Behavior of the Boston Marathon Bomber

April 19, 2013 in Applying The Observations

Like many people, I haven’t strayed too far from the TV today as I’ve been waiting to see this massive manhunt end and Dzhokar Tsarnaev get taken into custody.  I saw this interview describing the behavior of the 2nd suspect on the day after the Boston Marathon Bombing and thought it would be worth sharing.  In this clip, CNN interviews the owner of a car shop frequented by Dzhokar and describes the way he was acting 24 hours after the attack.

Listen to the way the owner describes his behavior.  The owner says that Dzhokar was acting like he was on drugs, that he was biting his nails, that he was nervous, and that he was walking in circles.  These are all indicators from the Uncomfortable Cluster.  What makes this observation so important is that the owner states that he never saw him act this way before – ever.  He might not use the words “deviating from the baseline” or that his behavior was an “anomaly,” but that is exactly what he is saying. This Uncomfortable behavior that people may otherwise classify as jittery, nervous, or anxious is a tell-tale sign of someone experiencing a stress response. To see where this stress response comes from and why it is such a reliable indicator, take a look at this article here.

 

[expand title=”Read Video Transcript”]

Reporter:        …and acted very curiously with this auto-body owner, so he thought he was on drugs it was so bizarre. He’s known him for two years, never seen him like this. The day after the marathon, watch this.

Shop Owner: Tuesday I saw the youngest man, you know, the youngest brother. He came to my shop, he was standing right there, and he came, I’d say it was around 12:30-1:00. And he had a car that he dropped in here, which was two weeks ago and he told me the car belonged to his girlfriend. You know, he disappeared for two weeks and then Tuesday he came, he said “Where is the car?” I said, “The car is in the parking lot, but I haven’t worked on the car yet. He just removed the rear bumper and he removed the taillights. But he said, “I don’t care, I don’t care. I need the car right now, I need the car right now.” I said “Why? You know me, it takes time.” He said, “No, I need the car right now, and he was biting his fingernails which he’s never done before.

Reporter:        So he was nervous?

Shop Owner:  Nervous, very nervous. I thought he was on drugs, to be honest with you; because I never seen him, you know, I’ve known him for probably two years and I never seen him acting the way he was acting.

Reporter:        Did he appear injured at all?

Shop Owner:  No, no. He was nice dressed, and I told another friend of mine that he had a pair of shoes, which costs like $900. When the friend of mine asked him about his shoes and what he paid, he said “I payed $900, which was a Louis Vuitton, you know. He said “Give me the key.” I said “The car’s in the parking lot but there’s no tail light”; and he said “I don’t care, I’m going to take the car the way it is because my friend, she wants the car back.”

Reporter:        Was he here, so you’re saying we’re just feet from where he was?

Shop Owner: You know I was working on a car in here, was putting a car together and he came and at first he went in a circle, you know, he bite his fingernails; which I thought it was hid friend. I said, “This dude is on drugs.” He said “I want the key, I want the key. I gotta take the car right now.  So I gave him the key and he left.

Reporter:        Was he here alone, or with someone?

Shop Owner: Alone. He lives right across the street, that’s why he always used to come in here, you know, see the cars, or brings friends to repair the cars.

Reporter:        What kind of car was it? Was it a nice car?

Shop Owner:  It was a Mercedes. It was probably like a 2007 Mercedes, Wagon, Station Wagon. Which is a nice car, really worth a lot of money; and all his friends, which they said they’re from Turkey, you know, they go to BU and MIT. They all want new cars. Brand new cars, I’m talking high end cars, you know, Range Rovers and Porches, and BMW’s, which is nothing new. You know, Boston’s a college town, you know some kids, they come from overseas they have the money to afford to buy new cars.

Reporter:                    Has he always had the kind of money to afford $900 sneakers?

Shop Owner:              I mean, as far as I know, he always dreamed about buying new cars. But I don’t think he could afford to buy a new car though. He always was riding with his friends, which they own, you know, expensive cars. But, he himself, I don’t think he could afford it.
[/expand]

Matt Sampson Follow Up Interview

April 17, 2013 in Applying The Observations

After sitting down with Matt Sampson for an interview on New12 Westchester, we had the chance to talk a bit further about how people can be aware of their surroundings in public.

