Article: Beyond Behavioral

24 Mar 2014

We hear more and more these days about behavioral assessment and behavioral indicators in the realm of threat mitigation. Detector Dogs Australia teaches screening people by observation techniques, this program teamed by a behavioral detection instructor has been in effect since 2006, and applauded for its successes. We have a problem with the word “behavioral” when associated with threat indicators. The word behavior reflects things that are human: body language, micro facial expressions, nervousness, etc. And while the nervousness displayed in human expression can reflect malicious intent, it is only one small aspect of the entire situational assessment that needs to be performed by a screening or security system.
Suspicion indicators can just as well apply to situations and objects.  Here are some examples:

  • appearance
  • cover story
  • personal documentation
  • accents if they differ from stated nationality or name
  • affiliation with an individual or group
  • human interactions
  • configuration, size and location of an object
  • and more

An effective and thorough threat assessment is based purely on Methods of Operation (MOs) and suspicion indicators, indicators that include but go well beyond behavior. For example, you’re at the airport and see a man dressed as a pilot but wearing his wings on the wrong side of his uniform. The suspicion indicator correlates with someone using a cover or disguise of a pilot to gain access or trust, depending on the situation. The misplaced wings pin is not behavioral; it represents an object associated with appearance and for that matter, a cover story. It is the connection between a suspicion indicator and an MO that makes the threat assessment real and relevant.

Still on the topic of appearance as a potential suspicion indicator, a man wandering around in a Bunny Suit (Easter’s around the corner) may be abnormal but not necessarily suspicious. A man hanging around a lobby or entrance for an abnormal duration might well be suspicious and reflect a surveillance MO. But again, for an abnormal activity to become suspicious it must correlate with an MO.