11.1 Terrorism Awareness, CBRNE & See Something Say Something

Key Takeaways

  • Terrorism is the unlawful use of force or violence to intimidate or coerce a government or civilian population in furtherance of political or social objectives — Class D officers observe and report; they do not investigate terrorism cases.
  • DHS's If You See Something, Say Something® campaign teaches reporting of suspicious behavior and circumstances to local law enforcement — not profiling people based on appearance, religion, or ethnicity.
  • CBRNE hazards are Chemical, Biological, Radiological, Nuclear, and Explosive; recognition cues and immediate life-safety response (distance, upwind, notify) matter more than identifying the exact agent.
  • Awareness-level OPSEC, physical security, access control, and bomb/mail screening reduce soft-target vulnerability by denying adversaries information and uncontrolled entry.
  • Pre-attack indicators often include surveillance, elicitation, testing of security, acquiring unusual materials, and rehearsals — patterns of behavior, not single innocent acts, drive reporting.
Last updated: July 2026

11.1 Terrorism Awareness, CBRNE & See Something Say Something

Quick answer: Terrorism is the unlawful use of force or violence to intimidate or coerce a government or civilian population for political or social goals. A Class D officer's role is observe, protect life, deny easy access, and report — not to investigate or confront a suspected terrorist alone. DHS's If You See Something, Say Something® campaign, CBRNE awareness, and basic OPSEC/access-control habits are the tools that make that role effective on a Florida post.

Definition and brief history

Modern terrorism training treats terrorism as intentional violence or threats of violence aimed at creating fear and forcing political, ideological, or social change. Attacks may be carried out by formal organizations, loosely networked cells, or lone actors inspired by an ideology. United States history includes both domestic and international examples — from the 1995 Oklahoma City bombing and various ideologically motivated plots to the September 11, 2001 attacks that reshaped homeland security. For licensing purposes, the exam focus is not memorizing every historical event; it is understanding that terrorists choose soft targets (places with many people and relatively light security), seek publicity and disruption, and often conduct pre-operational surveillance before striking. Private security officers are frequently the first people in a position to notice that surveillance and report it.

Types of organizations and attacks

Terrorist threats are commonly grouped by who is involved and how they attack:

CategoryWhat it means for a post officer
International / transnationalGroups or networks with foreign ties; may target symbolic U.S. sites, transport hubs, or crowded venues
DomesticActors based in the United States motivated by extremist ideologies; may target government buildings, houses of worship, schools, or opposing groups
Lone actorIndividual who plans with little or no group structure; harder to detect through traditional intelligence, more likely noticed through odd on-site behavior
Attack methodsActive shooter, vehicle ramming, IED/VBIED, edged weapon, arson, cyber-enabled disruption of critical systems, or CBRNE release

Attack types matter because response differs: an IED callout is not handled the same way as a medical emergency, and a chemical odor with multiple people collapsing is not treated like a simple HVAC complaint. Officers learn the categories so they can describe what they see accurately to dispatch and supervisors.

If You See Something, Say Something®

The U.S. Department of Homeland Security (DHS) national campaign If You See Something, Say Something® raises public and private-sector awareness of indicators of terrorism and terrorism-related crime, and how to report them. Core teaching points for Class D officers:

  • Report suspicious activity — unusual behavior or circumstances that do not fit the context of the location — to local law enforcement or the appropriate tip line designated by the employer or jurisdiction.
  • Do not report to DHS as a substitute for calling local police; the campaign directs tips to local authorities who can respond and, when warranted, share through Suspicious Activity Reporting (SAR) channels.
  • Focus on behavior and context, never on race, religion, national origin, or appearance alone. Profiling is both ineffective and discriminatory; a person taking photos of a landmark is not automatically suspicious, but the same person photographing camera placements, badge readers, and shift-change patterns for hours may be.
  • Protect privacy, civil rights, and civil liberties when documenting: stick to facts (who, what, when, where, how) without speculation about motive or ideology.

