Identifying Suspicious Behavior: Essential Pre-Attack Indicator Training for Executive Protection Agents

An article by Bob Duggan, Founder & President, Executive Security International

Senior executive protection professionals will all agree that the number one goal when performing protective details is to prevent a threatening or embarrassing situation before it becomes a reality for your client. Now, we all know that the majority of EP schools are highly invested in the ‘’cool guy skills’’. They spend hundreds of hours training in martial arts, firearms, evasive driving, etc. While those skills are important for anyone involved in the executive protection industry, we should not forget that equally important are the skills that will provide these agents with the necessary knowledge and tools of how to prevent a threatening situation.

Identifying suspicious person in a crowd

After more than 6 decades in this profession and having taught thousands of students, I can never highlight enough how important it is to have the ability to identify suspicious behaviors and clues to dangerousness. It is safer for both the client and the security team if the agents have a more proactive mindset rather than a reactive one. We all know by experience,  and from the hundreds of case studies, that no matter how skilled you are in martial arts or how great of a sharpshooter you are, when the moment comes and you have to respond to an attack, it doesn’t matter how many bad guys you can fight or shoot, or how fast or skillful you can drive. Because at that moment, the result of the fight will be determined by many factors other than your skills in fighting or shooting. How an attack toward your client will end depends on numerous variables such as the method of attack, the number of attackers, how well equipped they are, what kind of weaponry they are using, the attack area or “The X”, and most importantly, each one of the EP team member’s mental preparations to respond. Remember, the bad guys have done their homework, and they know your weak spots, and how and when to attack. So, they do have the upper hand in the surprise. Always keep in mind…They only have to get it right once…You have to get it right all the time.

And let’s not forget that while you are fighting or shooting publicly in the open, your client is quite exposed, could be seriously harmed, and will undoubtedly be scared emotionally for life! The fact that you could not foresee and/or plan to prevent a situation that put them at such risk is considered a failure. So, wouldn’t it be safer for everyone, and your job, to be able to prevent a threat instead of merely reacting to it? Again, the senior executive protection professionals will say over and over that the best protective details are not those based on force, numbers, or use of firearms, but those based on foreseeing an upcoming threat or embarrassing situation and preventing it. In the highly demanding and fast-changing world of protective details, the difference between a secure environment and a potentially dangerous situation is purely based on the agents’ ability to preemptively recognize and respond to suspicious behavior.

For more than 4 decades, at Executive Security International (ESI) we have been teaching thousands of students behavioral intelligence and how to identify clues to dangerousness. In simple words, we have been educating them on how to understand an attacker’s behavior, what are pre-attack indicators, and how to identify clues to dangerousness and suspicious behaviors.

Pre-Attack Indicators – Clues to Dangerousness

Pre-attack indicators are specific behaviors or actions that precede an attack, or illegal/bad act, and can serve as a warning to the observant protection agent that something wrong is going to take place. These indicators can vary widely but often include unusual patterns of body movements, facial expressions, gaze, overt interest in security measures, or attempts to breach the personal boundaries of the protectee. In the milliseconds prior to an attack, human predators quite often assume the physical features of apex predator animals as they close in on their prey/target. Being able to identify and understand these indicators requires the proper training on behavioral clues and a psychological insight into the mindset of potential attackers.

“Reading suspicious behavior”

One may ask, “Is it possible and easy to read others? Especially when it comes down to suspicious behavior?” Based on scientific evidence and real-life incidents, we can testify that it is possible and if trained properly, it is easy to do so. As with all skills, being able to read others and the environment around you requires constant training and good observation skills. After all, we can’t process the information we don’t see, correct?

Humans are emotional creatures, and what they feel (anger, fear, stress, happiness, embarrassment, etc.) can be seen through their body language or facial expressions. We can all tell why a child who is confronted by his parents is hiding his hands behind his body, or why some people are pacing back and forth in a hospital waiting room. In the same way, you can learn to identify suspicious behaviors and stop an attack before it takes place by simply observing peoples’ behavior, like someone who is going to commit an attack, either a suicide bomber or an attacker. They will display either stress, fear that they may be caught and fail their mission, or be under the influence of drugs. Being taught how these emotions are expressed through body movements and facial expressions can help you identify clues to dangerousness.

