Identifying people who are familiar and unfamiliar with their surroundings 

March 11, 2015 in Assessing The Environment

This video analysis is part of our recently released training center content.

What Is The Setting?

We are going to do this in Grand Central Terminal in New York City.  Why GCT? Because we aren’t on the practice field anymore.  With over 700,000 people passing through the station each day (the traffic exceeds a million people during the holidays) and the constant terrorist threat to mass-transit stations, there is no better place to use as a training ground.  We will continually use this as setting for our observations because if you can establish a baseline for Grand Central, observing people smaller areas and areas with less people will become increasingly accurate.

The Way It Will Work

Here is how it will work.  The first video is going to provide an overview of the terminal.  This is your “baseline” time and a chance for you to attain a certain degree of context and understanding of the area as a whole before we focus on a specific section. Think of this as the time spent observing a marketplace from an observation post for a short amount of time to establish a baseline before you patrol in.

The baseline video clip is one minute long, so feel free to watch it as many times as you like to begin establishing the norm for the station before we shift to a more confined area.  Don’t worry about details or specifics just yet, begin with the big picture and observations from the domain of Atmospherics.

Step 1: Watch the video and establish the baseline before reading on.

 

Overall: I would assess this is as having Continue reading »

Identifying Anchor Points and Insiders With Violent Intent

March 11, 2015 in Assessing The Environment

This video analysis is part of our recently released training center content.

The dynamic of territoriality and how that concept leads to the creation of anchor points plays a critical role in the professional lives of our nation’s protectors.  Anchor points are the areas where we keep the things that are important to us and, therefore, they require the most security.  For observers, understanding how two key characteristics of anchor points – how they are created and how people interact with them – provides the opportunity to make objective assessments and predictions about the people within the places you visit.  The first characteristic, how people establish ownership of an area, empowers our military and police forces to locate the areas that criminals, insurgents and terrorists use to plan their operations and strike them in their own backyard.  The second characteristic, how people interact with established anchor points, allows all members of the security and defense industries to better evaluate the people attempting to access restricted areas.

Before we can take this concept of identifying anchor points from theory to tangible real life scenarios, the initial requirement is to understand what differentiates anchor points from habitual areas. We will do this by analyzing two video clips. The first video is taken inside the entrance to a Target store and the second clip is focused on the people entering a Costco.  Start by watching each of these clips through one time to get a basic understanding of the behaviors we will be discussing.

Target Entrance

\

Costco Entrance

We should start by realizing that both of these stores are very similar as they both offer customers a wide variety of food and household items to shop for. However, the difference between the two lies in the customers who are Continue reading »

School Security: A Dangerous Contradiction

September 17, 2013 in Assessing The Environment

As summer approaches its close, schools across the country will again be welcoming students back onto campus.  In some locations, great effort on the part of school administrators, teachers and security professionals has been undertaken to assuage the apprehension and fear of parents and students alike in regard to criminal activity within the confines of a learning environment.  However, one basic error concerning an overarching principle in security will repeatedly be made by administrators, despite their best attempts to secure our schools.  Schools will be thought of, and viewed, as anchor points, but will be treated as habitual areas. This contradiction leads to the establishment of security gaps, which create vulnerabilities that can be exploited by threats.

A habitual area is a location where people come and go with little inhibition or restriction.  It is a location where people are generally welcomed and frequent often and repeatedly.  People generally feel comfortable and move about in an inviting and relaxed environment.  Habitual areas are generally created by a proxemic pull into the area, allowing people to meet a need.  A shopping mall is a good example of a habitual area.  Generally, it is the attitudes and actions of people within the physical space that make a place a habitual area.

Conversely, an anchor point is a location where only a certain group of people are normally allowed to operate in and would feel comfortable doing so.  Individuals who are not a part of the pre-established group would not be welcomed in the anchor point.  Anchor points provide safe haven and a sense of increased comfort and security for those who are part of a specific group or subset, but only to the extent that the anchor point is secured and defended.  Anchor points are a “base of operations” allowing selected individuals or groups to operate in a controlled environment with familiar people with common goals and objectives.  There is also a proxemic pull for anchor points, but only for those who are a part of the group allowed in the location.  Unlike habitual areas, there is also a proxemic push away from the area for the unwelcomed that are not a part of the group. Like the habitual area, it is to a large extent the attitudes and actions of those within the anchor point that defines it as such.

The physical setting does also contribute to the establishment and identification of a habitual area or an anchor point.  Physical security measures such as fences, gates, the layout of walkways, lighting and entry points, help define the area and set the mood, tone, and expectation of those entering and operating within the area.  The addition of iconography (signage, symbols, markings and writings) communicating the belief, association and principles of those operating in the area can paint an accurate picture of who is welcome, what criteria must be met and the operating mores within the area.