On a Florida Class D post, "saying something" usually means notifying a supervisor per post orders and ensuring law enforcement is contacted when the activity reasonably suggests a crime or terrorism nexus. Document the observation factually in an incident report.

Dynamics and pre-attack indicators

Terrorist operations often follow a cycle: target selection, planning, surveillance, rehearsal or dry runs, and attack. Officers are most likely to interrupt that cycle during surveillance and testing of security. Common indicators taught at awareness level include:

  1. Surveillance — prolonged observation, photography/video of security measures, note-taking about staffing and cameras.
  2. Elicitation — probing questions about shift times, alarm response, VIP schedules, or how to bypass screening.
  3. Testing security — intentionally triggering alarms, attempting unauthorized entry, or abandoning bags to watch the response.
  4. Acquiring supplies — unusual bulk purchases of chemicals, fertilizers, timers, or weapons-related materials (usually noticed by retailers, but relevant if found on site).
  5. Dry runs — rehearsing approach routes, parking, or exit paths without completing an attack.
  6. Deploying assets — staging vehicles, packages, or people in unusual places just before an event.

A single indicator in isolation may be innocent. A pattern of indicators, especially when combined with attempts to avoid detection, is what justifies a report.

CBRNE: recognition and awareness-level response

CBRNE stands for Chemical, Biological, Radiological, Nuclear, and Explosive. Class D training is awareness-level: recognize possible indicators, protect yourself and others, deny entry to the hazard area, and notify specialists — do not sample, smell deliberately, or "investigate" a suspected agent.

HazardPossible cluesImmediate officer actions
ChemicalUnusual odors, mist/vapor, sudden multiple people with tearing, coughing, or collapse in one areaMove people upwind/uphill, isolate area, call 911, avoid contact with liquids
BiologicalDelayed illness clusters, unusual powders or containers, threats claiming contaminationDo not disturb materials; isolate; wash exposed skin with soap/water if directed by responders; notify authorities
RadiologicalUnexplained devices with radiation symbols, stolen gauges/sources (often no smell/visible cue)Maximize distance and shielding; limit time near source; keep others away; notify hazmat/LE
NuclearExtremely rare; catastrophic blast and radiation effectsFollow official evacuation/shelter guidance; officer role is life safety and scene control until relieved
ExplosiveSuspicious packages, wires, timers, unusual vehicle weight or odor of fuel/explosivesDo not touch; evacuate to safe distance; no radio/cell use near device if trained that way; await bomb technicians

The practical rule: life safety first, distance second, notification third. Officers support fire, hazmat, and law enforcement; they do not neutralize CBRNE threats themselves.

OPSEC, physical security, access control, and screening (awareness)

Operational security (OPSEC) means denying adversaries useful information: do not discuss VIP movements, alarm codes, camera blind spots, or response times with unauthorized people; shred sensitive documents; challenge social-engineering attempts. Physical security and access control reduce soft-target appeal — locked doors that should be locked, visitor badging, anti-tailgating, lighting, and reporting propped doors or disabled cameras. Bomb and mail screening at awareness level means recognizing suspicious packages or mail (no return address, excessive postage, oily stains, protruding wires, odd odors, misspelled addressee, restrictive markings like "Personal — Only") and following the post's isolation/notification procedure rather than opening or moving the item. Together, these habits turn a Class D officer from a passive observer into an active layer of terrorism prevention on everyday Florida posts.

Test Your Knowledge

According to DHS guidance associated with If You See Something, Say Something®, suspicious activity related to possible terrorism should primarily be reported to:

A
B
C
D
Test Your Knowledge

CBRNE is an acronym for which set of hazard categories?

A
B
C
D
Test Your Knowledge

Which observation is the BEST example of a terrorism-related suspicious activity indicator rather than profiling?

A
B
C
D
Test Your Knowledge

At awareness level, what should a Class D officer do first upon discovering a package with protruding wires and no return address in a mail room?

A
B
C
D