Transcript

Public places, just constantly be looking for what is normal behavior for wherever you are. If you’re in a mall, a church, a school, a public place, constantly be looking for what you’d expect to see people doing. Whenever you see anyone who deviates from that baseline, who is acting abnormal, that person should attract your attention. You should be confident in that assessment that they’re acting differently for a reason. It can help you focus your behavior on a specific person instead of the crowd as a whole to begin to recognize threats before violence happens.

There was a group of Marines that I worked with who, before they were deployed to Afghanistan, went through our course. When they were in Afghanistan, they were on patrol through a marketplace. They were used to seeing people be very comfortable, very relaxed around the Marines when the Marines were in the marketplace talking with them. There was one vehicle that drove past them, and the looks that they were given by the people, the males inside the vehicle, were what we would call very dominant behavior. They were aggressive. They were posturing.

One of the Marines that went through the course recognized that, that stood out from what he expected to see. The Marines went on high alert. As the vehicle went just a little bit further down the street, two guys got out of the vehicle and went in separate directions which for that Marine, he said, that’s not normal either. All the Marines began to pull away from that vehicle as quickly as they could. Soon after the two guys left the vehicle, the one remaining person in the vehicle detonated the car bomb. Had that Marine not recognized those cues or not been confident that there was something off about that vehicle. When he came back, he talked to me, he said that was the training, it was the course that ultimately let him realize that he should be nervous.

A Justification For “Run – Hide – Fight”

March 5, 2013 in Applying The Observations

I was recently asked my opinion about the different responses to active shooter incidents that are currently being advertised by some of the different security providers.  While this site is dedicated to preventing violence, it would be naïve to think that we can prevent every incident. The bottom line is that we support and recommend the “run – hide – fight” response to any violent incident.  To be clear, we certainly still encourage people to focus on preventing these attacks from occurring using the strategies explained on the site, but the “run – hide – fight” is a response to violence is our recommended process if an incident can’t be averted.

The reason for our choice of the “run – hide – fight” model is due to the way people make decisions under stress as well as the way that people naturally respond to situations that pose a threat to their personal survival. Continue reading »

Beginning With The Baseline – Beyond The Formula

February 18, 2013 in Applying The Observations

Recognizing that violent acts are going to occur requires that we observe more than just the criminals, insurgents, and terrorists plotting the attacks.  Obviously, by identifying those individuals we can get much further left on the attack timeline, however the reason we start by establishing a baseline for the area you are in is because human behavior can provide a great deal more information than that singular purpose.

Think about this.  Every Atmospheric Shift is caused by an anomaly, but not every anomaly causes an Atmospheric Shift.  There are situations when you simply feel that something going to go wrong because you see a shift in the collective mood of the area.  While this is a very clear indicator, without first having a baseline to compare to, there is the chance that you question your suspicion or second-guess yourself.  There are other times when a criminal can be subtle enough to avoid causes the ripples in the environment that would attract your attention.

[expand title=”Read Text of Speech”]
The key is identifying anomalies. That is what everyone wants to do. The anomaly is the attacker. The anomaly is the insurgent, the criminal, the terrorist, whoever it is that we’re out there trying to stop.

A lot of training exists of how to specifically find that anomaly. What cues might a single person give off that should alert us to their intentions? There’s a lot of training that’s out there that focuses on the decision. Once we know who the enemy is, how are we going to deal with him? What’s unique about being an anomaly, though, is that the anomaly is in relation to something to stand out. The person who has those violent intentions will stand out, but you have to stand out compared to something. You have to understand the baseline for the area that you’re in. Individual people have baseline behavior, groups of people have a baseline; what is normal, what’s expected.

You can look at a small, confined area like a Starbucks and identify what the baseline is. When people come through that door, we can predict, there’s give or take about five steps that every single person will do once they walk through that front door, as soon as they deviate from those patterns, we can start to pick up on them. But until we understand what’s normal for an individual, for a group, for a small confined area, even for an entire village, or a specific situation like a protest or riot, once we know how to define what’s normal, the anomaly will stand out. The anomaly becomes much more apparent to us once we’ve taken the time to explicitly state what’s normal here.

[/expand]
Here is why:

Continue reading »

Training Beyond The Physical Terrain

January 31, 2013 in Applying The Observations

A response to “Defining The Human Terrain – Revealing Core Patterns.”  

