You already know what to do to increase your chances of surviving a terrorist attack . But at that point, you are just re-acting. That is the way that many of us have been trained for. A bomb goes off, you are being fired at…..and you re-act. Neutralize the threat. Look after the wounded. And that is exactly what the US marines were mostly doing and getting killed and injured in unprecedented numbers in Iraq. Marine General Mattiss, callsign “Chaos” was fed up with it. He wanted the Marines to have the knowledge and training to be able to predict an attack before it even happened. Not only be defensive, but be offensive as well. Take away the initiative from the enemy….and kick their ass!

The Combat Hunter program was created to do so. The objective: Bring the Marines ‘Left of Bang’. Imagine a timeline. ‘Bang’ (the incident) is in the middle of it. To the right you have the re-action: the immediate action drill, CAS, Medic etc. To the left you have every thing leading up to ‘Bang’.

Especially the ‘Combat Profiling’ pillar of the Combat Hunter Program can easily be used by anybody for an early detection of a terrorist act.

Left of Bang by Patrick van Horne and Jason Riley, has been written about this program and I highly recommend it for all military personnel, law enforcement officers and concerned citizens. The book focuses on Pre Incident Indicators, to keep you Left of Bang.

I am not an expert on the subject, but still I did not want to keep this useful information from you. I hope it will help en inspire you to study more about the subject. It was eye-opener for me and hope it will do the same for you. This article is based on the book and additional online information. The Combat Hunter program has proven to save many Marine lives.

Be Aware

You have probably heard this a thousand times, but let’s be honest: If you are not aware, you might as well stop reading. Don’t even continue if your head is in your cellphone 24/7 in public places. Obviously, for you to be able to pick up signs that someone is up to no good….you actually have to be aware of the people in your surroundings. It’s hard enough to pick up these Pre Incident Indicators as is. Be aware. There are enough Sheep. Thank you for making the World a safer place.

So, you’re scanning the area you are in. Eyes wide open. 360. Full Mellow Yellow. Constantly aware…….but what are you looking for??? What good is a hunter if you do not know what the prey looks like?

Phases Of An Attack

Broadly, there are 2 phases that we can concentrate on that a terrorist will go through:

-The Preparation Phase

-The Execution Phase

Both these Phases are crucial to the attacker. In both Phases the attacker does not want to show what he is up to, right up until the attack takes place. That is the way to kill a bunch of people. By surprise.

Nowadays the Preparation Phase can be really short: Open kitchen draw, grab biggest knife, walk outside, stab as many people as possible. Yes, it’s sick.

But usually there will be more preparation to an attack. You can observe a terrorist in each of these phases, because he will probably need to expose himself. Just know that a lot of Bad guys do not want to get caught, confronted or even discovered in the Preparation Phase. For many, just being addressed during this Phase is reason to call off an attack entirely. No surprise = Hard target. Hard target = Less likely to succeed. There are many soft targets around.

Think of the following Preparation that you can witness a terrorist conduct:

  • Surveillance. If terrorists have chosen a specific target, that target area will most likely be observed during the preparation phase of the operation. They do this in order to determine the strengths, weaknesses and number of personnel that may respond to an incident. Routes to and from the target are usually established during the surveillance phase. It is therefore important to take note of such things as someone recording (like cameras ion mobile phones) or monitoring activities, drawing diagrams on or annotating maps, using vision-enhancing devices and/or having in one’s possession floor plans or blue prints of places such as high-tech firms, financial institutions or government/military facilities. Any of these surveillance-type acts may be an indicator that something just is not right. Nothing is too trivial and should not be discarded as such. Often surveillance is needed to confirm the information that has been gathered online or to fill in the blanks. Be on high alert when you see someone doing surveillance. If someone is trying to hide what they are doing, be especially suspicious.
  • Elicitation. The second sign or signal is elicitation. What this means is anyone attempting to gain information about a place, person or operation. An example is someone attempting to gain knowledge about a critical infrastructure like a power plant, water reservoir or maritime port. Terrorists may attempt to research bridge and tunnel usage, make unusual inquiries concerning shipments or inquire as to how a military base operates.  They may also attempt to place “key” people in sensitive work locations.
  • Tests of Security. Tests of security is another area in which terrorists would attempt to gather data. This is usually conducted by driving by the target, moving into sensitive areas and observing security or law enforcement response. Terrorists would be interested in the time in which it takes to respond to an incident and/or the routes taken to a specific location. They may also try to penetrate physical security barriers or procedures in order to assess strengths and weaknesses. They often gain legitimate employment at key locations in order to monitor day-to-day activities.
  • Funding. Suspicious transactions involving large cash payments, deposits, or withdrawals are common signs of terrorist funding. Collections for donations, the solicitation for money and criminal activity are also warning signs. You might not be able to see this, but it can be an essential part of the Preparation Phase.
  • Acquiring Supplies. This may be a case where someone is purchasing or stealing explosives, weapons or ammunition. It could also be someone storing harmful chemicals or chemical equipment. Bomb-making supplies can be as quotidian as fertilizer or beauty supplies. A terrorist would also find it useful to have in their possession law enforcement equipment and identification, military uniforms and decals, flight passes, badges, etc. If they can’t find the opportunity to steal these types of things, they may try to photocopy IDs or attempt to make passports or other forms of identification by counterfeiting. Possessing any of these would make it easier for one to gain entrance into secured or usually prohibited areas.
  • Dry Runs. Before execution of the final operation or plan, a practice session will be run to work out the flaws and unanticipated problems. A dry run may very well be the heart of a planning stage of a terrorist act. If you find someone monitoring a police radio frequency and recording emergency response times, you may very well be observing a “dry run.” Another element of this activity could include mapping out routes and determining the timing of traffic lights and flow. This stage is actually your best chance to intercept, report and stop an attack. Multiple dry runs are normally conducted at or near the target area.
  • Deploying Assets/Getting Into Position. This is a person’s last chance to alert authorities or take action before the terrorist act occurs. It is also important to remember that pre-incident indicators may come months or even years apart. This is already part of the Execution Phase.

What Behaviour To Look Out For?

In trying to disguise his true intentions and anxiety, the terrorist might display certain behavior. He will try to blend in. Go unnoticed. Hide in plain sight. But that might not be easy.

Establish Baseline

Wherever you are, you need to establish a Baseline. A Baseline is behaviour that is expected and ‘normal’ at a certain place. People at a concert behave in a certain way. People at a mall behave in a certain way. People on a busy Metropolitan subway behave in a certain way. The Baseline is the Normal. That baseline can differ from location to location, from country to country, from culture to culture…..but there will be a Baseline.

Now look for deviations from that Baseline, the anomalies. Any person that does, or does not do something, that you would expect. Or any item that should, or does not, belong in an area.  Anything out of the ordinary.


What Is This Person Doing Here?

Then ask yourself about these anomalies: ‘What is this person actually doing here?’

Use these simple guidelines to help you make sense of their behaviour:

Humans are creatures of habit – 93% of what we do is based on habit. Deviating from habits takes mental energy, which is why we do it as little as possible.

Humans are lazy. They will follow the path of least resistance and create natural lines of drift. If you see somebody who takes the hard way from point A to B, it’s strange.

Humans will run, fight or freeze when presented with extreme stress. This behaviour is common across cultures. Does the person look dominant (fight) or submissive (flight)?

Humans are not good at multitasking. A person reading a newspaper and conducting surveillance at the same time will generally stand out.

Humans are clueless. Just scope out a mall. When you yourself conduct surveillance on a mall, how long would it take somebody to notice you doing so? Long time, right? If at all. So watch out for anybody who is situationally aware. Only good and bad guys check their Six!

Don’t fall into the trap of ‘racial profiling’, the attacker will easily be able to fool you. Observe behavior.


What Am I Seeing?

These six domains capture the most significant aspects of human behavior in simple terms that aid profilers in establishing baselines and identifying anomalies.

