Watching a building or other venue from a nearby location. Using binoculars, using cameras, taking measurements, drawing diagrams, etc. Taking photographs with no aesthetic value. Recording or monitoring the activities of law enforcement.
Attempting to gain information about operations, infrastructure, or people. Asking suspicious questions. How many employees / guests? What types of security? Evacuation plans? Building plans? Ingress and egress routes? Shift changes?
Test of security
Any attempts to measure reaction times to security breaches or to penetrate physical security barriers or procedures in order to test the strengths and weaknesses. This may include abandoning suspicious package, suitcase, backpack, or other item.
Suspicious transactions involving large cash payments, deposits, or withdrawals are common signs of terrorist funding. Collections for donations and the solicitation for money and criminal activity are also warning signs.
Acquiring or attempting to acquire supplies
Can include conventional weapons, such as guns, ammunition, and knives, and/or non-conventional weapons, such as explosives or their precursors, chemical, biological, or radiological material.
Additionally, this may include acquiring hospital / medical uniforms, scrubs, fraudulent identifications, keys and key cards, and other related identification for access to any secured building or area.
This may also include otherwise legal items such as pool chemicals, fuel, and fertilizer by individuals who may have no reasonable need to possess such items.
This could also include stockpiling large amounts of currency or having multiple passports, identifications, or travel documents.
Suspicious persons out of place
People who don't seem to belong in the workplace, neighborhood, or in a particular building or area.
Putting people into positions and moving them around according to their plan without actually committing the crime / terrorist act. This activity also includes mapping out routes and determining the timing of patrols and routines of individuals, services, and traffic lights.
People and supplies are put into position to commit the terrorist act. This is a person's last chance to alert authorities before the terrorist act occurs.