After the Manchester Arena terrorist attack that shook British society and the whole world, one of the event security guards, Kyle Lawler, said that the terrorist was reported by a member of the public who, he himself thought the person looked ‘’dodgy’’, and one of Showcase’s stewards also had a look at the terrorist minutes before he detonated his bomb. As Lawler continued with his testimony to the police, and according to The Guardian article, we read that:

“As Ali (Showcase steward) turned to have a look he’s (the terrorist) clocked that we are looking at him. He’s become fidgety with his hands. No sudden movements. He was watching us, watching him.“He would kind of look, slightly look away and look back at us.”In his statement to police, Lawler said: “I just had a bad feeling about him but did not have anything to justify that.”He said Abedi was “fidgety and sweating” and he said he panicked slightly and was “conflicted” because he thought something was wrong but could not put his finger on it, the inquiry heard.”

What we see in this horrific incident is that at least three people were aware of a suspicious presence/behavior. A member of the public who saw “something wrong” reported it to a security guard and an event steward. According to the description, we see a very usual behavior by someone who is going to do something bad. “He’s become fidgety with his hands” because he was stressed, “He would kind of look, slightly look away and then look back at us” because he wanted to make sure he wasn’t caught or somebody had spotted him, and he was “fidgety and sweating”, because he was showing signs of stress.

Looking at the last statement made by the security guard, he found a specific behavior wrong, and he felt conflicted because he didn’t know how to interpret it. Here again we see the importance of training Executive Protection professionals (and anyone related to the security industry) behavioral intelligence and clues to dangerousness. The sad part of this situation is that three people, without training, spotted something they knew was wrong and if they had been trained properly, they would have known why something looks wrong and how to deal with it. Perhaps, in this particular case, the outcome would have been significantly different with quite a lower number of casualties.

Another incident, definitely worth mentioning and studying is that of the on-camera assassination of Russian ambassador to Tukey, Andrey Karlov, who was shot dead at an Ankara gallery by a Turkish policeman who wanted to protest Russia’s involvement in the Syrian war. By watching the video, one can see the clear pre-attack indicators of the assassin, minutes before he starts shooting. For those of you who have seen the video, we invite you to watch it again and this time pay attention to the following findings:

  • His pacing in the background shows signs of stress.
  • When he stands still his feet are planted wider than his shoulder’s width which shows a person who is ready to get physically engaged.
  • He has interlocked his fingers with his thumbs touching each other which shows an elevated level of stress.
  • He touches his jacket frequently, which is a sign of soothing movement.
  • He is also seen to be checking his firearm. And at one point, beginning to go for the firearm, he regrets it and seconds later he touches his face, which is another sign of stress. Blood is gathering around the mouth and nose area.
  • His face shows contempt, which is very frequent with terrorists.

A significant point to also consider is that he was an off-duty officer, showing up at an event he had no business attending, and being in close contact, was somehow allowed to place himself behind the victim in a live event. This in combination with the rest of the signs should have been a big red flag for what was about to unfold.

politician greeting crowd

The majority of the assassinations, terrorist attacks, and other physical attacks, could have been prevented if security personnel were trained in how to identify clues to dangerousness. Effective protective operations are those where the agents anticipate potential scenarios and prepare accordingly, rather than merely reacting to events as they unfold. The role of an executive protection agent is more about preventing incidents than it is about responding to them.

We started implementing our studies and experience, on behavioral intelligence and body language, into our Executive Security International’s executive protection courses since the mid 80’s. From the early days of my career, I have been fascinated by, and at the forefront of exploring how, someone’s body language and movements within a crowd can serve as crucial indicators of intent, in particular, nefarious intent to harm our clients. After years of protecting celebrities and high-net-worth families, both abroad and in the U.S., my observations led me to investigate and study further about body language and microexpression clues and how, by observing them, one can identify suspicious behavior.

