Initial Detection: Through Increasing Tips and Leads and Information Sharing
Initial detection is about finding, recognizing, and reporting the initial warning signs of a possible mass attack plot. Reporting these warning signs is the beginning of all other prevention efforts.
- Tips from the Public (When in Doubt, Call it Out—You Make the Call, You Make the Difference): Often, the only way organizations know of a concerning situation is through tips from the public. If you think you see signs of serious intent for an attack or preparations for attack, let the relevant organization or law enforcement know so that they have the chance to assess a possible threat.
- Observable Warning Signs: Warning signs can be deliberately given or inadvertently leaked by the would-be attacker to others, either in person or online.
- Active Information-Sharing: There are hundreds of systems that provide sources of information that can be used to conduct thorough investigations and threat assessments. There should be an awareness of these systems, which ones apply to the local area, and how to access them while following privacy laws. There also should be a way to collaborate with partners when specific information cannot be shared. The only way that these systems are valuable is if local agencies use them.
The table below summarizes top findings and recommendations about warning signs and reporting.
Figure 1 - Warning Signs and Reporting
| Findings | Prevention Practice Needed |
|---|---|
| Plots for which an initial warning sign was reported were foiled in advance more than 80 percent of the time. In contrast, plots for which an initial warning was not given—whether because no warning signs were observable or observed warning signs were not reported—were foiled in advance less than 5 percent of the time. | Do more with communities to increase their awareness of warning signs, the role they can play to prevent violence, the support that can be provided to people in crisis, and how to report their suspicions to increase the quality and number of actionable tips. |
| Of the cases where plots were foiled, 28 percent were foiled because of reports from the public about direct threats being made against would-be targets; 36 percent were foiled because of reports from the public on other details about potential plots. In all, about two-thirds of prevented plots were foiled because of public reporting. | Do more with communities to increase their awareness of warning signs, the role they can play to prevent violence, the support that can be provided to people in crisis, and how to report their suspicions to increase the quality and number of actionable tips. |
| Although a sizable percentage of would-be attackers had advanced their plot as far as site surveillance, we saw very few cases where this surveillance and probing was detected by those at the site. | There may be an opportunity at high-risk locations to increase employee engagement with visitors. The Power of Hello framework provides a way for alert employees to contact people in a nonthreatening way to determine their reason for being in a building (Cybersecurity and Infrastructure Security Agency, undated). |
| More than two dozen plots in our data were foiled by alert officers noticing evidence related to carrying out mass attacks while they were responding to calls or investigating seemingly "ordinary" crimes. | Increase officer awareness of warning signs and have policies in place to require reporting of suspicious activity. |