First Domain: Kinesics…
is the domain that involves people’s conscious and subconscious body language. This is important
because humans give off signals through their postures, gestures, and expressions that communicate
their current emotions and possibly their future intentions. Being able to pick up on these signals is
critical to proactively identifying threats. See the section titled “kinesics” for an explanation of our
use of the term.

Second Domain: Biometric cues…
is the term we use to describe the uncontrollable and automatic biological responses of the human body to stress. These physiological responses are key to understanding a person’s emotional states and changes.

Third Domain: Proxemics…
is the domain that allows us to understand groups of people by observing interpersonal distance and identify an individual’s relationships and intentions based on how they use the space around them. While proxemics is often discussed within the larger category of nonverbal communication, we separate it from biometrics and kinesics because proxemics allows us to understand an individual’s behavior as it relates to the surrounding people. Proxemics also permits us to understand group dynamics.

Fourth Domain: Geographics…
is the domain that involves reading the relationship between people and their environment. This helps us to understand and identify who is familiar or unfamiliar with the area they are in and how people move around their surroundings. Because human behavior is predictable, profilers can anticipate where people will go and what they will do in certain areas.

Fifth Domain: Iconography…
is the domain that allows us to understand the symbols people use to communicate their beliefs and affiliations. Gangs, insurgents, terrorist groups, and individuals use iconography as a symbol of group unity, for rapid recognition of other members, and to communicate their beliefs to the larger populace. Observing these symbols, particularly the increased presence or even sudden absence of them, can be key to your situational awareness.

Sixth Domain: Atmospherics…
is the domain focused on the collective attitudes, moods, and behaviors in a given situation or a place. Profilers can read the social or emotional atmosphere of an environment and pick up on the changes or shifts in that atmosphere that often signal that something significant has changed or that something is about to occur. Understanding the collective atmosphere can key profilers into those individuals whose attitude, emotions, and behavior do not fit the given situation—these individuals are anomalies.

Valuable, ‘Easy To Use’ Criteria

There are the very helpful criteria to determine a possible bad guy, as used by US airport security staff :

– Avoids eye contact with security personnel

– Excessive fidgeting, clock watching, head-turning, shuffling feet, leg shaking

– Excessive perspiration inconsistent with the environment

– Face pale from recent shaving of beard

– Facial flushing while asked their intentions

– Faster eye blink rate when individual is confronted

– Increased breathing rate, panting

– Obvious “Adam’s Apple” jump when requested to submit to screening procedures

– Protruding or beating neck arteries

– Repetitive touching of face

– Rubbing or wringing of hands

– Strong body odour

– Sweaty palms

– Trembling

– Whistling as the individual approaches the screening process

The 15 fear factors are:

– Bag appears to be heavier than expected or does not suit the individual’s appearance

– Bulges in clothing

– Cold penetrating stare

– Constantly looking at other travellers or associates

– Exaggerated emotions or inappropriate behaviour such as crying, excessive laughter or chatter

– Exaggerated, repetitive grooming gestures

– Hesitation/indecision on entering checkpoint

– Individuals who are seemingly unrelated but display identical dress or luggage

– Powerful grip of a bag or hand inside the bag

– Rigid posture, minimal body movements with arms close to side

– Scans area, appearing to look for security personnel

– Shows unusual interest in security officers and their work routine

– Displays arrogance and verbally expresses contempt for the screening process

– Wearing improper attire for location

– Widely open staring eyes

And the six deceptions factors are:

– Appears to be confused or disoriented

– Appears to be in disguise

– Asks security-related questions

– Does not respond to authoritative commands

– Maintains covert ties with others

– Repeatedly pats upper body with hands

Keep an eye out for strangers who seem nervous and out of place. In an ordinary situation, someone who is sweating, looking around anxiously, or otherwise acting panicked may have violent intent. Be especially suspicious of anyone who seems out of place, is wearing a uniform that does not match or otherwise isn’t quite right, or who doesn’t seem to know anyone in a social space.

Recognize impersonators. Aside from people who seem out of place, look out for people soliciting donations for charities you don’t recognize, workers in incomplete uniforms or uniforms that don’t fit, or anyone presenting false or incomplete documents. Report it if someone tries to access a building, perhaps where you work, if they cannot prove they are authorized to enter.