What is the “human terrain”? As Pat notes in his article, although the word has been thrown about for the past few years, it has not been clearly defined. A recent thesis written at the Naval Postgraduate School puts the matter plainly:

The term “human terrain” encompasses a wide variety of concepts and meanings.  It came  into widespread use following the events of September 11th as a catch all phrase to describe the human dimension of the operational environment, including groups’ and individuals’ feelings and inclinations. However, as a stand alone term, human terrain has not been officially defined by the DoD. Although its use is widely prevalent, human terrain is currently an imprecise term, which is vague and nebulous.

Human terrain implies two specific requirements based upon its name. First, the activity, action, behavior, or trait originates from an individual human or a group of humans. Secondly, the trait must be tied to a geographic location. These traits may be an observable action as well as cognitive (examples: identity, motivation, values) or not readily observable (examples: family affiliations, language, education level).

(E. B. Eldridge and A. J. Neboshynsky, “Quantifying the Human Terrain” [Thesis, Naval Postgraduate School, 2008], 18-19.)

Our military forces have excelled at defining, categorizing, reading, navigating, and maneuvering the physical terrain. We’ve incorporated aspects of the physical terrain into every element of our military training. We have done this both because we operate in physical environments, and because we know that whoever controls the ground has a critical advantage in any conflict. Our Marines and soldiers, enlisted and officers, are trained in land navigation and map reading. Our leaders are able to conduct detailed assessments of the terrain in order to plan operations. We can easily categorize the accessibility of a piece of terrain by a quick look at a map, and can identify key terrain without much effort.

Unfortunately, we have neglected a critical piece of our operations, the human terrain. Since Sept. 11th, our military has been in a scramble to understand one of the most basic elements of human life—people. As the authors of the aforementioned thesis describe, the human terrain is basically a look at human activity and interaction within a particular geographic environment. But even this definition is almost too broad to be useful. One of the issues is that the human terrain, like the physical terrain, can be viewed from various perspectives. A pilot sees the ground differently than a rifleman. A squad leader sees an area different than a company commander. The same is true for the human terrain. A Marine rifleman sees the populace and their activity different than does a Psyops officer. However, while physical terrain is described using common terminology, which every military person should know, the human terrain has not been given the same common language. This is unfortunate because a lack of a common “human terrain” lexicon slows down communication, causes misunderstanding, and keeps our forces from effectively collaborating. The Six-Domains of Combat Profiling (Biometrics, Kinesics, Proxemics, Geographics, Iconography, and Atmospherics) provide the terminology which all levels of operators can use to speak about the human terrain. As Pat argues, the Six Domains provide our military forces with the ability to easily quantify the human terrain, and enables cross-communication. We encourage soldiers, Marines, commanders, and everyone operating overseas to make the Six Domains “household” terminology. Not only will doing so help communication, but will also begin to build a Combat Profiling mindset among everyone in the military. This will enable proactive thinking and the type of situational awareness necessary in the types of irregular warfare our military fights in the modern era.

This article has become part of an e-book that can be downloaded here

Learning Your Beat

January 31, 2013 in Applying The Observations

A response to “Defining The Human Terrain – Revealing Core Patterns.”

What the military is only now beginning to utilize in regards to reading human terrain has been a prerequisite for successful urban law enforcers for decades. As Patrick stated in his article, the need for our nation’s military to become more capable of separating the enemy from the crowd he hides amongst becomes an increasingly relevant skill-set.  This skill set is what has defined and set apart the successful, street-smart urban law enforcement professional from all others. Though the collection and subsequent analysis of data concerning political, social and economic factors can and should be used by a higher level in the chain of command for strategic planning and decision-making purposes, such information does little to provide the domestic law enforcer or Marine the ability to spot the criminal element before a criminal act is executed.  Herein lies an important component to understanding the difference between strategic decision-making and tactical decision-making.  Tactical decision-making is necessary to keep the boots on the ground “left of bang” and free from the pitfall of “paralysis by analysis,” when there is little time and/or little information to work with.

Law enforcement agencies have struggled for years to find the right balance in regards to the amount of time an officer remains on a particular beat or district.  Often the concern is allowing enough time for the officer to “know his beat” (establish a baseline for the area and hone his skills at spotting anomalies) versus preventing an officer from becoming too comfortable, which can lead to boredom, complacency, or worse, varying levels of corruption.  In any event, just as current rotation schedules impact military personnel, unlimited time on target, whether for the beat cop or Marine, is nonexistent.  As a result, both need tools that allow for an expedited establishment of the baseline and an expedited recognition of the anomalies.  Urban warriors, whether they be domestically situated or occupying foreign soil, must be able to make quick, tactical decisions.  They need to be able to address the “here and now” that keeps them left of bang.  The ability to do such results from understanding real time group and individual behaviors that are indicative of a threat.  This threat could be anything from the next gas station robbery, home burglary or the IED implanter or suicide bomber.

