AMU Careers Careers & Learning Emergency Management Federal Intelligence Law Enforcement Public Safety Public Service Terrorism

How to Stop a Terrorist: Identifying Extremist Activity and Behavior

By Dr. Jeffrey V. Gardner, Faculty MemberHomeland Security at American Military University

Today the United States is facing significant and diverse terrorism threats from overseas terrorist groups, foreign extremist infiltrators, and even radicalized domestic citizens. Many attackers have overt and observable signs of radicalization or pre-attack actions that may enable prevention if suspicious activity is reported and synthesized with other available information beforehand.

What signs should intelligence and law enforcement professionals look for in order to stop terrorists in our midst?

Not all terrorism is preventable, as a radicalized individual can decide to act without outside support or direction, reducing signs of warning to nearly zero. (An example of such a “below the radar” attack occurred in San Bernardino in 2015.) However, Mitch Silber, the former NYPD director of intelligence analysis, describes in his article, How to Stop the Next Domestic Terrorist, that “selective and focused observation of certain jihadist or pro-ISIS inclined sites, Twitter accounts and YouTube channels might provide an early warning or opportunity to identify an individual or individuals who has adopted the ideology promoted on these networks, and may suggest future action in furtherance of that ideology.”

While social media is clearly the current medium being used to inspire terrorism, this article will focus on the physical actions and behavioral components that are observable by citizens and law enforcement professionals.

Counterterrorism Models and Resources

Today there are many different agencies involved with domestic counterterrorism, including the Department of Justice (DOJ), Federal Bureau of Investigation (FBI), the Office of the Director of National Intelligence (ODNI), National Counter Terrorism Center (NCTC), and the Department of Homeland Security (DHS). These agencies help by training intelligence and law enforcement professionals to identify extremist behavior and terrorist precursor activities.

[Related: The Role of Local Police in the War Against Terrorism]

The counterterrorism program by the DOJ Bureau of Justice Assistance (BJA) offers many references and training opportunities for public safety professionals. The BJA also supports the State and Local Anti-Terrorism Training (SLATT) Program, “an initiative that teaches law enforcement about counter-terrorism measures that work at the community level.” The program includes resident events and an upcoming May 2018 webinar on What Law Enforcement Agencies & Justice Professionals Need to Know about the “Lone Wolf.”

The FBI often provides training directly to state and local law enforcement agencies on terrorism and signs of extremism. The well-known FBI Law Enforcement Bulletin also offers many helpful articles, such as the April 2016 item entitled Identifying Warning Behaviors of the Individual Terrorist.

The DHS has the National Training and Exercise Division (NTED), offering more than 100 courses to state and local agencies. These courses are of little-to-no cost to jurisdictions and include classroom-based, online, and mobile programs in which instructors travel to the locations that request them. Some new courses include Community-led Action in Response to Violent Extremism; Homemade Explosives: Awareness, Recognition, and Response; and Vehicle-Borne Improvised Explosive Device Detection (see the full catalog).

The NCTC has the Joint Counterterrorism Assessment Team (JCAT) whose role it is to improve information-sharing in public safety with regard to terrorism. They produced an online Counterterrorism Guide for Public Safety Personnel, which assists first responders in recognizing and reporting suspicious activity, such as indicators of mobilization to violence. One important aspect of this guide explains the terrorist attack planning cycle:terroristImage from:

This JCAT counterterrorism guide also recommends that law enforcement and intelligence professionals take online training for Suspicious Activity Reporting (SAR). The SAR initiative started with the “If You See Something, Say Something” campaign in New York City, which was adopted by DHS as a nationwide program in 2010. This is now called the Nationwide SAR Initiative (NSI), an interconnected system linking the homeland security enterprise, including individual citizens, the private sector, local law enforcement, the national network of fusion centers and federal agencies (such as DHS and the FBI). NSI provides a unified approach to gather, document, analyze and share terrorism-related suspicious activities. Online SAR Training for Law Enforcement and Hometown Security Partners is available at

Suspicious activities, according to this NSI online training, include “observed behavior reasonably indicative of preoperational planning related to terrorism or other criminal activity,” or actions that could be a signal of future events. The training focuses on indicators and behaviors present in previous terrorist events that are suspicious activities in themselves (i.e. not race, religion, ethnicity or national origin). Officials are instructed to report on the what, where, when and how of the suspicious activity (see the below graphic), while recognizing that many public and private activities are constitutionally protected activities where privacy and individual civil liberties must be preserved.


Some specific indicators of potential terrorist activity include:

  • Testing security procedures
  • Asking probing questions about facility security measures
  • Photographing critical infrastructure
  • Acquiring unusual materials or unusual amounts of materials that could be used as weapons or explosives (e.g. acetone, hydrogen peroxide hair dye, or ammonium nitrate-based fertilizer).

Other signposts of terrorism may include:

  • Unreasonable interest in military weapons and/or military style training disguised as games such as paintball or airsoft
  • Photography, observation or surveillance of security measures at ‘soft targets,’ such as theaters, concerts, sporting venues and other large public spaces or events
  • See the below graphic from the NSI online training for more types of suspicious activity

terroristCharacteristics and Behaviors of Potential Terrorists

Reporting suspicious activity and indicators of extremist radicalization is more important than ever as we enter what’s known as the fourth phase of modern terrorism, which refers to online-inspired attacks such as those attributed to or motivated by the Islamic State in New York City on Halloween and on the subway on December 11th. As the JCAT counterterrorism guide states, “Communities are an integral part of the effort to prevent violent extremism and can assist law enforcement in identifying at-risk individuals. Awareness and vigilance are crucial to identify behaviors that can lead to a violent act. Several behaviors, when taken in context, can indicate radicalized individuals are mobilizing—preparing to engage in violence to advance their cause.”

