The IAFC’s committee on Terrorism and Homeland security has focused on highlighting the criteria for Suspicious Activity Reporting (SAR) through actual fire department case studies. The last two articles of this series will review a complex, extended case study on how the fire department’s SAR system and information sharing with our partners helped identify a potential plot.
This case will highlight the importance of information sharing partnerships and developing a comprehensive SAR policy.
National Capitol Region Fire/EMS – Leading up to the President’s Second Inauguration
Over the course of five months (September 2012–January 2013), there were multiple reports of suspicious activities in the National Capitol Region (NCR) involving suspicious inquiries about fire/EMS stations, specific equipment and function of apparatus, and operations throughout the NCR region.
Their frequent occurrence and similarity in pattern underscore the importance of attention to behavior that may indicate nefarious motives, related to either terrorist or criminal activity.
September 2012, Fairfax County, Va.
During battalion training on terrorism, a member relayed an anecdotal situation that happened at a station he was assigned to earlier. Two men entered the station to inquire what it would take to “drive a fire truck.” They were informed of the process on becoming a firefighter. They weren’t interested in joining the fire service, just in driving the truck. They asked specific questions regarding a CDL and how much water the engine could carry.
This wasn’t reported due to the lack of personal data on the subjects. It was relayed to the Northern Virginia Regional Intelligence Center (NVRIC) at a later date.
Note: if it’s suspicious, report it, even if you only have partial information.
In another event, a fire captain reported a suspicious note seen during an EMS call: a hand-written paragraph, seen in plain sight during the call, in Arabic with three English words written in the margin of the page: “Bomb,” “fuse,” “convention.”
He reported this through the NVRIC to JTTF. The FBI followed up with firefighters by interviewing them at their station. (Case opened.)
December 2012, Fairfax County
A deputy fire chief witnessed two men sitting in a car outside a career fire station in the alley at night; this is a one-way alley with access to the fire station’s kitchen door. There was a public, lit parking lot on the back side of the building for visitors and public access.
The deputy chief approached the car to ask if there was a need for service. The men reported wanting to volunteer, but acted suspiciously. The chief gathered their information and reported it to NVRIC; a formal SAR was created with this information. One individual and the owner of the car were in the Terrorist Screening Center’s Watch list.
December 2012, District of Columbia
A woman and a self-identified “Afghani” man entered a fire station, asking how to become a volunteer and drive apparatus. Their questions and behaviors were unusual: D.C. doesn’t have volunteers, the individuals were aware of the DCFD work schedule, they asked about dispatch protocol for apparatus and the male wasn’t from Afghanistan.
This event was reported through JTTF and passed on to NVRIC because of our information sharing policy in the region and because they knew we’d had several similar incidents.
A second report surfaced about the same woman entering a fire station the next day. An investigation discovered discrepancies in the full name, date of birth and address she gave. She also had a very convoluted criminal history.
At this point, all entities of the NCR increased communication about any type of suspicious events. The NCR had well-established information-sharing partnerships comprising FSLT members. With these events happening only weeks before the inauguration, heightened importance and attention were given to any similar events.
See how this situation continued to grow and how it was concluded in December’s IAFC SAR series article.