Schools, perhaps more than ever, need to be anchor points.  Past acts of horrendous violence make this point undeniable.  However, simply believing or stating that a location is an anchor point doesn’t make it so.  It’s dangerous to declare a place to be an anchor point or have a belief that it is, yet operate it as a habitual area.  This creates false bravado, diminishes our situational awareness and impedes our ability to spot anomalies.

Patrick Van Horne talks about an experience that illustrates this point beautifully.  After the shooting last winter in Newtown, CT, Pat had scheduled a meeting with school officials to discuss training aimed at increasing situational awareness, and thus overall school security.  Pat was to meet with the school officials at the school in question.  The school officials, after meeting with Pat, boasted about the security measures they had already put in place.  They took great pride in explaining to Pat the high degree of safety, security and control they had implemented.  They questioned the need for Pat’s expertise and the training he could provide.

What those school officials did not know was that Pat had arrived early because he wanted to find the exact location of the meeting within the school and didn’t want to be late.  Pat was able to enter the school grounds, wander the halls and corridors in a number of directions, and essentially had full access to the school.  Pat went unchallenged, unencumbered and uninhibited throughout the school until finally finding the specific meeting place.  Whatever measures they may have taken to bolster security did nothing to make the school more secure against a potential intruder.  Their actions only caused them to believe they had created an anchor point, when in reality they had not.  As a result, they were lulled into a false sense of security.

A baseline can be much easier to establish in an anchor point, and thus, anomalies are more easily forced to the surface and recognized than in a habitual area because there are less variables.  Anchor points by their very nature are more controlled and regulated.  There is often a higher level of expectation in regard to appearance, behavior, customs and practices.  It doesn’t take a long period of time, or much observation, to spot the sisters from a local convent who wander into an outlaw biker bar.

The same principle applies to our schools, but only to the extent we are willing to truly establish schools as an anchor point and put the measures and practices in place that establish it as so.  Pat probably wasn’t challenged or even given a second look as he walked unfettered through the school because of the mistaken notion that anyone on the school grounds must belong there and / or someone has already  “cleared” the subject.  If we aren’t willing to defend schools as anchor points, and make clear through deeds, not just words, that only a preselected group of people are welcome, then there is no point in even considering it an anchor point.

Well-intentioned people will most times follow the protocol of school entry.  Those with ill intent certainly will not.  In fact, they will look for the gap in security measures caused by the incongruence between believing the school to be an anchor point, but operating like a habitual area.  Here are some key questions to ask to check for those security gaps.

  • Are check in and checkout procedures well established and followed consistently for every visitor?
  • Do teachers, administrators and other school staff feel empowered to challenge anyone they don’t personally recognize?  Are they required to do so?
  • Of those individuals that are personally recognized, do school staffers still inquire as to the purpose of their presence?
  • Are there requirements in place regarding what can and cannot be carried onto the campus by visitors?  Are there measures in place to check bags, boxes, etc.?
  • as the concept of defense in depth been employed HHasHas the concept of defense in depth been employed?  Has a buffer zone around and leading up to the anchor point been established?
  • Is there a means by which to quickly Is there a means by which to quickly and clearly identify bona fide visitors from strangers from a distance and upon first glance?
  • Is a consistent message being sent about how welcome a stranger may feel simply entering the school grounds by way of iconography, the physical setting and placement of fences, gates, entry ways, walkways, foliage, lighting, and the actions, attitude and demeanor of school personnel?

Perhaps most importantly, school personnel must be trained in how to quickly establish a baseline for their school for any given day, time of day, or special event, and then spot the anomalies that rise above or fall below that baseline.  School personnel must be able to spot those behavioral threat indicators displayed by an individual before a full incursion of the anchor point can unfold and develop.

The defense of an anchor point relies on being proactive, not reactive.  Too many schools rely heavily on reactive measures to preserve life and property after a dynamic event has unfolded.  A true anchor point exists because those that occupy it have made it clear that those not part of the group are unwelcome, creating a proxemic push from the area.

Schools need to be anchor points for our students, teachers and staff, so that teaching and learning flourishes in an environment of safety and security, absent of the threat of violence.  We must establish them as such.  Teachers and staff need to be adept at observing and searching for anomalous behavior. We must train them to do so.  Schools need to be operating left of bang. We must get them there, and keep them there.