In 1985, I came across the groundbreaking work and research of Dr. Paul Ekman, whose studies on facial expressions and emotions deepened my understanding of deception detection. Although Ekman’s research wasn’t directly linked to aggression, it convinced me that trained observers/executive protection agents could spot the pre-indicators of assault and guide these agents toward strategies of preemptive intervention and therefore, prevention.

It’s important to highlight here that much of today what training institutions teach security personnel about situational awareness (SA) seems to be superficial. Five years ago, we realized that in practice, SA terminology often means the agent is merely waiting for something to happen. Still, many use ‘Situational Awareness’ as a reactive intervention strategy, which leads to late reactions, resulting in client harm or embarrassment. It is crucial for anyone interested in learning more about this field to understand that, while observing behavioral cues is critical, the key is to preemptively engage by confronting the Person of Interest (POI) through soft entry or hard contact. Preemptive Intervention now means engaging the POI, communicating with team members, and seeking a resolution before any actual contact with the client. Going back to our reference on the Manchester Arena terrorist attack, if the security guard was trained in how to engage with a suspicious person for that “first interview”, most likely he would have gotten a good idea that there was something wrong that needed to be reported and investigated further BEFORE that person/visitor could proceed further into the event facility. We will analyze this method in a topic that we will develop in depth in our next article.

Today, when we talk and teach about Behavioral Intelligence, Clues to Dangerousness and Predator Hunting/Preemptive Intervention in our ESI classes, we teach with knowledge that is backed up with both real-life experience and thorough research since the early 80’s. We are very passionate about this topic because we genuinely believe in its highly proactive approach. The skill to read behavioral clues has been tested and it has been proven that it works, and the ability to “read others and the environment around you” remains the cornerstone of effective security and protective measures.

Bob Duggan

Founder & President

For those interested in learning more about behavioral intelligence and clues to dangerousness, please visit www.esibodyguardschool.com 

Russian Oligarchs Keep Getting In Troubles by Instagram Selfies

In our latest interview with expert Nick Barreiro, Chief Forensic Analyst of Principle Forensics, we discussed the security risks from any/all social media platform postings and how someone can obtain critical information from your pictures. If you haven’t watched the interview yet, please find it below

According to Vice’s latest article, authorities have been following Instagram profiles of the women related to, or involved with, Russian oligarchs to obtain information about them, their holdings, accounts, and locate assets to seize/freeze by merely identifying and following the weakest link who posts the most. These women who act like ”influencers” or social media celebrities are looking for publicity, but they now represent a significant threat to the security of the individuals they’re around and expose them to unwanted scrutiny. ”Oligarchs themselves rarely use Instagram to accidentally crack open a window into their high living. Rather, it’s the people partying with them: A stepdaughter, an ex-wife, or in the least one infamous case, an escort.” Read the full article here.

Social Media Investigations and Monitoring for Risk Mitigation Purposes

The use of social media and the way it affects our lives and businesses have brought a new challenge to the security industry and the protective team’s responsibility. It gives the entire world the ability to look into people’s lives with the mere push of a button. Scandals are created, secrets exposed, and lives ruined. In the case of personal security, social media can be used in the advancement of a protective detail; however, one must know how to utilize it properly. Today, we will talk about Social Media Investigations and Monitoring. For those who are not aware of the term, as we utilize it in protection circles, Social Media Investigation and Monitoring is the process by which you can identify what is being said about your clients, a brand they represent, or the corporations with which they are involved and any threats or dangers that may exist in relation to those aspects.

As we sift through different social media platforms and online channels, we must then determine if what is being said has any significance regarding your clients’ reputation, persona, and safety and if there is the need to mitigate any risks. In other words, it’s like setting up an online, social media “net”. This process then helps you discover everything that is being said, written about, or portrayed on social media and determine its relevance to your clients. You can gather information about the ‘’public opinion’’ surrounding your clients, about people or entities who are angry with them for one reason or the other, people who are obsessed with them, or people who are making online threats. SOCMINT or Social Media Intelligence (not to be confused with OSINT) has seen a huge rise in necessity due to the use of social media and a competent protective detail needs to always be informed and social media investigations and monitoring are a huge part of this process. 

