The identification process for Domestic Extremists requires considering many indicators. Recently released research indicates examining the mix of behavioral indicators such as personal connections, ideology, travel, and training may prove beneficial in determining the existence of an individual’s extremist views. The presentation suggests using these indicators not as a checklist but as a type of scale to help analysts determine priorities for research and investigation as resources become available.

1. 9/27/2012
Abstract
• The identification process for Domestic
Extremists requires considering many indicators.
Recently released research indicates examining
the mix of behavioral indicators such as personal
connections, ideology, travel, and training may
prove beneficial in determining the existence of
an individual’s extremist views. The presentation
suggests using these indicators not as a checklist
but as a type of scale to help analysts determine
priorities for research and investigation as
resources become available.
1

2. 9/27/2012
Why is this being done?
• Contacted by friend at Fusion Center
–Worked gangs together.
• In TN (and other states), used point
system for gang investigators to quantify
indicators of gang membership.
– Could we come up with similar system for
domestic terrorists?
2

3. 9/27/2012
• Domestic Terrorists • Militia Extremists
• Homegrown Violent • Animal Rights
Extremists Extremists
• Racist Skinhead • Anti-Abortion
Extremists Extremists
• Sovereign Citizen • Environmental Rights
Extremists Extremists
• Supremacist • Anarchist Extremists
Extremists (black) • Lone Offender
• Supremacist • Facilitators
Extremists (white) • Unwitting Co-optees
Domestic Terrorism (DHS/FBI)
• act of violence
–dangerous to life, potentially destructive of
critical infrastructure or key resources
–committed by group or individual
–operating entirely within US without
direction or inspiration from foreign
terrorist group (unlike homegrown violent
extremist).
3

4. 9/27/2012
Important to note (NCTC, 2011):
• Wide array of indicators in case studies,
coupled with variety of US organizations
that appear best placed to detect specific
signs, cautions against adopting checklist-
like mentality in countering HVE threat.
• Simplistically interpreting any single
indicator as confirmation of mobilization
probably will lead to ineffective and
counterproductive efforts to identify and
defeat HVEs.
Gang points (count to 10)
Self Admission (9). Corresponding with Gang
Tattoos (8) members (3)
Hand Signs/Symbols/Logos (3) Named Gang member in
Wearing colors, clothing, correspondence (8)
paraphernalia (1) Confirmation by outside
Possessing related docs (3) agency gang unit/database (10)
Possessing commercial pubs (1) Gang Crime or activity (8)
Participation commercial pubs (8) STG-related discipline (5)
Consistent contact with Gang Identified as Gang member by
members (2) gang member (8)
Contact w/Gang members Identified as Gang member by
In photo with Gang members (2) reliable informant (9)
Outside jurisdiction docs (5)
4

5. 9/27/2012
Available Research (DT/HVE)
• The DHS Information Sharing Environment
(ISE) Suspicious Activity Reporting (SAR) Version
1.5, Functional Standard (FS) 200, May 21, 2009,
defines suspicious activity as observed behavior
reasonably indicative of pre-operational planning
related to terrorism or other criminal activity.
• Examples of the criteria for identifying behavior,
with defined relationships to criminal activity
that also have a potential terrorism nexus,
include
5

6. 9/27/2012
• Breach/Attempted • Testing or Probing
Intrusion Security
• Misrepresentation • Recruiting
• Theft/Loss/Diversion • Photography
• Sabotage/Vandalism/ • Observe/Surveillance
Tampering • Materials
• Cyber Attack Acquisition/Storage
• Expressed or Implied • Acquisition of Expertise
Threat • Weapons Discovery
• Aviation Activity (used)
• Eliciting Information • Sector-Specific Incident
These activities are generally First
Amendment-protected activities . . . absent
articulable facts and circumstances . . .
behavior observed is not innocent . . .
(DHS, 2009).
Race, ethnicity, national origin, or religious
affiliation should not be considered as
factors that create suspicion (although
these factors may used as specific suspect
descriptions) (DHS, 2009).
6

7. 9/27/2012
Keeping that in mind
7

8. 9/27/2012
More Available Research (HVE)
In Identifying Homegrown Violent
Extremists Before They Strike, the
Department of Homeland Security
(2010) identified a list of activities that
might warrant reporting Homegrown
Violent Extremists before they carry out
a terrorist act.
• New or increased advocacy of violence
• New life styles/segregation from normal groups-
association with criminal/terrorists.
• Adoption of new name.
• Surveillance of potential targets.
• Acquisition of excessive quantities of weapons or
explosive materials.
• Travel to or interest in traveling to attend
extremist institutions or paramilitary camps.
• Reading materials that advocate violence and
initiating action in support.
• Interest in critical infrastructure and landmarks
8