This Article Has Become Part Of An E-Book, You Can Download It Here

 

Red Cell: Penetration-Testing Your Anchor Point

September 17, 2013 in Assessing The Environment

Establishing and implementing a security plan is not a one-time event.  It is a process that requires continuous testing and improvement.  Security plans are established at anchor points in order to protect those inside from not only outsiders and non-members, but also from any insiders who have criminal intentions.  While I believe that behavioral analysis provides security practitioners with the information and insight needed to accomplish these goals, the concept has also been gaining traction in other areas.  In a recent article published in the Wall Street Journal: Risk and Compliance Journal about how to “How To Crack Down On Insider Threats,” Gordon Hannah, a principle in Deloitte & Touche’s Security practice, notes that by adding behavioral profiling to existing security practices, organizations “can effectively neutralize the insider threat and mitigate the risk a single individual can cause.”[1] These insider threats can span the spectrum of violence from being bullied by a coworker, the theft of intellectual property, harassment or even an active shooter scenario. While the threat of insider attackers is widely acknowledged, the ability to proactively identify these workers with dishonest intentions continues to be a challenge.  One way that organizations can reduce this risk from insiders is through the practice of penetration testing.

The penetration test, which is commonly used in the context of computer and network security, is a way for security officers to determine how capable they are at preventing both internal and external threats.  The goal of a penetration test is to identify where you are vulnerable so that you can later determine how to plug that gap.  The process begins by establishing a baseline for the entrance that insiders will have to pass through.  By going through the steps and process outlined in “How I Break Down A Video,” we can establish the patterns that are present and have a quantifiable structure to build off of.

Step 1 – Baselining: Where the penetration test requires a focused effort is on the different groups of insiders that use the entrance you are trying to protect. One example is the anchor point that gets established inside of an airport terminal at the individual gates.  There are a number of groups that are allowed into the jet-way once their credentials have been verified: passengers, flight attendants, pilots, gate attendants, maintenance staff and the crew that resupplies the planes with the food and drinks.  For the gate attendant who serves as the bouncer and sentry at this particular anchor point, her task is to assess each of these groups and know the patterns that each group is supposed to follow. These are the insiders with a legitimate reason for being there, or those trying to appear to be insiders.  Consider the following picture taken of the people attempting to board a Southwest Airlines flight.

For the sake of clarity and the specific purpose of the article, I’m not going to elaborate on the complete baseline for this anchor point, but I recommend that you first go through the baselining process and then consider how the following commentary would fit into the larger established norm.

  • Passengers stand in line in numerical order in their assigned boarding group. This forced channelization helps the gate attendant observe the behaviors of those about to board by separating them from the other people sitting in the area.  Members of this group might show elements of familiarity or unfamiliarity, based on how frequently they fly, but if a passenger shows familiarity with one stage of the boarding process for a Southwest flight, they should show familiarity with all steps in the process.  Those familiar with Southwest’s boarding process should also behave in a way that indicates comfort.  As passengers line up to enter, the gate attendant could focus her attention on someone displaying familiar cues yet are also uncomfortable.  This could be due to an annoying or loud traveller nearby, but the deviation from the familiar and comfortable will identify someone who stands out and can let the attendant know to contact this person and attempt to discover the cause.
  • The flight attendants and pilots would also show a high degree if familiarity with the boarding process. This familiarity is common with insiders and they have a great deal of experience in airports.  Even if they are in an airport they haven’t travelled through before, because all Southwest gates are set up the same, they should be very familiar with the layout and the process for them to check in and board the plane. The pattern of flight attendants would be different from passengers in three areas.  First, they won’t be waiting in line like the passengers.  Second, the flight attendants would also show that they have a pre-existing relationship with the other members of the crew as many teams work together day in and day out. As they walk up to the gate, I would expect them to be arriving as a group and being friendly towards each other in a way that I would not expect from passengers who were not travelling together. Finally, because flight attendants regularly work the same route, they might also show indicators of familiarity with the gate attendant at the airport. While flight attendants and passengers both have a process for boarding the plane, the processes are different enough that they both required being defined and differentiated.
  • When observing the maintenance staff working at the gate, they might not have a clear boarding process the way the passengers and the flight crew do, but they exhibit behaviors that would indicate familiarity.  The maintenance staff might not have a pre-existing relationship with the flight crew on a personal level, but may display familiarity based on the responsibilities that each provides while the plane is at the gate. For example, a member of the maintenance crew would know which attendant to talk to if there are any problems, or to let them know when they are complete with their work.

By establishing a baseline and expanding on the behaviors and details for each and every group that has access to an anchor point, you now have a very well-defined norm and can begin planning your penetration test.  

Step 2 – Red Cell: It is at this point where the red cell comes into play where you can identify the specific behaviors that would deviate from this baseline and begin to outline possible causes for each.  If the baseline is comfortable, define why a member of the flight crew would display over-the-top-dominant, uncomfortable or submissive cues.  You can also define how a member of these groups might act if questioned or challenged when they are innocent and when they have violent intentions.  This red cell phase is the planning time of the penetration test and a chance to look objectively at each possible situation and vulnerability.