Now, let’s see some examples of how social media investigations and monitoring applies in protective services. Let’s say one of the people you are protecting belongs to a large pharmaceutical company and they decided to raise the price of a specific drug, thus affecting the lives and wellbeing of thousands of people. Perhaps another client is involved in a financial institution that quite suddenly makes a significant decision that affects people’s lifetime savings and pensions. You can imagine that there will be a significant number of people who become very angry, and some may want to harm your client. During the recent pandemic, there were a number of “anti-vaxx” groups that were quite vocal and utilized Facebook as one of their many platforms to accomplish their goals. Another example would be the need to discover if there is someone using your client’s name or company to scam others and commit crimes.

We are sure that many of you today are aware of the infamous ‘’Tinder Swindler’’, Shimon Yehuda Hayut, who legally changed his name to Simon Leviev to pretend to be the son of the billionaire Lev Leviev and used his name and company logos to scam people. Although his actions were known since 2017, it was only after the airing of the Netflix documentary in 2022 that the Leviev family found out and filed a lawsuit against Hayut for falsely portraying himself as the son of Lev Leviev, receiving benefits, and committing crimes.

According to Leviev’s family attorney, Guy Ophir, they will now include anyone who has attempted to make a profit from his scam during the next lawsuit. What we can ask is, as security providers, why didn’t someone from the real Leviev family ever discover this scam artist who was extremely public and active on social media as the ‘’son of Lev Leviev’’? Although the real family members were never part of this fraudulent scheme, and it didn’t appear to affect their safety, it did, however, involve their name/brand in a very public and negative way. In other words, it should have definitely been considered as a threat to their reputation. Other people who were harmed by this scam artist were the businesses who did work with them, and their secondary service providers as well. 

Another interesting case to mention is Elon Musk where he, the actual client, took it upon himself to “solve” the issue and directly contacted the person of interest who had begun posting his private flight details and created the security risk for him and was literally blackmailing him unless the POI was paid. According to media reports “Elon Musk states social-media accounts that track his travel movements are ‘becoming a security issue.” Tail numbers and yacht names of billionaires are increasingly being shared on online platforms and one can track them by having the appropriate app unless significant efforts are made to secure them from the reach of those diligent few. These are some unique specific details that the security team needs to pay close attention to at all times.

Photo by Asad Photo Maldives on Pexels.com

Since Social Media platforms are the way people today communicate with each other, we as security providers must keep in mind that this is not always a positive aspect. Perhaps a person or persons will utilize social media to collectively gather people with their same goal or mission, to get together and plan their next move (Example: protesting outside your client’s house or corporation). In this case, you will want to know what is being said online about the person you protect to determine if there is something of extreme necessity to include in your risk and threat assessment and then take protective measures as well as inform their legal department.

As we have all witnessed too many times, it only takes one well-placed picture or story regarding some alleged activity on the part of your client, and it will go viral quickly, truth or not. Staying one step ahead of this type of “attack” has become a crucial necessity in order to protect your client from embarrassment or exposure. One of the most common issues in recent history is when personnel close to the client i.e., family, staff, vendors, and any other secondary customers post pictures, stories, or opinions and subsequently fail to understand the negative effect these types of communications can and will have on the client’s life, business, and the lives of their loved ones.

Why do you need a Social Media Investigations and Monitoring Strategy when you are a security services provider? To summarize we can say:  

1) To identify new threats. 

2) To discover what information about your client is posted online either by himself, the ones close to him, or his employees and evaluate how these affect his safety. 

3) To evaluate a threat (someone is posting online threats directed at your client).

4) To add to your due diligence.

5) To geolocate a picture or a video, sometimes even audio. 

6) To include any findings in your Risk and Threat Assessment (We can never highlight this enough, social media surveys and investigations are now a critical part of your Risk and Threat Assessments).

7) To find people obsessed with or following your clients (stalkers).

8) To identify hate groups or terrorist organizations that may affect your client.

9) To identify people or businesses your client may or may not want to do business with.

10)To mitigate risks from the information found online about the person you protect (How are the pictures of my client used or tampered with and for what purpose?).

11)To identify if someone is impersonating your client or a family member.