9. 9/27/2012
Even More Available Research (HVE)
In Behavioral Indicators Offer Insights for Spotting
Extremists Mobilizing for Violence, the National
Counterterrorism Center (NCTC) (2011) reported
discovering major mobilizing patterns shared by a
majority of HVE cases between 2008 and 2010,
identified distinct behaviors often associated with an
individual mobilizing for violence. These four
patterns included :
1) links to known extremists
2) ideological commitment to extremism
3) international travel
4) pursuit of weapons and associated training.
9

10. 9/27/2012
Of 70 behaviors associated with HVE mobilization, 16
appeared most (at least 50%) of the time
• Communicating/Links to Extremists
• Possessing/sharing Jihadist videos or propaganda
• Seeking religious instruction
• Suspicious foreign travel (destination-based)
• Acceptance/approval/intent to conduct violent jihad or martyrdom ops
• Weapons/paramilitary training, acquiring gear, recon, surveillance
• Expressed perception of threat against individual or Islam
• Effort to obtain weapons, materials, chemicals
• Acknowledge/implied membership or association with radical groups
• Use of cover terms to mask meaning of events or other illicit activities
• Attempted/desired foreign travel
• Research targets, technical capabilities, planning, logistics
• Suspicious travel patterns – one way, lost passports, using agencies of interest
• Isolation/ruptured family relationship
• Active engagement in online, password protected websites.
• Active leadership or participation in secret group meetings.
Let‘s combine the indicators . . .
10

11. 9/27/2012
There are three areas
• Foundation
• Preparation/Intelligence
Gathering
• Commission of
Crime/Terrorist Activity
How’s that work?
Imagine you are investigating activity after the fact.
• Foundation
– not likely to be prosecutable
– may be protected by Constitution.
• Preparation & Intelligence
– could be the overt act in conspiracy, where two or
more agree to commit crime and one does something
(overt act) in furtherance of the crime.
• Commission of Crime/Terrorist Activity
– activity likely charged alone in most jurisdictions.
11

12. 9/27/2012
Foundation
1. Discarding Old Associations: New life styles, isolation,
segregation, ruptured relationships, (DHS, 2010; NCTC,
2011)
2. Making New Associations:
– Connection to Criminals, Extremists , Terrorists (DHS, 2010;
NCTC, 2011)
– Using online, password protected websites (NCTC, 2011)
– Use of cover terms to mask meaning of events or other illicit
activities (NCTC, 2011)
3. Adopting New Beliefs:
– New or increased advocacy of violence (DHS, 2010)
– Seeking religion, including extremist, instruction, possessing
videos or propaganda, perception of threat against beliefs ,
association with radical groups (NCTC, 2011)
– Participating in secret group meetings (NCTC, 2011)
Preparation and Intelligence Gathering
1. Acquiring New Identification: Adoption of new name (DHS, 2010)
2. Developing New Skills:
– Reading materials that advocate violence and acting (DHS, 2010)
– Acquiring Expertise (DHS, 2009)
3. Obtaining Tools and Conducting Research:
– Acquiring weapons, gear, materials, chemicals, paramilitary training; recon,
surveillance (NCTC, 2011, DHS, 2010)
– Observe/Surveillance Photography (DHS, 2009; DHS, 2010)
– Attempted Intrusion, Probing ,Expressed or Implied Threat (DHS, 2009)
– Research targets (e.g. landmarks, infrastructure), tech capabilities, planning,
logistics (NCTC, 2011; DHS, 2010)
– Eliciting Information (DHS, 2009)
– Suspicious Aviation Activity (DHS, 2009)
4. Traveling:
– Travel to or interest in traveling to attend extremist institutions or paramilitary
camps (DHS, 2010)
– Attempted/desired/completed suspicious foreign travel (NCTC, 2011)
– Suspicious travel patterns (NCTC, 2011).
5. Recruiting (DHS, 2009)
12