One of the most common complaints lodged against young, inexperienced police officers are the allegations of improper and unnecessary, stops, searches, and other contacts.  The second most common complaint may well be the internal complaint from superiors and peers for lack of initiative, not being proactive, sub-par numbers, and general incompetence in effectively addressing crime and disorder.  This often results from the inexperienced officer not recognizing benign, normal behavior for the area compared with truly criminal behavior.  When you don’t know what you are looking for, or looking at, everything and everybody will either look completely innocuous or of criminal intent.  Both of these inaccurate assumptions can have dire consequences.  Failing to recognize a threat on the street corner or battlefield can be worse than mistakenly detaining an innocent party.  Such actions, or lack there of, by police officers, do little to build public trust, and can hamper efforts at empowering residents to change an area plagued by crime and violence.  The same can be said for counter-insurgency efforts fostered by military personnel.  Good people want to know that we can discern the good from the bad quickly and deal with the bad efficiently and effectively.  When we can’t do that, public trust erodes and the true criminal element becomes empowered to operate.

For the law enforcer, knowing ones beat means far more than knowing the geopolitical boundaries, major streets and intersections, the quickest ways to traverse an area, where the chronic complainers and crazies live, or which establishments offer the beloved half priced “cop deals” on everything from tires to torpedo sandwiches.  Knowing your beat means first establishing the collective “norm” (the baseline) of the area of responsibility by viewing the surroundings with an understanding of not only the “what” associated with habitual areasanchor points and natural lines of drift, but the “how” as well.  Knowing how to use the personal knowledge of those geographic features to secure an area, identify threats, and collect intelligence for future operations can make the difference between furthering the mission objective or furthering the ability of the criminal element to thrive.

A basic tenant of being street savvy means being able to read and understand Iconography, and knowing how to use it to ones advantage.    Proxemic pushes and pulls in an area can and do, tell a police officer a lot about how the police are perceived and the level of trust, respect, admiration, fear, or reverence a neighborhood may have for a particular officer or the force in general.  Reading body language or Kinesic cues have saved many officers lives during that car stop, pat down, or simply a bar patrol.  Baseline establishment, or “knowing your beat,” as established through these lenses, is as fundamental a tool for the police officer as is a sidearm, radio or field notebook, and so it must be for military personnel charged with a similar mission.

The successful warrior (Marine or cop) does not view each of these domains in a singular or isolated fashion.  Rather each domain must be viewed collectively and/or simultaneously.  There is an interdependent relationship that each domain has upon the dynamics of the other.  Just as looking through a pair of NVG’s, binoculars or an RCO enhances the ability to see geographic terrain, allowing for the safe ingress or egress of an area, or bringing our target into better focus; viewing people and the utilization of their surroundings through the proper lenses allows us to bring the target of criminal and insurgent behavior into better focus.

This article has become part of an e-book that can be downloaded here

Defining The Human Terrain – Revealing Their Core Patterns

January 31, 2013 in Applying The Observations

The Situation On The Ground

There are two ways for our nation’s protectors to get left of bang: either to identify the pre-event indicators that are present on the ground (the physical terrain) or to find those indicators communicated by people (the human terrain).  Both components are what make up the environment, but in the search for the quantifiable information needed to make decisions on the battlefield, the physical terrain is often seen as more tangible and therefore more reliable. People can easily identify the affect that sunlight, wind, and moisture has on vegetation or the ground itself.  Disturbances caused by a footstep are present for a longer amount of time than a posture or gesture is displayed on the body, allowing the observer to spend a longer time on scene to analyze that information if needed.  However, in an urban environment with a heavily concentrated population, these indicators become very hard to find as the sheer number of people can contaminate the scene and skew the analysis.  As the world’s population migrates from rural areas into urban centers, the need for our nation’s military to become more adept at separating the enemy from the crowd he hides amongst becomes an increasingly relevant skillset.

