Training >> Browse Articles >> Homeland Security


The Detection and Prevention of Preparatory Terrorist Acts

The Detection and Prevention of Preparatory Terrorist Acts

Photo courtesy US DOJ

Noor Razzaq

One of the most important aspects of counterterrorism is the prevention of attacks against U.S. interests. Prevention requires law enforcement and intelligence personnel to have a basic knowledge of terrorist practices and mindsets concerning planning and implementation of attacks. It also requires a basic understanding of how these practices and mindsets differ from the planning and implementation of other types of premeditated criminal attacks.

Studies by the National Institute of Justice (NIJ) in 1999 revealed that terrorists are far more careful in planning and preparing for the completion of their attacks than other categories of criminal (as cited in Smith, Damphouse, & Roberts, 1999). This is due to the differing paradigms between both groups. While “average criminals” commit crimes with individualized self-serving motives, terrorists conduct attacks with religious, ideological, and/or political objectives in mind which their parent organizations believe to serve the “greater good”.

Terrorist groups can only reach their organizational objectives through careful consideration and planning. This planning is referred to as the Pre-Incident Phase of a terror attack and is often comprised of non-terrorist related activity (Razzaq, 2003). While there are generally five phases to a terrorist attack (Pre-Incident, Incident, Negotiation, Conclusion, and Post-Incident), this article will focus on the dynamics of the Pre-Incident Phase of terrorist attacks. Specifically, this article will review common pre-incident planning indicators and legal tools law enforcement officials have at their disposal to combat these tactics.

Examples of the Pre-Incident Planning Phase include thefts to procure group funding, theft of explosive materials, “the creation of false identities for group members… and crimes related to the maintenance of internal security” (Smith, et. al., 1999, p. 2). Some indicators of pre-incident planning include surveillance, tests of security, acquisition of supplies, elicitation, the presence of suspicious or out-of-place persons, dry runs, and the deployment of assets (Security Community Network, 2005).

Some examples of surveillance by terrorist group members include the drawing of maps or diagrams of potential targets, annotation of information on maps or diagrams, the use of vision-enhancing devices (e.g., binoculars, cameras, videotape, or night vision) near potential targets, and the possession blue prints of important facilities (e.g., military installations, government facilities, hospitals, et cetera) (SCN, 2005). Evidence of terrorist surveillance can be and has been spotted by local law enforcement during unrelated incidents such as traffic stops and during calls for service for such as domestic and loud noise complaints.

Tests of Security are terrorist assessments of emergency response capabilities via hoax activities (e.g., unsubstantiated bomb threats, etc.) (Razzaq, 2003). These tests allow terrorists to assess numbers, tactics, response time, and types of personnel and equipment used by first responders to quell emergencies. The final test of security is often the final dry run prior to the second phase (the “incident phase”) of a terrorist attack.

Elicitation refers to solicitation of information pertaining to critical U.S. infrastructures and can be detected by taking note of any unusual inquiries into military or first responder operations. It is important for law enforcement officials to remember that while a small innocuous piece of information may seem harmless in and of itself, these bits of so-called “harmless” information gathered over time by terrorists could allow them to piece together information which would be considered ‘sensitive knowledge’. This is often referred to as the “Grain of Sand” technique of intelligence gathering. These types of activities are analogous to the street criminal “casing a joint” and warrant at least a field interview, the same as any other suspicious activity.

In addition to unofficial inquiry, some terrorist organizations have been known to go to the extent of infiltrating government contracting agencies in both information-sensitive roles and non-information-sensitive roles (e.g., janitors, mail room workers, etc), thereby allowing their own personnel to be in key positions to more easily elicit information on potential targets (Razzaq, 2003; SCN, 2005).

Studies by Smith et al (1999) revealed that most terrorist incident preparation occurs approximately three months prior to attack and generally lasts between 12 days and two months. While some preparatory acts are not as overt as others, over three quarters of pre-incident planning activity is overtly observable criminal behavior (Smith et. al., 1999). It is important to note the aforementioned studies also revealed that over 62% of terrorist groups conducted their last preparatory act on the day of the incident while another 9% conducted their last preparatory act just the day before (Smith et. al., 1999). This alone is good reason for first responders and police personnel to remain vigilant in order to attempt to detect any of the aforementioned methods of pre-incident planning by terrorist organizations.

Once these activities are detected, prosecutors and law enforcement personnel have a variety of legislative tools at their disposal to prevent terrorist incidents before they occur, the most obvious of which is the Patriot Act. Some of the fundamental system-wide provisions of the Patriot Act are covered in Sections 201, 203, 206, and 212. For example, Section 201 of the Patriot Act allows us to use currently existing wiretap, pen register, and DNR (dialed number recorder) provisions to investigate offenses a given terrorist group or cell is likely to commit (U.S. Department of Justice, 2005).

Section 203 takes down the “wall” which used to inhibit information exchange between law enforcement and intelligence (U.S. DoJ, 2005). This relatively new free flow of information allows law enforcement to utilize intelligence agencies as sources of information regarding a particular terrorist group’s motives. The Department of Justice (2005) has credited Section 203 as being an instrumental tool in facilitating the revocation of visas of suspected terrorists and has helped to prevent re-entry of suspected terrorists into the U.S. It has also greatly enhanced the ability of law enforcement to track sources of terrorist funding and identify terrorist operatives overseas.

