Recognize Suspicious Activity | Homeland Security (2024)

Communicating a spoken or written threat to commit a crime that could harm or kill people or damage a facility, infrastructure, or secured site.

A prolonged or unusual interest in facilities, buildings, or infrastructure beyond casual or professional interest.

Taking pictures or videos of persons, facilities, buildings, or infrastructure in a covert manner, such as photos or video of security related equipment or personnel, infrequently used access points, or structure of a building.

Stealing or diverting items—such as equipment, uniforms, or badges—that belong to a facility or secured site.

Challenging or testing a facility's security or IT systems to assess the strength or weakness of the target.

Operating or interfering with the operation of an aircraft that poses a threat of harm to people and property.

Unauthorized people trying to enter a restricted area or impersonating authorized personnel.

Presenting false information or misusing documents to conceal possible illegal activity.

Questioning personnel beyond mere curiosity about an event, facility, or operations.

Gaining skills or knowledge on a specific topic, such as facility security, military tactics, or flying an aircraft.

Disrupting or compromising an organization’s information technology systems.

Funding suspicious or criminal activity or recruiting people to participate in criminal or terrorist activity.

Damaging or destroying part of a facility, infrastructure, or secured site.

Acquisition and/or storage of unusual materials such as cell phones, radio controllers, or toxic materials.

Collection or discovery of unusual amounts of weapons including explosives, chemicals, or other destructive materials.

Actions which raise concern to specific sectors (e.g., power plant) with regard to their personnel, facilities, systems, or functions.