7.1 Terrorism Awareness & the National Terrorism Advisory System

Awareness without profiling

Terrorism is violence or threatened violence used to intimidate or coerce for political, ideological, or other objectives. A guard is not expected to identify a person's ideology or make an intelligence assessment. The useful role is to notice behavior, vulnerabilities, and anomalies at the assigned site; protect immediate safety; and send accurate information to supervision and law enforcement.

Identity is not an indicator. Religion, ethnicity, citizenship, language, political expression, disability, dress, photography alone in a lawful public place, or unfamiliarity with a site does not prove hostile intent. Focus on conduct tied to the protected facility: attempts to defeat access controls, repeated probing of restricted entries, concealment of unauthorized devices, explicit threats, surveillance combined with operational questions, tampering, theft of credentials, or acquisition of sensitive details without a legitimate purpose. Context matters, and lawful activity must not be converted into suspicion through stereotype.

Understanding NTAS

The Department of Homeland Security uses the National Terrorism Advisory System (NTAS) to communicate information about threats to the public and relevant sectors. The system issues:

• Bulletins describing trends or developments that may not fit a specific, credible threat;
• Elevated Alerts warning of a credible terrorism threat; and
• Imminent Alerts warning of a credible, specific, and impending threat.

Each communication can include a summary, duration, affected area or sector, potential indicators, and protective actions. The current message and its expiration matter. The older Homeland Security color-code system is not the current public advisory method and should not be used to invent a facility response.

An NTAS communication does not automatically close a building or authorize searches, detention, or force. Site leadership converts official threat information into measures under the emergency and security plan, such as increased patrol frequency, credential review, delivery controls, liaison with law enforcement, or temporary area restrictions. Guards carry out assigned measures consistently.

Protective vigilance

At shift briefing, review current official advisories relevant to the sector and region, recent site incidents, special events, contractors, out-of-service controls, and the escalation path. Inspect critical doors, cameras, barriers, utilities, mail and delivery areas, gathering points, and emergency access. Protect sensitive schedules, camera maps, key lists, response plans, and employee information. Avoid discussing vulnerabilities with unauthorized people or posting operational details online.

Use layered protection rather than relying on one device. A badge can be stolen; verification, anti-passback procedures, visitor sponsorship, camera review, patrol, lighting, and employee reporting provide additional chances to identify misuse. Report failed control systems promptly and use approved compensating measures.

Reporting and response

When behavior creates concern, record observable facts: who, what, when, where, direction, vehicle, object, words, and interaction with the site. Explain why the conduct is unusual in context without claiming motive. If danger is immediate, move people from risk and call 911. For nonemergency suspicious activity, use the site's reporting channel or the law-enforcement contact designated by policy. Preserve related video, access records, notes, and physical areas.

Do not confront solely to test a terrorism theory, conduct an unauthorized search, publish the observation, or tell bystanders that a person is a terrorist. A consensual service question—“May I help you find the public entrance?”—can clarify behavior when safe and permitted, but the person may decline. Enforcement must rest on an actual access rule or lawful basis.

Information discipline

Verify the source and date of alerts. Social-media posts, mass texts, and screenshots can be altered or stale. Route media inquiries to authorized officials and share operational information only with people who need it. At shift turnover, distinguish open facts, actions already taken, and items needing follow-up.

The exam-ready principle is behavior, context, official information, and prompt reporting. Alertness protects both the facility and civil fairness when the guard refuses to turn identity into evidence.

Mail and delivery awareness

Delivery controls deserve special attention because ordinary packages can conceal hazards and ordinary delays can create pressure to bypass verification. Compare sender, recipient, markings, condition, expected shipment, and delivery route through normal handling. Warning signs may include threatening language, protruding components, stains, unusual odor, excessive postage, or an item abandoned in an illogical place. No single feature proves danger. Stop handling, isolate, and use the suspicious-item plan rather than opening an item to resolve doubt.

Exercise and review

Tabletop exercises should test how an alert reaches the post, which measures change, who approves them, and how accessibility and public-service needs continue. After an exercise or real event, correct bad contacts, outdated rosters, uncontrolled information, and failed barriers. Threat readiness is maintained through verified updates and disciplined practice, not permanent maximum restriction.