Step 3 – Test: Once you have established a baseline and red celled how a criminal would behave in different scenarios (dominant, submissive, uncomfortable, comfortable) you can instruct the people tasked with testing the security measures on specific behaviors they should exhibit in their probing attempts.  The person responsible for maintaining security at the gate first has to know how to observe and classify each cluster of behavior, and this is an opportunity to coach and mentor the attendant on the behavior she observed of a passenger and how she did (or didn’t) respond.  The goal of the actual test is to not determine which group of insiders is the risk, but to determine the vulnerabilities in the bouncer and coach that person to greater effectiveness.

This ability to coach the guards is one additional benefit to defining the role of the bouncer the way we did in the “Identifying Anchor Points” article.  By understanding the dominant cluster of behavior, you can mentor your guards (or whoever is tasked with scanning those approaching your building, police department, or patrol base) to determine how intense a display of dominance is required to meet your security goals. If there is an event at the building you are responsible for protecting, maybe you choose a higher-intensity dominance for the special circumstances that wouldn’t be necessary on slower days. By looking at each behavior in the cluster, you can tailor the security posture to meet the needs as well as compensate for guards less capable at observing the subtle behaviors that he should be searching for.

Testing Your Anchor Points: As we have noted throughout this issue, treating an anchor point like a habitual area, or simply assuming that security is effective, is extremely risky.  Even if your anchor point doesn’t require the same degree of security as an airport terminal, it doesn’t change the need for penetration testing. While an airline is attempting to reduce the risk of flying as much as possible, some office buildings might accept a greater degree of risk because of a lower probability of attack. Regardless of where on the security spectrum you are operating, the penetration test is designed to identify the vulnerabilities that a security plan is supposed to address.  How the security gaps that you find in your penetration testing get fixed is a decision often made by top-level leadership, but the objective planning and testing that I’ve talked about in this article and in this issue of The CP Journal provides those leaders with the information needed to make intelligent security decisions.

[1] http://deloitte.wsj.com/riskandcompliance/2013/09/10/how-to-crack-down-on-insider-threats

This Article Has Become Part Of An E-Book, You Can Download It Here

 

Being In Public – The Habitual Areas We Visit

July 17, 2013 in Assessing The Environment

We all have our needs – food, water, clothing, cars, iPhones, beer, hanging out with friends, needing new shoes, and the million other reasons that cause us to leave our homes.  When we enter into the public sphere, we willingly abandon the defensible security and safety of our personal anchor points, our homes, and take on the challenge of ensuring our own safety out in the community.  As recent history has shown, securing these public areas is very difficult because of the inherent nature of being in areas that are open to anyone.  However, instead of assuming that these places can’t be secured, it just requires that people have the ability to clearly establish what patterns exist and how criminals will deviate from that baseline.

The public areas that we visit are places that we classify as Habitual Areas.  This type of location is identified by the  Continue reading »

The Transparency Of Familiarity

May 16, 2013 in Assessing The Collective, Assessing The Environment

Getting Oriented Post-Attack

Not every attack is going to be prevented.  While the ultimate goal of the Journal and our training is for every citizen to become a trained observer, and for everyday people to become aware enough of their surroundings to take preventative action, this will not happen overnight. As the number of people aware of those around them increases, the opportunity still exists for terrorists to conduct attacks.  However, when those attacks do occur, trained observers can use the same principles and behavioral cues that we use to get left of bang to quickly orient on those responsible for a crime after the fact.  Regardless of where we are on the attack timeline (left or right of bang,) using the domains of observable behavior will allow us to quickly identify who stands out.  April’s terrorist attack in Boston shows just how important the concept of assessing behavior post-attack is, as law enforcement officers need to be able to quickly regain the initiative after an attack and focus their investigative attention on those responsible.

Following the attack at the Boston Marathon, officers were able to isolate the bombers from the crowd they hid amongst so quickly by establishing the baseline behavior in the video footage and recognizing that the bombers were anomalies. According to a 60 Minutes report, in the chaos that ensued immediately following the two explosions, an FBI agent noticed that suspect number two’s behavior was in stark contrast to everyone around him.  As you might expect, the explosion surprised, shocked, scared, disoriented, and caused a sense of fear in the people around the explosion.  For the area and the crowd at the finish line, this immediately became the new baseline. The crowd was forced to scramble as each person had to go through the OODA loop cycle and figure out what happened, what areas to avoid, which direction to head, where their family and friends were, and how to get away. This new baseline is what caused suspect number two to stand out, as his behavior did not show any of that surprise, fear, panic or disorientation. He was simply going from one phase of the attack to another.  He was moving along a pre-determined egress route and, because he had known the explosions were coming, he didn’t have the same emotional response as the rest of the crowd.

