Terrorism Awareness & WMD
Nature of terrorism, weapons of mass destruction (chemical, biological, radiological, nuclear, explosive), suspicious-activity indicators, and coordinating and sharing critical information with appropriate authorities.
Nature of terrorism and the 'See Something, Say Something' culture
Terrorism is the use or threat of violence against people or property to coerce a government or population for political, religious, or ideological aims. The categories most often discussed in U.S. training are international terrorism (groups directed or inspired from abroad), domestic terrorism (U.S.-based extremism across the ideological spectrum), and lone-wolf attackers (individuals acting alone, often radicalized online, who give the smallest pre-attack signal). Private security is on the front line because so much of American critical infrastructure — energy, transportation, water, healthcare, large venues, faith centers — is in private hands. You are the closest set of eyes. The DHS 'If You See Something, Say Something' campaign is the cultural foundation: report unusual behavior to the right authority, even if you are not sure. Reports do not have to be certain to be useful; analysts at fusion centers stitch small reports together into patterns no single guard can see. Your hesitation costs more than your wrong call.
Suspicious-activity indicators — the seven signs of pre-operational activity
Terror attacks are usually planned for weeks or months and leave traces. Watch for the seven commonly taught pre-attack indicators. First, surveillance: people watching, photographing, sketching, drone overflights, or pacing entry and exit points of a facility that is not a tourist site. Second, elicitation: someone asking questions about security shifts, camera coverage, alarm response times, or staffing levels, in person, by phone, or by email. Third, tests of security: vehicles approaching restricted gates and turning around, false alarms set off to measure response, repeated attempts to enter back-of-house. Fourth, supply gathering and funding: large purchases of precursor chemicals, fertilizer, fuel containers, weapons, body armor — often paid in cash and shipped to short-term addresses. Fifth, suspicious persons out of place: someone in heavy clothing on a warm day, someone present too long with no apparent reason. Sixth, dry runs: full or partial rehearsal of an attack route, timing a walk-through, dropping a backpack and retrieving it. Seventh, deploying assets: positioning vehicles, materials, or people in final positions just before an attack. None of these is conclusive on its own. Together, or repeated, they are exactly what attack planning looks like. Document specifics — vehicle plates, descriptions, times, locations — and report up.
Weapons of mass destruction — CBRNE indicators
The acronym CBRNE captures the categories of weapons of mass destruction: Chemical, Biological, Radiological, Nuclear, Explosive. Chemical agents — choking, blood, blister, or nerve agents — often announce themselves with multiple casualties showing similar symptoms in the same area, unexplained odors (bleach-like, fruity, garlic), dead birds or insects, and visible vapor clouds where there should be none. Biological agents (anthrax, ricin, pathogenic outbreaks) are often invisible at the moment of release; the warning is a cluster of unusual illnesses, or a suspicious envelope with powder. Radiological devices, including dirty bombs, mix conventional explosives with radioactive material; the explosion is the visible event, the radiation hazard persists silently — distance, time, and shielding are your defense, and Geiger detection happens at the response level. Nuclear devices are the rarest and most catastrophic; the indicators are at the strategic-intelligence level rather than the patrol level. Explosive devices remain the most common WMD threat by a wide margin and include vehicle-borne IEDs, suicide vests, and mailed devices. Your role is not to identify which agent; your role is to recognize that something is wrong, evacuate upwind and uphill, isolate the area, and call 911 immediately so the right HazMat and EOD assets respond.
Reporting channels and civil-rights compliance
Reports follow a layered structure. Local law enforcement is almost always first — 911 for anything happening now, and the local PD non-emergency line or your contracted PD liaison for after-the-fact reports. The FBI's Joint Terrorism Task Force (JTTF) is the federal-state-local body that investigates terrorism cases; many JTTF tips originate from private security observations. California's State Threat Assessment Center (STAC) is the statewide fusion center, with regional fusion centers including the Joint Regional Intelligence Center (JRIC) in Los Angeles, the Northern California Regional Intelligence Center (NCRIC) in the Bay Area, the Sacramento Regional Threat Assessment Center, the Central California Intelligence Center, the Orange County Intelligence Assessment Center, and the San Diego Law Enforcement Coordination Center. Your employer should have a written escalation path; learn it before you need it. Suspicious Activity Reports (SARs) that flow into fusion centers must comply with civil-rights and privacy rules — the federal framework at 28 CFR Part 23 governs criminal intelligence files maintained with federal funds, and California has its own privacy and civil-rights requirements layered on top. Report behavior, not identity. 'Two people photographing the building's loading dock for 20 minutes' is a usable report; 'two foreign-looking guys' is not — it tells analysts nothing and it tells courts you were profiling. Your training, your post orders, and the law all point the same direction: see behavior, document behavior, report behavior.
Last updated: May 2026