Recognize the attire and posture of a suicide bomber. An imminent suicide bomber might exhibit signs the US government refers to as ALERT.

  • A – Alone and nervous. Report someone who is alone and seems nervous, sweating, eyes darting around, muttering.
  • L – Loose and bulky clothing not compatible with weather conditions. If you see someone strangely overdressed, or who looks like they have something hidden under their clothes, report them.
  • E – Exposed wires. Wires sticking out of clothing could indicate a bomb.
  • R – Rigid mid-section. Wearing an explosives belt or harness makes some terrorists sit very upright. If you see someone with unnatural posture who exhibits other signs of ALERT, alert the authorities.
  • T – Tightened hands. Someone with tightened hands may be holding a detonation device in place. Report someone in this posture immediately.
Notice people who feel personally damaged by unrelated political developments. If you hear a friend, family member, or acquaintance complain that they have been personally wronged by political events that are remote, listen carefully. 80 percent of future lone wolves are known to take politics personally, and claim that they have been wronged enough that violence would be justified.

Recognize when a lone wolf is broadcasting their intent. Report any messages on social media, any personal messages, and anything that is said to you that suggests an individual is contemplating violence. This can include suicide threats as well as threats against others. Watch out for anyone espousing the belief that violence is rational or necessary. It is extremely common for a lone wolf to make public announcements when an attack is imminent. Combinations of political and personal complaints that are followed by veiled threats should be reported immediately. Listen for people who claim affinity with extremist groups. Many lone wolves speak admiringly of white supremacist groups, anti-abortion groups, or foreign terrorist groups.

When To Act And What To Do?

The above indicators should, of course, be looked at in context. If a guy has just finished a boxing match, he is probably sweaty, have an increased breathing rate, might have a cold stare and shaking hands. That does not make him a terrorist. Use common sense.
Know that you will never have ‘all the information’ or ‘all the time to get the information’ in order to make a decision. You are looking for the minimal important information and have to discard the rest. When you have that information…… need to act.
When you detect 3 or more anomalies, you need no more information. It’s time for action. You should alert the authorities. Don’t rationalize the threat away. Take action.
Is the threat imminent and there is no time to alert the authorities?
The US Marines use these 3 steps:
2. Capture
3. Contact
Obviously you will start at 3 if possible, but ‘Be ready to kill’ has been put first to make sure they can switch quickly.
But these are the guidelines for Marines. They are trained. Know that you might risk your life in taking these steps. But you might save many others. Use extreme caution.

Be Aware, Establish Baseline, Look For Anomalies, Take Action Before It’s Too Late.

Subscribe to Arminius on Youtube.

There is also a FB community. 

More into Instagram nowadays? No problem!

Written by Robin C, Former Dutch SF officer, Operator, 12 years into adapting to civilian life ?

Thanks for reading, leave a comment, and don’t forget to sign up, hit that button on the right side!


*Thank you for reading, subscribe and stay up to date! This article is shared with the consent of the original author. It was originally published on by Mark van Riele. IG  and FB

*The views and opinions expressed on this website are solely those of the original authors and contributors. These views and opinions do not necessarily represent those of Spotter Up Magazine, the administrative staff, and/or any/all contributors to this site.



By Mark van Riele

Mark served in the Dutch Army Special Forces unit “Korps Commando Troepen”, And he served in different units ranging from Diplomatic close protection to contractor work. He has his own blog called @arminius_tribe on Instagram

3 thoughts on “How To Spot A Terrorist by Arminius Tribe”
  1. Also for consideration: check to see if the suspected terrorist got funding or training from any intelligence agency cut-outs. Look for his handlers to be nearby monitoring him. Be especially alert if there is a “counter-terror” drill going on that day; it just might “go live” while you’re watching. Be especially alert if there is political crisis looming for which this terror act would be the perfect excuse to do what the government wants to do anyway, but needs a pretext in order to do it. Stay safe!

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.