Using Behavioral Indicators to Help Detect Potential Violent Acts

Relevant information may be proximate (e.g., during preparations for or part of an attack) or from previous observations over days, months, or years.

Three Types of Data for Using Behavioral Indicators to Detect Potential Violent Attacks

• Many detection efforts focus on communication patterns. These include monitoring and analysis of online communications, text analysis and natural language processing, and speech analysis.
• Another class of detection efforts focus on pattern-of-life data, including data on communication, travel, and purchasing, much of which is held in private-industry databases.
• A third class of detection efforts focus on individuals' physical movement and physiology. These include monitoring and analysis of kinetics and gross movement (for example, the gait of individuals carrying weighted objects) as well as physiological state and reactions (for example, voice stress and facial expression).

Cross-Cutting Issues

• There is current value and unrealized potential for using behavioral indicators as part of a system to detect attacks. Unfortunately, analytic quantification of that potential is poorly developed.
• Ongoing research is a mix of laboratory- and field-based empirical research and modeling. Operators in the field are often well ahead of the science base, which can be either good or bad.
• Probing to stimulate behavioral responses can sometimes improve detection effectiveness significantly, but such approaches involve significant tradeoffs between detection effectiveness and negative consequences for civil liberties, commerce, and the perceived legitimacy of the security system.
• Much of the literature and discussion focuses on detecting behavioral responses in the absence of countermeasures, but countermeasures are in fact a big problem.
• Many of the potentially attractive technologies and methods currently depend on such relatively benign circumstances as close-up observation by humans. Operational value will be much enhanced by improved capabilities to make observations from a distance, automatically, and in some instances without the subjects being aware of the observation.
• Nothing on the horizon presents a "magic bullet" for threat detection, raising the potential importance of effective information fusion, including networked real-time or near-real-time integration of information.
• A major challenge in detection systems is the tradeoff between false negatives (failure to detect) and false positives (false alarms).
• Many of the technologies and methods associated with monitoring behavioral indicators raise profound civil liberties concerns. Many problems and errors can be avoided by up-front review of procedures by experts.