What makes this observation so impressive is that the FBI agent recognized an anomaly below the baseline – something that should have been there but wasn’t.  Identifying the absence of fear (or any emotion or behavior) is typically a harder observation to make than it is to identify an anomaly above the baseline.  It is easier to confidently recognize behavior that is above the baseline, because the additional presence of something, such as excessive dominance or excessive discomfort, is tangible and quantifiable.  On the other hand, recognizing when something should be there but isn’t, has the potential to cause observers to doubt themselves, question their judgment, and second-guess their assessments.

In the instance of the Boston attack, the post-attack observations and baseline are grounded in what we refer to as the collective assessment of the crowd – the Atmospherics of the area.  Atmospherics reveal how people perceive their own safety.  Following a terrorist attack, the lack of security would convey a negative Atmosphere.  The collective mood following an attack is likely to be fairly standard from situation to situation, as unknowing bystanders in Afghanistan would likely react similarly to an IED detonation as the people at the Boston marathon did to the explosions near the finish line. The intensity of the reaction might vary, as the likelihood and previous exposure to explosions is higher in Afghanistan that it is in Boston, but the sense of fear and the immediate emotional response would be common.

Keeping It In Context

The observation that the bombers did not react the way we would expect innocent bystanders to after an explosion needs to be considered within the context of the situation.  To do this, we need to consider the bomber’s behavior preceding the attack.  The eyewitness testimony and photos of the two bombers indicate that the bombers were likely very calm as they approached their target and dropped their bombs.  There are two potential causes for this level of comfort.  The first is that these two are true psychopaths and were incapable of recognizing that what they doing was wrong. The other potential (and more probable) option is that these two planned and rehearsed the attack so well that nothing caused them to become uncomfortable during the attack.  If they were confident enough in their plan, that the bombs were sufficiently concealed and that there wouldn’t be any police checkpoints to disrupt their plans, they in fact could have been completely comfortable without any external stressors. While this apparent comfort comes from familiarity with their surroundings and their plan, it also caused suspect number two to be identified because he was unaffected by the explosion, causing him to stand out from the baseline.

Other Potential Scenarios

The way that we are identifying the two terrorists in the case of the Boston attack will not be the way that all terrorists will behave as no two attacks are exactly the same.   Because of this, we should consider other observations that could be made right of bang in order to facilitate the speed at which you can orient on the criminals responsible after an attack. One scenario might include terrorists who did not plan out the attack as thoroughly as the terrorists did in Boston.  If they failed to establish and rehearse their escape route, you might expect them to give off the same uncomfortable cues as the other bystanders because they are now at risk of getting caught.  In this situation though, due to the perceived threat of getting captured, they may continuously “check their six” to see if they were being followed.  These terrorists would be in contrast to the innocent civilians who would likely keep their attention to the direct front as they look to get to safety.  If this were the case, though, I would expect that attacker to stand out from the baseline before the attack and to display uncomfortable cues as they would recognize the limitations of their current plan.

Another potential scenario might include a bomber who is unsure of what affect the bomb detonation will have on people.  Whereas the expected reaction would be for people to focus their attention away from the blast so they could escape, an inexperienced bomber might continue to keep his interest focused on the blast and the first responders.  These cues from the Interested vs. Uninterested cluster would help focus first responder attention on the anomaly for this reason.  These are considerations that military and law enforcement officers could discuss to train their responders on what to look for.

Regaining The Initiative

By identifying the anomaly below the baseline and finding the person who was missing the elements of surprise, fear and panic, the FBI was able to release the terrorists’ photos to the public and regain the upper hand by forcing the criminals into a reactive mode.  Whether your battlefield is on the streets of any city here in America or in a combat zone overseas, analyzing the baseline behavior for the crowd following an attack can allow you to orient on the criminal very quickly and take back the initiative.  While the environments that our military deploy to are not likely to produce the same amount of video coverage used in Boston, squads and platoons can be trained to search for anomalous behavior during their response and immediate action drills.  As the first priority is to establish security on the scene of IED strike, training to the Marines and Soldiers to assess the comfort and interest of the bystanders can help to rapidly identify any potential follow on threats.

For investigators here in America, the Boston attack was perhaps the first time that crime scene footage was crowd-sourced so extensively. With the abundance of social media and quick and easy transferring of information and media, it certainly won’t be the last.  As this will likely become more commonplace, becoming efficient at classifying the behavior of those in the footage will allow for a timely response during attacks.  How quickly we can orient on the criminal following an attack could very well be the difference between success or failure in catching him, the difference between that person escaping or getting caught, the difference between a single attack or multiple follow-on attacks, and the difference between few or many people hurt of killed.