While it is widely recognized that there is no universal profile for a terrorist, there are often observable characteristics and behaviors of individuals that may indicate extremism or indicators of potential terrorism.

[Related: Understanding the Mind of Mass Shooters: Psychological Autopsy]

The JCAT counterterrorism guide notes: “Readiness to act can vary across time and be influenced by multiple factors—including personal will and competence, experiences while in training, and motivation gained or lost as a result of established relationships.”

The NYPD model further explores “triggers that can serve as the catalyst including: Economic (losing a job, blocked mobility); Social (alienation, discrimination, racism – real or perceived); Political (international conflicts); Personal (death in the close family).” This means we should be on the lookout for what I call “comprehensive life implosion” situations where a series of events in a person’s life may drive them to act out illogically and violently.

Both the terrorist shooters at Fort Hood in 2009 and Chattanooga in 2015 experienced a downward spiral of personal and professional events which culminated in many deaths at their hands. Major Nidal Hasan, the perpetrator of the 2009 Fort Hood shooting, was a poor performing and overweight army psychiatrist who also lost his parents, was unhappily single, and was about to deploy to Afghanistan – where he was deathly afraid both for his own safety and that he would have to be involved with killing fellow Muslims (he was called a “ticking time bomb” at the time).

[Related: Understanding Homegrown Extremists: An Academic Approach]

Similarly, Chattanooga shooter Mohammad Abdulazeez lost his nuclear power job due to a failed drug test and was arrested for DUI. He gravely embarrassed his already unstable family, was in deep personal debt, and searched online about being absolved of his sins through martyrdom (a sort of extreme “suicide by cop”).

Tamerlan Tsarnaev of the Boston Marathon bombings in 2013 was also in the midst of a comprehensive personal, professional, familial, and financial crisis – he likely sought personal redemption through violent jihad and brought his younger brother along as well (see the Fall of the House of Tsarnaev).

Identifying Signs of Radicalization

Intelligence and law enforcement professionals are also taught about radicalization processes and how individuals reach the point where they feel violence against unarmed citizens is justified. One popular radicalization model originally created by law enforcement is Radicalization in the West: The Homegrown Threat, co-authored by Mitch Silber in 2007, mentioned earlier. These Homegrown Violent Extremists (HVEs) are difficult to identify, but many do transition through three distinct stages as described by the NYPD model: Pre-Radicalization; Self-Identification and Indoctrination.

One of the specific signatures associated with these stages is gravitation away from an old identity and association with new, like-minded individuals. The Silber model goes on to state, “the transformation of a Western-based individual to a terrorist is not triggered by oppression, suffering, revenge, or desperation… Rather, it is a phenomenon that occurs because the individual is looking for an identity and a cause.”

[Related: Sisters of Battle: Analyzing Female Terrorists]

Altered individual behaviors such as radical changes in dress or grooming – like growing a beard or head-shaving – may not be signposts of extremism by themselves, but combined with other indicators, such as making extremist statements and seeking weapons, could be a red flag. An official NCTC report titled Behavioral Indicators Offer Insights for Spotting Extremists Mobilizing for Violence describes four patterns that may point to potential terrorism:

  • Links to known extremists
  • Ideological commitment to extremism
  • International travel attempts
  • Pursuit of weapons and associated training.

It was found that these four behaviors repeatedly appeared in the case studies, reinforcing initial assessments of potential trends of Homegrown Violent Extremists.

Finally, the FBI Law Enforcement Bulletin article Identifying Warning Behaviors of the Individual Terrorist describes warning behaviors that were found in more than 90 percent of the cases studied. They include:

  • Pathway – engaging in behaviors to prepare for an attack
  • Fixation – a preoccupation with a cause
  • Identification – close association and affinity for previous attackers or causes
  • Energy burst – an increase in activities related to the target in the hours or days before the attack
  • Last resort – taking on the mentality that there is no alternative other than violence, and the consequences are justified

All of these behaviors and indicators may be observed by community leaders or citizens and should be reported to law enforcement.

Law enforcement, in turn, must be prepared to apply the multiple models and tools at their command. As the NCTC report on behavioral indicators describes, a single indicator of extremism or terrorism may not be sufficient, and “Finding combinations of indicators offers the best approach to countering HVEs. Identifying such combinations in a timely manner requires collaboration that taps the capabilities of federal, state, and local government agencies and their nongovernment partners.”

About the Author: Dr. Jeffrey V. Gardner is an assistant professor of Homeland Security Studies at American Military University, teaching courses such as Intelligence and Homeland Security (HLSS320); Mind of a Terrorist (HLSS154); and Homegrown Violent Extremism (HLSS323). Jeff is a retired Army Lieutenant Colonel with a Ph.D. in Public Policy and Administration — Homeland Security Policy and Coordination. He also possesses a Master of Science of Strategic Intelligence with a concentration in terrorism from National Intelligence University, as well as two other master’s degrees. To contact him, email

Comments are closed.