This skill is accomplished by developing the ability to not only read and assess the people around us, but also to communicate what information the human terrain is providing.  It is a long established principle that successfully defeating an insurgency comes from successfully earning the active support of the population.  This is no different than law enforcement officers’ efforts to minimize the influence that gangs have on American cities.  Herein lies the problem; without the ability to clearly define and measure the human terrain, our ability to target insurgents effectively and earn the ability to influence the local population will always be lacking.

Defining the local population isn’t something that we have failed to attempt. We have just failed to do it well.  We have tried to gain insight through a segmentation of the population based on demographic data or mapping tribal affiliation. We have tried to measure the success of our operations by looking for economic indicators, changes in the political structure, or the existing rule of law.  We have tried to understand literacy rates, poverty rates, and social structure, without finding the valuable information we were after. While that information may help decision-makers at a higher and more detached level of command, they rarely provide any useful information to small-unit operations operating on the ground.  The decisions that the Marines and soldiers on the ground make on a daily basis require a different set of metrics – indicators that can be read immediately, with minimal analysis, and can be assessed without the support of technology.

Getting Dropped Into The Deep End

The information pulled from successful counter-insurgency campaigns and countless after-action reports from Marine units returning from deployments show us that the units who are most effective at intuitively understanding this ambiguous human component of the environment are also the ones who have spent the greatest amount of time in an area. The continuous exposure to a single neighborhood over time allows an operator to develop a tacit understanding of the patterns that people set and identify when changes have caused a shift in that norm.  Our current deployment cycles, however, will never allow for a deployment long enough to successfully implement an approach like this that would be reliable.  There is also the inherent limitation of the length of time it would take for someone new in the area to develop this understanding. One unit that we spoke with mentioned that it would take them upwards of 15 patrols before members of the squad felt that they had begun to develop a working baseline. The insurgent who has lived in the village their entire life, already has an understanding of the environment, which lets them be a step ahead of a new unit that has just rotated into that area.  While the unit is trying to a feel for the area (establishing a baseline), the insurgent has already begun searching for weaknesses in the new unit that can be exploited.

The Underlying Patterns

Because success or failure of an operation is a relative term (success is in comparison to a previously existing condition) there has to be a starting point for assessment.  This means we must have a way to explicitly define what is normal for an area. The area’s baseline is that starting point. The baseline is made up of the patterns that individuals, groups, and an entire neighborhood or village sets and becomes the basis for future comparison.  To do this, we will analyze the baseline through three separate lenses using the Combat Profiling terminology.

(Note that we are looking at this simply to understand the environment that is expressed by the local population, not the enemy.  This information will need to be assessed later against a picture of enemy activity to identify enemy patterns that indicate a relationship between the two.)

The First Lens – Noncombatants

Before we can understand the enemy, we first have to understand the environment we are operating in.  This is why the first layer of observations needs to be focused on “bigger picture” patterns of movement around the village.  The initial goals are to identify the places where people go to get their needs fulfilled.  These Habitual Areas are the places where people are being Proxemically Pulled for a specific reason.  This could be for tangible needs, such as goods at the local market or restaurants, spiritual needs fulfilled at a place of worship, or the intangible goal of relaxation at a local park, playground, or beach. Once we know where people are going to end up, we can begin working backward to identify how people are getting there.  Locals who are familiar with their area will know where the Natural Lines of Drift are, and will use those to move – taking the safest, yet most simple path of least resistance to the places they are going.

We focus our observation on the “noncombatant” behavior initially in order to find the metrics we will be using for future assessments.  This behavior can also provide pre-event indicators for an attack, since any change in behavior could indicate their knowledge of a pending attack.  This could be villagers avoiding the local marketplace (a habitual area) that is normally bustling with activity because they know insurgents are waiting in an ambush.

For each of these habitual areas, baseline establishment can begin by observing “pattern of life” information, such as when people begin arriving at that area, when it is first opened, the peak times of the day, when it closes, and how many people visit to provide an additional layer of quantifiable facts to your observations. Assessments can be made about the normal Atmospherics in the area to get a reading on the normal noise level, existing rule of law, and other indicators that show the population’s perception of safety.

We can also look at any messages that an insurgent has used to communicate their beliefs or affiliations, Iconography.  These sentiments and the local’s acceptance of them may change over time and show that shift through graffiti, posters, and signs.  Later in the process, this initial assessment of civilian behavior can be overlaid with enemy activity to identify their patterns and relationships as well.  Over the course of your deployment, the human component of the environmental are what will provide the context to better understanding the population.

