Suspicious Activity Reporting SOG PDF

Standard Operating Guideline (SOG) Suspicious Activity Reporting Effective Date: 07/01/2022 Guideline Number 04-42A Revised Date: Number of Pages 01 1....

Standard Operating Guideline (SOG) Suspicious Activity Reporting Effective Date: 07/01/2022 Guideline Number 04-42A Revised Date: Number of Pages 01 1. Overview On occasion, during their normal work assignment, Salt Lake City Fire Department (SLCFD) personnel may find themselves in a situation where Suspicious Activity is observed. This guideline outlines the procedure to utilize when making a Suspicious Activity Report (SAR). 2. Definitions Suspicious Activity: An observed behavior which is reasonably indicative of pre-operational planning related to terrorism or other criminal activity. Defined criminal activity and potential terrorism nexus activity: Breach/Attempted Intrusion: Unauthorized personnel attempting to or actually entering a restricted area or protected site. Could include impersonation of authorized personnel (e.g., policy/security, janitor, etc.) Misrepresentation: Presented false or misusing insignia, documents, and/or identification to misrepresent one’s affiliation to cover possible illicit activity. Theft/Loss/Diversion: Stealing or diverting something associated with a facility/infrastructure (e.g., badges, uniforms, identification, emergency vehicles, technology, or documents [whether classified or unclassified]) which are proprietary to the facility. Sabotage/Tampering/Vandalism: Damaging, manipulating, or defacing part of a facility/infrastructure or protected site. Cyber Attack: Compromising, attempting to compromise, or disrupt an organization’s information technology structure. Spoken or Written Threat: Communicating a spoken or written threat to damage or compromise a facility/infrastructure. Aviation Activity: Operation of an aircraft in a manner that reasonably may be interpreted as suspicious or posing a threat to people or property. Such operation may or may not be a violation of Federal Aviation Regulations. Potential Criminal or Non-Criminal Activity Requiring Additional Fact Information During Investigation: Eliciting Information: Questioning individuals, at a level beyond mere curiosity, about particular facets related to the purpose of a facility or building, operations, security procedures, etc., which would arouse suspicion in a reasonable person. Testing or Probing of Security: Deliberate interactions with, or challenges to, installations, personnel, or systems which reveal physical, personnel, or cybersecurity capabilities. Photography: Taking pictures or video of facilities, building, or infrastructure in a manger which would arouse suspicion in a reasonable person. Examples include taking pictures or video of: infrequently used access points, personnel performing security functions (patrols, badge/vehicle checking), security-related equipment (perimeter fencing, security cameras), etc. Observation/Surveillance: Demonstrating unusual interest in facilities, buildings, or infrastructure, beyond mere casual or profession (e.g., engineers) interest, such that a 04-42A Suspicious Activity Reporting SOG, Page 1 of 3  reasonable person would consider the activity suspicious. Examples include: observation through binoculars, taking notes, attempting to measure distances, etc. Materials Acquisition / Storage: Acquisition and/or storage of unusual quantities of materials, such as cell phones, pagers, fuel, chemicals, toxic materials, and timers, such that a reasonable person would suspect possible criminal/terrorist activity. Acquisition of Expertise: Attempts to obtain or conduct training in security concepts, military weapons or tactics, or other unusual capabilities which would arouse suspicion in a reasonable person. Weapons Discovery: Discovery of unusual amounts of weapons or explosive which would arouse suspicion in a reasonable person. Sector-Specific Incident(s): Actions associated with a characteristic of unique concern to specific sectors (such as the public health sector), with regard to their personnel, facilities, systems, and/or functions. Note: these activities are generally First Amendment-protected activities and should not be reported in a SAR or ISE-SAR absent articulable facts and circumstances that support the source agency’s suspicion that the behavior observed is not innocent but rather reasonably indicative of criminal activity associated with terrorism, including evidence of pre-operational planning related to terrorism. Race, ethnicity, national origin, or religious affiliation shall not be considered as factors which arouse suspicion (although these factors may be used as specific suspect descriptors). 3. Procedure Reporting Suspicious Activity shall not impede or affect the completion of the Salt Lake City Fire Department’s primary response or activities. All Suspicious Activity shall be reported to the TrapWire repository as soon as reasonably possible, using one of the avenues listed below. Primary Reporting 1. Primary reporting efforts should be made using a SAR shortcut on the apparatus table, through Firehome, or by visiting the website https://iwatchsaltlake.org. 2. Immediately contact local law enforcement agencies if the observed behavior or material presents an immediate threat to life safety or property. Secondary Reporting 1. Email the SAR form directly to the Utah Statewide Information and Analysis Center (SIAC) at [email protected]. 2. Follow appropriate chain of command for internal notification up to and including: the on-duty Battalion Chief, shift Fire Investigators, Emergency Management LEO / Planning Coordinator, or Captain overseeing intel. If the observed behavior or material presents an immediate threat to life safety or property, a reasonable attempt shall be made to safely maintain or secure the scene until the arrival of law enforcement. Examples of this include, but are not limited to: the storage of large amounts of chemicals, Improvised Explosive Devices (IED) in late stage of development (deployment ready), operational chemical labs. Behavior or materials that meet the criteria for SAR, but do not pose an immediate threat, can be reported upon the conclusion of the incident, after returning to the fire station. Be prepared to provide as much detail as possible and to identify into which of the above definitions the reportable behavior can be categorized. 04-42A Suspicious Activity Reporting SOG, Page 2 of 3  All reports shall be immediately vetted and shared with appropriate area law enforcement for follow-up. This includes jurisdictional law enforcement as well as the SIAC and federal partners, if needed. Training All department members will be required to complete SAR training. This includes: Privacy training Threat identification Reporting procedure In-app navigation 04-42A Suspicious Activity Reporting SOG, Page 3 of 3