A Practical Guide to Recognizing PreAttack Behavior Anyone Can Spot
Intro: When people think of terrorism, the images that come to mind are usually dramatic: explosions, gunfire, chaos.
But most terrorist attacks don’t begin with violence. They begin with behavior — small decisions, subtle movements, patterns of activity that seem ordinary at first glance.
Today, we’re going to break down those patterns — the signs most people miss before attacks — using real examples from around the world and translating them into what they might look like in everyday life here in the United States.
Because terrorism doesn’t announce itself. But it leaves footprints — and if more people learn to recognize them, we can prevent tragedies before they even begin.
Segment 1 — Reconnaissance & Suspicious Observation
Concept
Before attacking, terrorists almost always observe and map their target — they study patterns, entrances, exits, security, and crowd flow. This is called reconnaissance.
Global Examples
2006 Transatlantic Aircraft Plot (UK): Plotters booked flights and hotel rooms near airports to observe security checkpoints and airport procedures directly.
2019 Sri Lanka Easter Bombings: Attack cells visited churches and hotels repeatedly to understand crowd flow and peak attendance times.
2016 Nice Truck Attack (France): The attacker drove the parade route multiple times beforehand to evaluate traffic and crowd density.
U.S. Analogy
Imagine someone
Taking repeated photographs of airport security checkpoints at a major U.S. hub like JFK or LAX
Segment 2 — Dry Runs & Testing Security
Concept
Terrorists often practice parts of an attack — approaching entry points, timing crowd peaks, checking reactions — before they act. These are called dry runs.
Global Examples
Paris 2015: Attackers rehearsed moving between cafés and the Bataclan Theatre, noting crowd patterns and security presence.
Mumbai 2008: Operatives walked through hotels and rail stations, timing guard responses and entry points.
Boston Marathon 2013: The bombers ran near the race route multiple times before the
Why It’s a Red Flag
Most people don’t rehearse public access unless they have legitimate business. Repeated access attempts without purpose can reveal preparation for disruption.
See Something, Say Something
⚠️ Multiple unexplained visits to a venue entrance⚠️ Someone timing entrances, exits, or crowd flow⚠️ Repeated movement through checkpoints without valid purpose
Segment 3 — Surveillance Behavior & Pattern Mapping
Concept
Once terrorists have picked a target, they often treat it like a system to be studied and exploited. Know everything.
Global Examples
Westgate Mall 2013 (Nairobi): Attackers studied security camera placement, guard patrols, and peak customer movement for months before the attack.
2006 London Train Bombers: Monitored commuter patterns and station routines before detonating explosives on trains.
Segment 4 — Changes in Routine & Encrypted Communication
Concept
Before execution, attackers often make communication changes to hide their planning — this is operational security, not social behavior.
Encrypted messaging and sudden changes in communication often appear in plots. These may
These are real apps used in past cases.
Global Examples
Paris 2015: Cells used WhatsApp and other encrypted apps to coordinate across borders.
Delhi in November: Terrorists linked to the recent bombing near the Red Fort reportedly used encrypted messaging platforms such as Session, Telegram, and Signal to communicate. Platforms like Session are particularly attractive to terrorist networks because they remove several of the identifiers investigators traditionally rely on. Session does not require phone number registration, meaning accounts are not tied to a SIM card or a real-world identity. The service also avoids centralized cloud storage of messages and routes communications through a decentralized network, limiting metadata and making attribution significantly more difficult.
U.S. Analogy
A person who suddenly deletes social media and only uses anonymous group chats while conducting unusual surveillance behavior.
Segment 5 — Resource Acquisition & PreAttack Preparation
Concept
Terrorists need materials, vehicles, weapons, or supplies to prepare a attacker. Gathering these quietly is often part of the plan.
Global Examples
Mumbai 2008: Firearms and GPS devices hidden and moved strategically.
London Liquid Explosive Plot (2006): Components bought in small, legal quantities to avoid detection.
Paris & Brussels 2015–2016: Weapons transported across borders and stored in safe houses.
Segment 6 — Micro Signs Often Overlooked
Many pre-attack indicators are subtle. On their own they may look ordinary, but when several appear together or repeat over time, they can signal surveillance or planning activity.
Examples
• Repeatedly asking detailed questions about security procedures, guard rotations, or access rules.• Photographing or filming emergency exits, fire alarms, security cameras, badge readers, or building access points rather than typical tourist photos.• Lingering near delivery entrances, stairwells, service corridors, loading docks, or restricted access doors.• Studying transportation schedules or infrastructure patterns at unusual hours, including bus routes, subway timing, or commuter flows.• Repeated presence at natural choke points such as entry gates, ticket counters, or bottlenecks where crowds slow down.• Unusual attention to infrastructure rather than people. Examples include counting cameras, studying lighting, mapping escape routes, or examining barriers and vehicle access points.
Terrorism doesn’t announce itself with a headline before an attack. The change of us knowing when and where exactly an attack is going to occur is near impossible.
It leaves patterns in behavior: reconnaissance, dry runs, surveillance, encrypted communication changes, resource acquisition, and microsigns in public spaces.
If you see something — anything that feels off or sticks out of the ordinary — trust your gut and report it.
“See Something, Say Something” is not just a slogan. It’s a proven early warning mechanism that helps protect communities, schools, transit hubs, and everyday public spaces.
Understanding how terrorists plan and behave gives you the edge — and it can save lives.
These links may be useful for content
https://www.foxbusiness.com/video/4816307193001
https://www.fbi.gov/video-repository/fbi-prevent-mass-violence-psa-021126.mp4/view
https://youtu.be/PFhQ-_cMwAU?si=5cwLC5eBZE1Zq5zZ