This Article Has Become Part Of An E-Book, You Can Download It Here

Improving The Search – Pulling From Iconography

May 1, 2013 in Assessing The Environment

Often when Marines or Soldiers are taught how to search a house while deployed, the focus is on finding weapons or contraband that ties them to the insurgency. It’s the sure-fire way to providing a clear link to the fighting and ensuring that the subsequent arrest doesn’t get thrown out for a lack of evidence.  As criminals, both at home and overseas, make this search more challenging; our military needs to continue learning how to pull good information and intelligence from each encounter.  A search though is naturally confrontational where the searching party has assumed a dominant role. This dominance makes it difficult to establish rapport and makes collecting that intelligence a challenge.

Iconography can help you find the information needed to find common ground with the suspects and get them to begin talking.  Iconography reveals what a person’s beliefs and affiliations are.  For the person tasked with questioning the suspects while the house is searched, a quick look to find the pictures, images, symbols, art, graffiti, flags, colors, and other indicators that reveal the suspect’s beliefs and affiliations can make it easier to find common ground and get the person talking Continue reading »

Explaining School Safety – Defending An Anchor Point

January 6, 2013 in Assessing The Environment, Veterans, Business, and Security

Since the shooting in Newtown, CT, on December 14th, I’ve spent a lot of time talking to school administrators, concerned parents, and security staff, about ways that schools can protect the children in their charge.  I’ve found myself answering many questions about specific steps schools can immediately take, and I have come to realize that many of these questions are getting asked without a common understanding of the goals and intent of securing a school building.  Without this understanding, any step taken would be reactionary and not necessarily along the path of progress in securing our schools.

Because of the attack at Sandy Hook Elementary, there is a great deal of emotional drive right now to take immediate steps and do whatever it takes to protect students and teachers, but without an objective and logical understanding of what is needed, changes in security measures could fail to accomplish the goals parents and school boards are after.  Everything I have been talking about concerning preventing school violence stems from the fact that a school is an Anchor Point and needs to be treated that way. Continue reading »

From Science To The Streets – Territoriality and Anchor Points

December 18, 2012 in Assessing The Environment

Like animals, humans are territorial. Territoriality is rooted in our DNA. On a daily basis we make a claim to the space around us. We protect our “personal space.” We place pictures and other personalizing items on our desks and workspaces to ensure that other people know this is our space. If we are students, we sit in the same seat on a daily basis and then get upset if someone sits in that seat one day, because it is “my seat.” We place “no trespassing” signs on our property. We look at people strange if they get too close to our cars. Territoriality has been defined as: “an individual’s behavioral expression of his or her feelings of ownership toward a physical or social object” (Brown, Lawrence, and Robinson, 2004). In other words, humans develop feelings of ownership over the space around them and objects they normally interact with, and they express this ownership through subtle and overt signs—through aggressive postures, explicit warning signs, proxemic behavior, and other such indicators.

Continue reading »

Natural Lines of Drift In An Online Environment

November 8, 2012 in Assessing The Environment, Veterans, Business, and Security

I’ve been very fortunate to have some very smart and very capable people in my life, especially as I transitioned out of the Marines and started my own business in the private sector.  Every time that I talk with people who are marketing professionals or business owners (people who have thrived on successfully predicting human behavior in any shape or form) I walk away with greater appreciation for how the concepts that you will find on this site are principles that apply well beyond just The CP Journal.

A Little Context and Background

Last week I was having a conversation with Callie Oettinger as she was preparing a company profile for a series of articles on Steven Pressfield’s blog about startups, writers, entrepreneurs, and those who “do the work.”  Up to that point, I had attempted to maintain two blogs for my company.  This is the first site, where I have tried to only publish posts on topics relating to behavioral analysis and how people can develop their ability to read others quickly and accurately.  Any posts that I wrote about something other than behavioral analysis were posted on the Active Analysis Consulting site, such as articles that related to business, the security industry, hiring veterans, or company announcements.  At the time, I was doing this for two reasons. The first was that I didn’t want to pollute the Journal with anything related to advertising or shameless plugs for my company (even though many of these posts were not written in that context) because those sort of things make a website horrible to read and would turn readers away from the site, so I kept those posts in a separate spot.

After our conversation, Callie’s questions and suggestions helped me realize that my approach was counter-productive and I was failing to take into consideration reader behavior and interests.  Essentially I was forcing a reader to deviate from the path of least resistance Continue reading »

Natural Lines of Drift and the Least Effort Principle

February 27, 2012 in Assessing The Environment

Recently, a question was brought up regarding our (The CP Journal’s) use of “Natural Lines of Drift”. To be clear, when we discuss the domain, “Geographics”, identifying a natural line of drift is a key principle.  Understanding this principle can help us determine which route the enemy has used, the suspected route the enemy has used, or a predicted route the enemy will use. This is beneficial in finding our enemy, or anticipating methods and areas of attack.