The Second Lens – Relationships

The second layer of observations relating to understanding the baseline is the relationship between the local population and the resident security forces.  Specifically, we are looking at Proxemics, and seeing if locals are attracted to or repelled away from the military or police.  Because security personnel maintain a position of authority and will often be the ones to close the distance with people they want to talk with as one example of Proxemics. These observations need to be coupled with Kinesics in order to confirm any assumptions.  Identifying the six clusters of individual behavior (Dominance, Submissiveness, Discomfort, Comfort, Interested, Uninterested) will show an observer how the local populace responds to that presence of authority.  As the support of the local population is often derived from their perceived sense of security, changes in these relationships can show a slow change in the baseline.  Without first identifying these patterns, they would be otherwise missed and fail to show to provide the feedback needed to show success or failure over a period of time.

The Third Lens – Personal Displays

The final layer of observations relating to understanding the baseline environment is how locals communicate information about themselves to others.  This can include Personal Iconography that shows status, beliefs and affiliations through clothing, tattoos, jewelry or other accessories they have chosen to display.  Understanding how a political leader, religious leader, schoolteacher, taxi cab driver and farmer, differentiate themselves through Iconography can help you make predictions about their interpersonal relationships and potential actions upon arriving in a habitual area.

These three lenses: looking at large scale patterns of behavior, the relationship with security forces, and personal displays of iconography, can be observed immediately upon arriving in the area because they are seen in the noncombatant masses that fill the village.  These factors can be observed from an observation post with standoff, allowing a unit to begin developing their understanding of what to expect before they come face to face with potential threats, and can begin the process of revealing how the insurgent is hiding among the locals.

An Operational Impact For The Better

The goal of intelligence is simply to reduce uncertainty.  Assessing the local population and the human terrain through these three lenses provides a quantifiable baseline and starting point. This is by no means the final answer, and we will never be able to completely see through the fog of war, but without metrics that can be clearly and confidently defined, we will continue to struggle to understand the environment we are operating in.  This terminology and these lenses can be used to guide conversation among squad members to make sure that everyone has the same understanding.  This ultimately can help to shorten the time required for a new unit to understand the village and become capable of looking for the enemy at an earlier point in their deployment.

Being capable of noticing and quantifying changes in the baseline over time is a requirement for determining how successful our patrols are.  However, without a clear starting point, these subtle changes are missed and decisions are made based on subjective observations that may or may not be truly accurate.  This greatly biases any determination about our progress and can cause a commander to question the quality of their intelligence.  Without a set terminology, the commander is limited to the common post-patrol statement “Atmospherics are good, nothing significant to report.” Using the Six Domains offered in a behavioral analysis program provides that quantifiable method for Marines to define their neighborhoods in terms that provide them with actual useable information that matters.

All of this information about the local population’s core patterns is assessed through an analysis of their behavior that is primarily outside of their conscious awareness.  This makes it more likely to be accurate, reliable, and objective.  By using the domain terminology, we can harness the tacit understanding of an operator with more experience in an area and pass that intuitive knowledge onto the new units taking over the battle-space.  By decreasing the time that we need to assess and understand the baseline, we can decrease the time that the enemy can operate with impunity. This not only improves our personal security, but also guarantees the success of the mission.

This article has become part of an e-book that can be downloaded here

Threats Inside The Wire – Trust Your Instincts

January 15, 2013 in Applying The Observations

A couple weeks ago, the New York Times published an article that highlighted the path an Afghan Soldier took to go from a solider and partner of Americans, to the perpetrator of another Green-on-Blue insider attack.  The first five articles in this series talked about proactive steps and observations that Marines, Soldiers and civilian contractors can make while deployed, but those articles leave out one significant factor.

In combat if something feels wrong, it is wrong. Continue reading »

Beyond Stop and Frisk

January 11, 2013 in Applying The Observations

This past week, the Associated Press reported that a federal judge in New York City ordered the NYPD to halt its stop and frisk policy, saying that it isn’t enough for an officer to have a hunch or non-specific suspicion about a person to perform a stop and frisk.  As police officers around the country ponder this ruling and how it could impact future Terry Stops, we don’t think that this should be considered a bad thing. It doesn’t limit an officer’s ability to search people suspected of committing a crime; it simply demands that officers can communicate what gave them the initial hunch.

