Using Behavioral Indicators to Help Detect Potential Violent Acts

Using Behavioral Indicators to Help Detect Potential Violent Acts: A Review of the Science Base

Paul K. Davis
Walter L. Perry
Ryan Andrew Brown
Douglas Yeung
Parisa Roshan
Phoenix Voorhies
Copyright Date: 2013
Published by: RAND Corporation
Pages: 300
  • Cite this Item
  • Book Info
    Using Behavioral Indicators to Help Detect Potential Violent Acts
    Book Description:

    Government organizations have put substantial effort into detecting and thwarting terrorist and insurgent attacks by observing suspicious behaviors of individuals at transportation checkpoints and elsewhere. This report reviews the scientific literature relating to observable, individual-level behavioral indicators that might, along with other information, help detect potential violent attacks.

    eISBN: 978-0-8330-8336-4
    Subjects: Sociology, Technology

Table of Contents

  1. Front Matter
    (pp. i-ii)
  2. Preface
    (pp. iii-iv)
  3. Table of Contents
    (pp. v-viii)
  4. Figures
    (pp. ix-x)
  5. Tables
    (pp. xi-xii)
  6. Summary
    (pp. xiii-xl)
  7. Acknowledgments
    (pp. xli-xlii)
  8. Abbreviations
    (pp. xliii-xliv)
  9. CHAPTER ONE Introduction
    (pp. 1-14)

    Federal, state, and local government organizations have put substantial effort into detecting and thwarting terrorist and insurgent attacks by observing suspicious behaviors of individuals, whether at transportation checkpoints. Technologies and methodologies abound for contributing to such defensive activities in myriad ways. However, the volume and diversity of activities and claims has often been overwhelming. Further, claims about effectiveness sometimes lack a clear basis in science and technology. This occurs for different reasons. Sometimes operators in the field move quickly to deal with clear and present dangers without having the benefit of scientific groundwork. Other times, enthusiasts for a clever idea...

  10. CHAPTER TWO Developing Intent
    (pp. 15-28)

    “Developing Intent” includes developing a motivation, disposition, or inclination that may lead to a violent act in the context of terrorism or insurgency.* We divide this phase into three lower-level behavioral activities: (1) motivational and emotional development, (2) psychological convergence, and (3) recruitment or joining.

    Some cognitive and emotional characteristics developed relatively early, perhaps under harsh conditions and even oppression, could support later involvement in a terrorist or insurgent attack. Behavioral indicators of such developments typically provide only very weak and ambiguous signals. For example, social disaffection can lead to involvement with criminal groups, to mental illness, or to addiction...

  11. CHAPTER THREE Planning and Laying Groundwork
    (pp. 29-36)

    Except for spontaneous attacks that use immediately available weaponry or explosives, a planning phase usually exists in which individuals or organizations select a target, acquire or develop and test the necessary explosives or weaponry, develop a plan of attack, and train or rehearse. One example was the Oklahoma City bombing. Timothy McVeigh carefully selected his specific target: knowing the attack would receive much press; he picked a building with a large window façade to create a more dramatic post-explosion image. Also, he used a variety of discrete ways to acquire bomb-making material, preformed numerous tests to ensure correctness, developed a...

  12. CHAPTER FOUR Immediate Pre-Execution
    (pp. 37-46)

    The “Immediate Pre-Execution” phase refers to the behavior of attackers and such support personnel as drivers and handlers in the period immediately preceding the attack (usually 24 hours or less) in what could also be termed “final preparations” for the attack. Due to the temporal proximity of these behaviors to attack execution, this phase could be the most useful and relevant for security and intelligence services attempting to detect and disrupt an attack before (or during) its occurrence. This temporal proximity also has relevance for a range of psychological and physiological changes and preparations, as well as alterations in social...

  13. CHAPTER FIVE Execution and Aftermath
    (pp. 47-56)

    This chapter combines the phases of Execution and Aftermath. We included these phases in a deliberate approach to look for plausible observables everywhere we could think to do so. Indicators from one attack’s execution and aftermath could be valuable in detecting a future attack. We drew on existing historical cases, logical thinking, and knowledge from what occurs with criminal behavior to generate a long list of behavioral indicators. Probably none are truly new or unusualexceptif looking for indicators of these types by exploiting massive networked computer searches in near real time, by drawing on prior knowledge about individuals,...

  14. CHAPTER SIX Technologies and Methods
    (pp. 57-114)

    Previous chapters describe behaviors displayed by terrorists and insurgents prior to, during, or after attacks. This chapter addresses technology and methods for detecting such behaviors, grouping them in three cross-cutting categories of information: (1) communication patterns, (2) “pattern-of-life” data, and (3) indicators relating to body movement or physiological changes. The items in each category can be useful in observing behaviors in the activity classes used throughout this report: developing intent, planning and laying groundwork, immediate pre-execution, execution, and aftermath. Because our review is to inform research and development (R&D) management and investment, it is selective rather than exhaustive, and the...

  15. CHAPTER SEVEN Cross-Cutting Issues
    (pp. 115-148)

    This chapter is about cross-cutting issues that loomed large as we sought to make sense of our review of the science base. To our knowledge, the literature contains no agreed framework for thinking about this, so we constructed a first-cut framework ourselves. We characterize a system in terms of its detection effectiveness and its effectiveness in limiting false alarms and their consequences. We then see these as depending on seven characteristics of the system, as shown in Figure 7.1. We discuss them in the numerical order shown in the figure, which is not strictly left to right so as to...

  16. CHAPTER EIGHT Conclusions
    (pp. 149-160)

    Some themes have been important throughout our study. First, it is clear that most relevant behavioral indicators will have low detection rates and large false-alarm rates. Such problems are exacerbated by adversary countermeasures. Detection-system performance, however, can in a number of instances be improved by probing or otherwise stimulating responses.

    Second, because of the weak signals and false-alarm rates, there is need for two classes of activity: (1)pattern discoveryby man-machine study of data and (2)information fusion. It remains to be seen what either or both can accomplish, but we expect the gain to be considerable.

    Pattern discovery...

  17. APPENDIX A Methodological Notes
    (pp. 161-164)
  18. APPENDIX B References and Cases to Support Historic Examples
    (pp. 165-176)
  19. APPENDIX C References and Cases to Support Indicator Tables
    (pp. 177-188)
  20. APPENDIX D Information Fusion Methods
    (pp. 189-224)
  21. Bibliography
    (pp. 225-258)