Section 206 allows the Foreign Intelligence Surveillance Authority (FISA) to authorize “roving surveillance”; meaning that wiretaps can be attached to a particular person rather than a particular communication device (U.S. DoJ, 2005). This is a significant step forward as previous laws did not account for changing technologies such as cordless telephones, cellular phones, and the internet. For example, they only allowed very specific communication devices to be wiretapped such as specific phone lines, specific phone numbers, or the base units of cordless phones but not the phones in and of themselves.

And finally, Section 212 allows providers of electronic communications to disclose customer records or the content of communications (e.g. phone records, e-mails, and the content of text messages) to government agencies in emergency situations involving “immediate danger of death or serious physical injury” (U.S. DoJ, 2005).

The aforementioned Patriot Act provisions are only a few of the many counterterrorism measures available to law enforcement. These measures improve law enforcement capabilities by allowing for enhanced ease in the development of probable cause, thereby allowing officers to take more immediate action in the disruption of pre-incident planning and the prevention of subsequent terror attacks.

Most federal law pertinent to terror investigation, prevention, and prosecution is contained within Title 18 of the U.S. Code. However, there are other Titles of the federal code which are available to law enforcement (especially federal and task force agents) in the fight against terrorism depending on their jurisdiction of legal code. Examples of non-Patriot Act federal law which applies to counterterrorism include the following:

18 USC 2332b (Acts of terrorism transcending national boundaries) makes it illegal to create “a substantial risk of serious bodily injury to any other person by destroying or damaging [or attempting or conspiring to destroy or damage] any structure, conveyance, or other real or personal property within the United States” (Cornell Law, n.d.).

18 USC 2339C: Prohibitions against the financing of terrorism makes it illegal to willfully fund terrorist activity or even be aware that funding is taking place without reporting it (Cornell Law, n.d.). 18 USC 1543 (Forgery or false use of passport) makes it illegal to counterfeit, forge, or alter passports and willfully and knowingly use those passports (Cornell Law, n.d.). 18 USC 842 (Unlawful Acts [Explosives]) specifies punishments for attempting to obtain explosive devices and 26 USC 5845 (f)(1) provides specific legal definitions for “destructive devices”, to include explosives, incendiary devices, and poison gas (Cornell Law, n.d.).

Title 50 of the U.S. Code can also be utilized in the prosecution of terrorists for pre-incident planning as related to military installations. For example, 50 USC 795 makes it illegal to photograph or sketch U.S. Department of Defense installations (Cornell Law, n.d.). And 50 USC 797 makes it illegal to trespass on any U.S. military installation (Cornell Law, n.d.). In addition to relevant federal law, law enforcement officers should be familiar with their own state’s laws pertaining to the prosecution of terrorism and terrorist acts as the implementation of state legislation to combat terrorism has become more common in the U.S. since 9/11.

Aside from direct violations of the aforementioned code sections, law enforcement should also remember the concept of arrests based on inchoate offenses, by which an offender can be charged for conspiracy, facilitation, solicitation, or even attempt to commit violations of the aforementioned or other laws. Based on this principle, simply planning a terrorist attack (meaning the implementation of any pre-incident tactic) is punishable by the same punitive measures used to prosecute the perpetrators of a completed attack.

While counterterrorism and terrorism prevention are concepts traditionally associated with our nation’s intelligence agencies, there are many basic avenues law enforcement can take in fighting terrorism. Simply keeping an eye out for indicators of pre-incident planning is integral to counterterrorism efforts nationwide. Patriot Act provisions greatly assist law enforcement efforts by facilitating more efficient terrorist monitoring and probable cause development. Finally, familiarization with state and federal law pertaining to the prevention of terrorist attacks is an absolute must.

The aforementioned laws and provisions are only a few of the many examples regarding which code sections can be used in the prosecution of terrorists attacking U.S. interests both domestically and globally. It is important for law enforcement personnel to be not only familiar with these available provisions, but to be vigilant in detecting both legal and illegal acts designed to prepare terrorist organizations for attacks against their targets. Vigilance and diligence in the fight against terrorism by law enforcement can be the difference between ‘just another day’ and another potential 9/11.


Cornell Law. (n.d.). Title 18 of the United States Code. Retrieved July 31, 2007:

Razzaq, N.Z. (2003, September). U.S. Air Force 1st Security Forces Squadron Emergency Services Team (EST) Lesson Guide. Paper presented at Langley Air Force Base EST (SWAT) Team’s First Instructional Forum on Terrorism.

Secure Community Network. (2005). Seven Signs of a Terrorist Attack. Retrieved August 5, 2007:

Smith, B.L., Damphousse, K.R. & Roberts, P. (1999). Pre-Incident Indicators of Terrorist Incidents: The Identification of Behavioral, Geographic, and Temporal Patterns of Preparatory Conduct. Retrieved August 5, 2007, from:

U.S. Department of Justice. (2005). Fact Sheet: USA Patriot Act Provisions Set For Reauthorization. Retrieved July 31, 2007, from:

Copyright © 2007 by Noor Z. Razzaq. All Rights Reserved.

PoliceLink School Finder

Save time in your search for a degree program. Use PoliceLink's School Finder to locate schools online and in your area.

* In the event that we cannot find a program from one of our partner schools that matches your specific area of interest, we may show schools with similar or unrelated programs.