Behavioral analysis doesn’t replace that hunch, it informs it.  Behavioral analysis provides a Continue reading »

Threats Inside The Wire – Finding The Truth

December 7, 2012 in Applying The Observations, Assessing Individuals

Behavioral analysis doesn’t make you a mind reader.  Observing someone who is showing cues from the Uncomfortable Cluster only means that they are uncomfortable.  That observation alone doesn’t mean they are about to commit a Green-on-Blue attack, we can begin putting together a plan, go into Condition Orange, but we still need more information. If you were to look at a TSA checkpoint as an example, an old woman who is nervous about going through security because it is her first time flying in a decade could give off the same exact cues as a smuggler trying to get a suitcase full of heroin onto the plane.  The only way we can narrow this field to the people who truly warrant our attention, stop insider attacks, and find the reason for their behavior is to contact them – to start a conversation.

The “contact” offers two benefits – the first is that it reduces the problem of false positives, the old woman going through the checkpoint.  The second benefit is that it provides the information needed so that you can determine why they were acting the way they were.  They have already gotten your attention, now you can figure out the cause.  This human intelligence (HUMINT) is key to stopping Threats Inside the Wire. Continue reading »

Threats Inside the Wire – The Cues and The Clusters

December 5, 2012 in Applying The Observations, Assessing Individuals

We’ve established that the context for insider attacks is the Proxemic Pull – the approaching attacker.  We covered that. But when we look at Green-on-Blue attacks, the observations we are going to make are going to be grounded in the nonverbal cues – the clusters.  This is what is going to make the attacker stand out from the baseline and let us identify him hiding in the crowd.

The four body language clusters Continue reading »

Threats Inside The Wire – The Approach

November 29, 2012 in Applying The Observations, Assessing Groups

The approach precedes the attack. It has to and Green-on-Blue attacks are no different.  An attacker must get closer to his target in order to be successful, but it also is going to cause that person to stand out from the baseline.  If you are a new reader, I recommend you take a look at the article explaining Proxemic Pulls to better understand this dynamic before moving on:

From Science To The Streets – Where The Proxemic Pull Came From

The reason for this is that attackers intuitively understand the principle that Proximity Negates Skill.  If you can’t shoot someone from 500 yards away, you have to get within a range where you can hit your target.  If you don’t have a gun, you need to get within knife striking range.  If you don’t the skill or the ability, you have to get within a closer proximity to compensate and be successful.

The consequences for failing to identify an insider threat are extremely high, and while the fact that attackers are moving closer to Marines or Soldiers can make stopping these attacks more challenging (a closer attacker reduces the amount of time available to react and limits the number of options available for dealing with the threat), it also simplifies the problem as well.  Continue reading »

Threats Inside The Wire – Finding Common Ground

November 27, 2012 in Applying The Observations

The reason that I led yesterday’s article off with the example of Nidal Hassan’s attack in Fort Hood might not be for the reason you would imagine. While this was a terrorist act in nature, the characteristics of his attack mirror those of a workplace violence incident.  In fact, it meets the exact definition of a Type 3 Workplace Violence incident as defined by OSHA.**  Nidal Hassan walked into a building where he was an employee/supervisor and committed a violent act against coworkers.

The situation in Afghanistan, where uniformed Afghan National Security Forces (ANSF) open fire on their “coworker” American trainers, is no different.  To get further and further left of bang, we first need to understand Continue reading »

Threats Inside The Wire

November 26, 2012 in Applying The Observations

On November 5, 2009, Army Major Nidal Hassan walked into the Soldier Readiness Center aboard Fort Hood and opened fire with an FN 5.7mm pistol, killing thirteen fellow Soldiers and wounding 29 more.  Even though he was a terrorist and inspired by Al-Qaeda and Imam Anwar al-Awlaki, I don’t want to focus on his ideology in this article.  What I care about is how he was able to physically get to the point where he could carry out his attack.  Nidal Hassan belonged in that building.  He wore the same uniform as everyone else. He had the ID card and all the credentials.  He wasn’t posing – he was an insider. 

In 2012, our nation’s military faced an alarmingly high number of Green-on-Blue attacks in Afghanistan. The military refers to these attacks as Green on Blue Incidents as “Green” represents the partnered Afghan National Security Forces (ANSF), while “Blue” represents the American military.  These attacks are mostly occurring on U.S. bases, spots where the military could traditionally let their guard down even just slightly.  Nidal Hassan and the ANSF present the same security challenge – how can you effectively establish provide for your own security when the threat wears the same uniform as everyone else?  Continue reading »