of herbal or flower water, as they may have sprayed perfume on themselves and clothing to prepare for Paradise.
• Suspects have been seen "praying fervently, giving the appearance of whispering to someone." Others have been described as agitated or very nervous.
• Suspects may also be hugging their packages, or keep checking the contents of a backpack or heavy shopping bag.
• Recent suicide bombers have raised their hands in the air just before the explosion to prevent the destruction of their fingerprints. They have also placed identity cards in their shoes because they want to be praised and recognized as Shaheed.
• Suicide bombers often look furtive and may be having a hard time 'fitting in' with the normal street scene. LTTE suicide attackers at the Colombo Airport in Sri Lanka approached their targets by acting as a picnic party on the runways. Palestinian attackers have often been identified by Israeli civilians as they approach to attack.
• Additionally, loose or bulky clothing, often inappropriate for the weather and circumstances, can conceal a vest bomb (though many have used backpacks instead of vest bombs, particularly in the summer).
• Look for someone maneuvering to get close to a VIP or a large cluster of people.
• Suicide bombers often try to avoid coming near security or into contact with any authority figure until it is time to launch their attack.
• Male suicide bombers often wear multiple sets of underwear (as many as ten in some cases) and a protective cup over their genitals to protect these in anticipation of the 72 Virgins they believe will be accorded a 'Martyr' in the afterlife. An odd fit to the pants may be another indicator.

Remember! There may be more than one attacker; people who remain widely separated (by over 5m) but keep in eye contact with each other should be regarded with suspicion.

11. Vehicle bombs are one of the most common forms of attack for modern terrorists, be suspicious of:

• Vehicle bombs are one of the most common forms of attack for modern terrorists, be suspicious of:
• Vehicles that have a strong chemical smell, or the scent of something burning coming from them.
• Signs of recent body work, especially of poor quality, or with patches welded to the cab or body of the truck.
• Extra fuel tanks or extra antennas, or recent signs of a reinforced suspension.
• Inappropriate license plates or misspelled artwork or badly executed stencil painting. A vehicle bomb can sometimes be disguised to look like an emergency or services vehicle.
• Heavily tinted windows, particularly if used in an unusual manner (for example, if the front screen of a delivery truck is tinted).
• Be wary of signs of large boxes, fuel canisters, extra batteries and similar objects that can be seen inside the vehicle.
• Signs that the vehicle is heavily over-loaded on its suspension.
• Drivers whose behaviors resemble those described in Section 10 above, or who insist on parking close to a crowded or hardened target should be regarded with suspicion.
• Remember! There may be more than one vehicle bomb present.

12. Custom and immigration workers, as well as police, should also be alert for:

• People with chemical burns and/or shaved chests (one arrival in Canada tried to explain that the burns were so that he could match his passport photo!).
• False documents, especially from visa-exempt countries such as EU nations, the US in Canada (and vice versa), Australia, Singapore, etc. If in doubt ask your subject about the national anthem, currency, landmarks, etc. from the country he claims to be from.
• Anyone with damage to the laminate layers of a plastic ID card -- as these could have been altered.
• Persons who come via another country than the one that issued his passport. For example, someone traveling on a forged Spanish passport might arrive in Canada via the UK, as his forgery could be easily spotted if he arrived directly from Spain. The al Qaeda manual advises Jihadists to use this indirect approach when traveling.
• Is this person trying to enter during a weekend or holiday, when it might be assumed there would be fewer and/or less attentive staff at the airport?
• What currency has he got in his pockets? Coins can be very revealing: ATMs and money exchanges never give or accept coinage, and these would be especially telling about where the subject has been -- particularly if there is a discrepancy between his story and the contents of his pockets.
• Are there any duty free stamps on his cigarettes? From where? Or his toiletries?
• Is he carrying matches or a lighter and no cigarettes?
• Is he carrying maps and photographs, diagrams, something coded (like phone numbers), or a list of temporary/casual e-mail addresses (hotmail and yahoo accounts particularly)? Are there CD disks that are plain and unmarked, especially if they are tucked in the case or jacket of a commercial product?
• Is there an album or disc of photographs? Are any missing? Remember that digital cameras put a sequence stamp on each photo.
• What books or magazines is he carrying? In what languages, and where were they printed?
• If entering the country on a student visa, does the school actually exist? Is it legitimate? Can this registration be confirmed?

13. Should you notice any of the above points, don't be afraid to quickly let your local police know about them. Canadians should first call the National Security tip-line at 1-800-425-5805. If calling 911, ask for a supervisor as most of them will know where to forward your call.

14. Make sure your report is clear and factual, share your suspicions but emphasize the reasons why they arose in the first place. Record your observations as quickly as possible, while your impressions are still fresh.

15. If something or someone attracts your notice, take no action other than to report it immediately. Do not attempt heroics -- this may deter a possible attack, but not the broken neck that a startled Jihadist might deliver to you personally if you grab him (or the assault charges or lawsuit if you grabbed an innocent party). Besides, terrorists are skittish about discovery and the impression that they have kindled your suspicions may be enough to send them scuttling off elsewhere.

John Thompson is President of the Mackenzie Institute which studies political instability and terrorism. He can be reached at: mackenzieinstitute@bellnet.ca