I presented the picture (left) to another instructor, and said we would like our students to consider roads and trails to understand the terrain and how it is used. My fellow instructor responded, “If your topic ‘Natural Lines of Drift’, which is defined as a route one would most likely take and is usually associated with a path of least resistance, then the picture to the left is not a “Natural Line of Drift’, is it?”

He was right.

Continue reading »

Iconography

November 30, 2011 in Assessing The Environment

I hate to admit it, but that jerk you saw swerving on the Southbound 5 Freeway last week, playing on his cell phone, well, that may have been me.  I would say I’m sorry, but I know you were probably the guy next to me doing the same thing.  We can’t help it.  Technology has made it easy for us to retrieve information, immediately.

Now, before you get all high and mighty, let me just say that I had good reason to endanger every motorist within a 2 lane radius of my car.  On this particular day as I was driving home, I found myself stuck behind a Prius, driving 65MPH, in the fast lane.  If you are not from Southern California, the average speed on the 5 Freeway is at least 80MPH.  This, in my humble opinion, is the worst type of human being.  So, after several vehicular gestures of decreasing the distance between his car and mine, I couldn’t help but notice a bumper sticker on the back of his car.  The sticker read, “CODE PINK”.  The name “CODE PINK” sounded familiar, but I didn’t know what it had meant.  My initial thoughts were that maybe it was a band, or a breast cancer awareness group.  Alas, my curiosity got the best of me; I whipped out my phone and preceded to “google” the phrase.  I had learned that Code Pink is a “… a women-initiated grassroots peace and social justice movement working to end U.S. funded wars and occupations, to challenge militarism globally, and to redirect our resources into health care, education, green jobs and other life-affirming activities.”  Whoa, that was unexpected.  So given this information I can probably assume this individual is probably an anti-war protester; that explains the Prius.

This person was telling me and the world a little bit about where he stands politically, whether we like it or not.

The use of body art, graffiti, art, symbols, clothing, jewelry, grooming, bumper stickers, flags, colors, or any other personal items to reveal information is what we call iconography. Iconography is a domain of combat profiling which we use to assist our ability to make proactive decisions.

Continue reading »

The 6 Domains of Tactical Analysis

September 29, 2011 in Assessing Groups, Assessing Individuals, Assessing The Collective, Assessing The Environment

There are 6 domains used in Tactical Analysis that provide us with 6 different ways to look at the world.  When you put these domains together, they allow you to predict what human beings are going to do.

For all of the following domains, a profiler has to establish a baseline (the norm for the area) and only then will he be able to hunt for the anomaly (those deviations from the baseline.)  The domains should be used to quantify and communicate what your baseline is as well as to let you pick out those anomalies that pose a threat.

Kinesics: The study of body language.  Being able to identify a person’s emotional state based off their body language provides an incredible insight into that person’s mind.  Are they dominant or submissive?  Are they comfortable or uncomfortable?  Are they interested or uninterested?  All of these cues will let us predict what a person is about to do. Kinesics does not merely involve the study of facial expressions, but rather takes into consideration the entire body.

Biometric Cues: Uncontrollable bodily reactions in response to the world around us.  Whether observing someone whose pupils are dilated or constricted, if they are blushing or pale, someone with a dry mouth, or someone with an increased blink rate are all cues that let us know how that person is perceiving people and objects around them.

Proxemics: The study of interpersonal relationships. By analyzing how people use the space around them, we can begin to understand their relationships with those people they are surrounded by.  Being able to assess what people are attracted to (proxemic pull) and what they avoid (proxemic push) will let us get into the collective mind of the group.  Proxemics can be observed up close to people during conversation or from hundreds of meters away using binoculars.  Proxemics can also be used to identify the key leader of any given group.

Geographics: The study of people’s relationship with their environment.  Understanding which areas of the neighborhood or the building you are in that everyone feels comfortable going to (habitual areas) and those areas that only a select group of people have access to (anchor points) can provide us with an anticipated baseline and pattern for the people who are visiting that area.  Identifying how people move through their terrain (natural lines of drift) will also let us identify those who are either familiar or unfamiliar with the area.

Iconography: The displays that people use to express what they believe in.  By observing the flags and colors that represent their groups, clothing choices, bumper stickers, graffiti, tattoos, and posters will give us a window into their motivations.  People who are willing to make a statement through a piece of iconography are often displaying their beliefs and ideals and are often times willing to fight for that belief.  Understanding what a person believes in will also assist us in predicting their future actions.

Atmospherics: The collective attitude and feel of an area.  Is it positive or negative?  By continually asking yourself if the behaviors, emotions, attitudes, and objects that you are observing match your baseline, you will be able to identify those individuals who don’t fit in.  Drastic changes and shifts in the baseline atmospherics will let you know when a threat is imminent.  Your intuition will very often perceive this threat well ahead of your conscious recognition of it.