13. 9/27/2012
Commission of Crime/Terrorist Activity
1.Misrepresentation (DHS, 2009)
2.Theft/Loss/Diversion (DHS, 2009)
3.Sabotage/Vandalism/
Tampering (DHS, 2009)
4.Cyber Attack (DHS, 2009)
5.Sector (e.g. Public Health, Police)
Specific/Unique Incident (DHS, 2009)
Simplified
Foundation 5. Recruiting
1. Discard Old Assoc Crime/Terrorist
2. New Assoc Activity
3. New Beliefs 1.Misrepresentation
Preparation & 2.Theft/Loss/Diversion
Intelligence 3.Sabotage/Vandalism/
Tampering
1. New ID
4.Cyber Attack
2. New Skills
5.Sector-Specific
3. Tools & Research Incidents
4. Travel
13

14. 9/27/2012
Consider agency-specific
needs and desires
Make steps:
13.
12.
11.
10.
9.
8.
7.
6.
5.
4.
3.
2.
1.
14

15. 9/27/2012
• Collection process can take each step into
account, perhaps equally weighted.
• With 13 indicators, anything above 8 is
definitely actionable, most above 4 are.
• If indicators climbing and resources
available, organization, agency, etc. can
choose to devote time to cultivate more
intelligence or determine strategy.
• If prioritization needed due to heavy
workload, the scoring system could easily
provide the way.
Goal is combining
objectivity & subjectivity
while leaving room for reality
15

16. 9/27/2012
Next Steps
• Review, revise, refine
• Examine past decade DT
offenders and indicators
• Consider weighting indicators
• _______________
• _______________
• _______________
Follow up?
16

17. 9/27/2012
References
Department of Homeland Security. (2010) Identifying
Homegrown Violent Extremists Before They Strike: An
Information Needs Review. Author. Retrieved from
http://www.scribd.com/doc/37873835/DHSHomegrownThre
ats
Department of Homeland Security. (2009). Information Sharing
Environment (ISE) Suspicious Activity Reporting (SAR) Version
1.5, Functional Standard (FS) 200. Author. Retrieved from
http://www.dhs.gov/xlibrary/assets/privacy/privacy-pia-
dhswide-sar-ise-appendix.pdf
National Counterterrorism Center. (2011). Behavioral Indicators
Offer Insights for Spotting Extremists Mobilizing for Violence.
Author. Retrieved from http://publicintelligence.net/ufouo-
national-counterterrorism-center-mobilizing-homegrown-
violent-extremists-hves-behavioral-indicators
What fit where?
• Foundation – F
• Preparation/intelligence
Gathering - P
• Commit Crime/Terrorist Act - C
17

18. 9/27/2012
DHS 2009
• Breach/Attempted Security P3
Intrusion P3 • Recruiting P5
• Misrepresentation C1 • Photography P3
• Theft/Loss/Diversion C2 • Observe/Surveillance P3
• Sabotage/Vandalism/ • Materials
Tampering C3 Acquisition/Storage P3
• Cyber Attack C4 • Acquisition of Expertise
• Expressed or Implied P2
Threat P2 • Weapons Discovery
• Aviation Activity P3 (used) P3
• Eliciting Information P3 • Sector-Specific Incident
• Testing or Probing C5
DHS 2010
• New or increased advocacy of violence F3
• New life styles/segregation from normal groups-
association with criminal/terrorists F1
• Adoption of new name P1
• Surveillance of potential targets P3
• Acquisition of excessive quantities of weapons or
explosive materials P3
• Travel to or interest in traveling to attend extremist
institutions or paramilitary camps P4
• Reading materials that advocate violence and initiating
action in support P2
• Interest in critical infrastructure and landmarks P3
18

19. 9/27/2012
NCTC 2011
• Communicating/Links to Extremists F2
• Possessing/sharing Jihadist videos or propaganda F3
• Seeking religious instruction F3
• Suspicious foreign travel (destination-based) P4
• Acceptance/approval/intent to conduct violent jihad or martyrdom ops F3
• Weapons/paramilitary training, acquiring gear, recon, surveillance
• Expressed perception of threat against individual or Islam P3
• Effort to obtain weapons, materials, chemicals P3
• Acknowledge/implied membership or association with radical groups F3
• Use of cover terms to mask meaning of events or other illicit activities F2
• Attempted/desired foreign travel P4
• Research targets, technical capabilities, planning, logistics P3
• Suspicious travel patterns – one way, lost passports, using agencies of
interest P4
• Isolation/ruptured family relationship F1
• Active engagement in online, password protected websites F2
• Active leadership or participation in secret group meetings F3
19