12)To find out if your client’s moves/visits/travels are posted online (Exposing them to others who may be in the same hotel, conference room, restaurant). 

13)To identify workplace violence or insider threat indicators.

14)To find out what is the ‘’public opinion’’ regarding your client (Always keep an eye on what is being said about your client and have a strategy to respond). 

15)To determine if a person or persons are utilizing your client’s name or business name in a malicious or unauthorized manner for their own personal gain. (Claiming associations or partnerships, etc.)

How to perform Social Media Monitoring for security purposes? 

First, let’s clarify one important thing. ‘’Googling it’’ is not enough, nor is it the answer. There are a number of search sites that allow for user input thus watering down or contaminating information and it’s accuracy. For those who are not aware, Social Media Investigations and Monitoring is quite a different department of protective services and quite often falls under Intelligence Analysis and Open-Source Intelligence. It requires unique skills and knowledge. One must clearly understand different social media and research platforms and how to use each one of them (and/or in combination) to obtain information. How you will approach each case is different and certainly depends on who your client is, their business, close relations, and/or their public image. This will directly affect the searches and the resources used and for what purpose. It is vital in our current day and age to include SOCMINT (Social Media Intelligence) in your client’s service proposal, no matter how public the person may or may not be. Hiring ten Executive Protection agents and a Residential Security Team is not enough anymore. SOCMINT services are a vital part of your Risk and Threat Assessments (Dynamic Risk Assessments too) and enable your protective detail to function more efficiently. 

For those who can not provide a certified Social Media Investigator for their clients, follow up with these steps:

1)Understand who your client is, his/her background, the threats, where do they stand in political, social, financial sectors.

2)Be aware of any of the latest changes in your clients’ lifestyle, public opinions, and professional decisions. 

3)Be aware of any of their political and social changes. Watch the news from multiple channels. 

4)Familiarize yourself with all close family, friends, staff, and associates and their respective social media footprints.

5)Set up a social media investigation and monitoring strategy. 

6)Have a good understanding of the Intelligence Cycle (How the intel is being collected, analyzed, disseminated, reviewed, etc.).

7)Have a good understanding of the search tools on different platforms (Facebook, Twitter, Instagram, TikTok, LinkedIn, Tumblr, Reddit, etc.) 

8)Do research on the available search engines and the strengths and limitations each one may have. 

9)Know how to conduct image, video, and audio research and gather intelligence from them.

10)Invest in appropriate platforms for social media investigations and monitoring (Have in mind, NEVER rely on one platform’s result or just platforms’ results. The user/investigator is the main component of a social media investigation). 

11)Download and use appropriate search engine extensions and apps. 

12)Invest time in creating ‘’sock puppets’’ or fake profiles and maintain their persona. Sometimes you may need a profile to have access to different forums or groups without being discovered.

13)Train yourself in link analysis (How to look for connections between people, events, and organizations).

14)Set keyword alerts (In multiple languages in case your client has ties with more than one country).

15)Gather, analyze, evaluate, and report your findings to the appropriate department or leadership.  

Photo by Lisa Fotios on Pexels.com

As the threat landscape changes every day, we as protection providers must be able to adapt and keep ourselves up to date with additional training. Today’s executive protection agent must also be skilled and knowledgeable in investigations, open-source intelligence, protective intelligence, HUMINT, and have an increased understanding of cyber security. Large corporations have already created their own embedded intelligence departments, while others are hiring threat analysts and OSINT investigations from outside security providers. The rise of protective intelligence, and whatever that includes, is here to stay and we are seeing it more and more through the highly increased number of related job postings every day. 

If you are an Executive Protection Agent and want to learn more on how to utilize Social Media Investigations and Monitoring for Risk Mitigation Purposes, reach out to us.

f you are a service provider and want to add Social Media Investigations and Monitoring for Risk Mitigation Purposes on your service list, contact us to learn about our vendor services. 

Chris Grow

AUS Global Special Services Travel Team

Managing Partner LeMareschal LLC

Denida Grow

Founder & CEO

Athena Worldwide 

Nannyguards

Managing Partner LeMareschal LLC