When pieces to a few of the domains or all six come together, they are what are going to let us put a person’s behavior into the context of their environment and determine what they are going to do in the future.  Not only will it let us identify their intentions, but also let us communicate our predictions and observations to others.

To see why these domains are the ones we rely on, take a look at the article explaining the function and the framework that the domains provide

Where Is the Enemy Going?

September 28, 2011 in Assessing The Environment

The Combat Hunter Program that we teach consists of much more than just combat profiling.  The other significant portion of the program ties in combat tracking.  (The Marine Corps really likes to add the word “combat” to things to make it sound intense: human profiling became “combat profiling” and man-tracking became “combat tracking.”)  These two skills, both focusing on understanding humans and how they interact with their environment, relate to each other in a number of ways.

While the tracking team is conducting their follow up (the act of man-tracking,) the team leader is continuously asking himself a series of questions about the person or group he is following.  Where is he going?  Does he know he is being followed?  If he does know that he is being followed, how is he going to react?  If I were being followed, where would I set up an ambush?

To get into his head and begin thinking like him, the team leader is pulling information from the trackers: how fast he is moving, if he is wounded or limping, if he has indicated that he is carrying a weapon, if he is moving alone, if he is turning around, if his speed or pace has changed, a series of facts that he can analyze and use in his pursuit.  All of these data points can be gathered by analyzing the tracks left behind by our enemy.

Obviously, figuring out where the enemy is going would make tracking him much easier.  Understanding how geographics and tracking tie together can help us in this.  Your enemy has to be returning to either a habitual area or his personal anchor point.

You can determine from his tracks if he knows he is being followed, if he is moving with a purpose, or if he is unsure of where he is going.  An experienced insurgent or criminal will not lead you back to his anchor point.  He will not want to compromise his secure space by being undisciplined.  In order to maintain the degree of security he perceives from inside of his anchor point, he will likely lead you back to a habitual area.  The crowds of people and open nature of habitual areas will provide him the cover that he needs.  This will also cause his tracks to become contaminated, preventing the trackers from catching him.  We can predictive profile because of patterns, and there is no difference when tracking.

What are the patterns that he has set up to this point?  Does he continually check “his 6,” ensuring he is not being followed?  Are there indicators that he has taken security halts, demonstrating that he is conscious of the fact that he has enemies too?  Has he been lying in a prone position that lets him observe the area without being seen?  If he has shown a pattern of being security conscious, you can anticipate that this will continue and he will make his way to a habitual area, remaining vigilant until he is positive he is safe.  This may be where you want to direct your adjacent units to cut your enemy off.

If this is the case and you can’t cut him off, you will need to shift into tactical questioning mode to ask people if they have observed your enemy, (again, the Marine Corps turned everyday questioning techniques into “tactical questioning.”)  Having a physical description of him or being able to identify the type of shoes he is wearing will help.  While you are asking questions, do you notice anyone in your proximity that has situational awareness?  If you have closed the gap and have surprised him, he may still be in the area to determine if he has been compromised.  Does anyone that you are questioning show signs of deception?  Profiling and tracking are not exclusive skill sets. They complement each other very well, each providing the other with information to assist you in finding your enemy in plain clothes.

The questions you can answer and patterns you can establish on the track-line will help you anticipate where the person you’re following is going.  Profiling doesn’t begin only when people are around, you can begin profiling the instant that you see any indicator of human activity. This could easily be his footprints and the indicators he leaves behind when he is walking.

Do you have more ways to integrate tracking and profiling?  Let us know.

Are All Habitual Areas Created Equal?

August 16, 2011 in Assessing The Environment

If you’ve sat through the class you know the definition: a habitual area is a place where anyone can come or go at any time, without any restrictions.  So that’s it?  I teach the class, but I can think of a thousand different questions regarding behavior that I might see at habitual areas.  While the definition works for the introductory class on geographics, you see that in practice, it isn’t always so cut and dry.  Should we consider opening up different classifications for habitual areas?

What if there were two different types of habitual areas: the restricted habitual area and the unrestricted habitual area?  If you were to visit a neighborhood park, there would be no question that you were in an unrestricted habitual area (unless of course there is some sort of gang presence there pushing people away.)  Anyone at all could come and relax, barbeque, and let their kids run around on the playground without any expectation of them.  But what about at a local restaurant, café, or coffee shop?  If you were to go to Pizza Port, would you classify that as a habitual area?  What about Starbucks?  I would definitely say they are, since anyone can come or go from there, but in that case, there is the expectation that they are going to buy something from the business.  They welcome you to sit at their tables to meet with people whenever you’d like, but aren’t those seats still reserved for customers?  However, I don’t think that requirement makes Starbucks or Pizza Port an Anchor Point.

Continue reading »