7.2 Suspicious Activity, SALUTE & Information Protection
Key Takeaways
- SALUTE organizes Size, Activity, Location, Unit or identifying description, Time, and Equipment into a concise report.
- Facts must be separated from assumptions, and urgent danger goes directly to 911 rather than waiting for a complete form.
- Pre-incident concerns can include surveillance, probing, testing, elicitation, impersonation, tampering, or acquisition of access tools when context makes them unusual.
- Guards preserve video, access records, original messages, notes, and physical scenes while protecting sensitive site information.
Recognize activity in context
Suspicious activity is conduct reasonably connected to crime, site vulnerability, or preparation—not a type of person. Potential pre-incident behaviors may include unusual surveillance of restricted operations, repeated probing of doors or response times, testing whether tailgating succeeds, eliciting nonpublic security information, impersonating a contractor, tampering with cameras, placing an unexplained device, stealing credentials, or acquiring restricted access tools. Each may also have an innocent explanation, so the guard reports facts and context rather than announcing guilt.
Consider normal operations. A licensed surveyor photographing public infrastructure with authorization differs from a person hiding a camera inside a restricted mechanical space. A vendor asking where to unload differs from someone repeatedly asking when guards leave and which cameras fail. The report should identify the behavior that created concern and any verification attempted.
SALUTE reporting
Delaware's official study material teaches SALUTE as an information framework:
| Element | Report content | Example |
|---|---|---|
| S — Size | Number of people, vehicles, objects | Two people and one white van |
| A — Activity | What they are doing | Testing three locked loading doors and photographing each keypad |
| L — Location | Exact current or last location and direction | North dock, moving east toward Gate 2 |
| U — Unit/identification | Clothing, markings, names, plates, distinctive features | Blue jacket, orange backpack, Delaware plate as observed |
| T — Time | Start, observation, departure, report time | Began 14:12; departed 14:18 |
| E — Equipment | Vehicles, bags, cameras, tools, weapons, devices | Handheld camera and bolt cutters visible in open bag |
“Unit” comes from the mnemonic's operational origins; in civilian security, use it for useful identification rather than guessing membership in an organization. Record exact words and objective movement. Avoid conclusions such as “Middle Eastern,” “crazy,” “terrorist,” or “definitely casing” when the actual fact is an accent, behavior, or repeated route.
Urgency and transmission
SALUTE improves organization but does not delay an emergency call. If there is a weapon, explicit threat, active tampering with a critical system, suspicious package, forced entry, violence, or immediate danger, call 911 with the key location and hazard first. Continue observing from safety and update direction or behavior. For a nonurgent concern, use the agency's supervisor, security operations center, property management, or law-enforcement liaison process.
Use plain language. Repeat plate characters and critical numbers, using an approved phonetic method if trained. State confidence and source: “I personally observed,” “camera 12 shows,” or “a named employee reported.” Correct an error immediately. Do not fill gaps with guesses.
Preserve information and evidence
Protect the original source. Bookmark or export video under policy before normal retention overwrites it; preserve access-event logs and visitor records; keep original emails or messages with metadata; secure handwritten notes; and prevent people from handling a suspicious area or object. Record who received each item. Do not enhance, crop, annotate, or circulate the only copy. Preserve a working copy and original according to policy.
Sensitive information also requires protection. Camera locations, alarm codes, employee schedules, executive movements, emergency plans, investigation details, and access credentials should go only to authorized recipients with a duty-related need. Confirm a caller's identity before disclosing. A person claiming to be police can be referred to the established agency contact or verified through dispatch.
Scenario
At 21:40, a guard sees two people at a closed warehouse. One holds a phone toward each camera while the other pulls three service-door handles. They leave in a dark sedan after noticing the patrol. A weak report says, “Two suspicious people casing the building.” A strong report gives size, actions, exact north-wall location, descriptions, time, vehicle and plate details, direction, camera references, and the fact that no entry was observed. That report permits immediate patrol coordination and later video review without claiming an unproven motive.
Shift handoff
Open observations must survive shift change. Tell the next guard what occurred, who was notified, evidence preserved, instructions received, and what remains pending. Enter the event in the official log without exposing it to unauthorized readers.
The quality test is: Could a person who was not present locate the event, recognize the subject, understand the conduct, assess urgency, and find the preserved evidence? SALUTE makes that result more likely.
When a subject leaves before contact, preserve direction and last-known time rather than merely writing “gone on arrival.” Those small details allow cameras, patrols, or police to continue the information chain and distinguish a current lead from stale information.
In SALUTE, what does the letter L identify?
A guard sees a person forcing a restricted door while displaying a weapon. Should the guard finish every SALUTE field before calling?
Which statement properly separates fact from inference?