11.1 Homeland Security

Homeland Security

North Carolina peace officers are local crime fighters and the state's first sensors for threats that cross municipal and national boundaries. In Basic Law Enforcement Training (BLET), the Homeland Security block (commonly about 8 hours) builds patrol-level awareness of terrorism indicators, the National Incident Management System (NIMS) and Incident Command System (ICS), information-sharing pathways, critical infrastructure, and soft-target concepts. The goal is not federal analyst expertise. The goal is a reliable observer, communicator, and first-arriving commander who can protect life until specialists arrive.

Why Homeland Security Matters on Patrol

Most terrorism-related events begin as ordinary calls: a suspicious package, unusual photography of a bridge, someone casing a school, a chemical odor at a warehouse, or a clerk's tip. Federal partners and fusion centers depend on local observations that are timely, specific, and documented. North Carolina's Department of Public Safety (NCDPS) Homeland Security enterprise stresses shared preparedness across government and private-sector partners because threats include terrorism, cyberattacks, and impacts to critical infrastructure. An officer who recognizes an indicator, protects a scene, and reports through the correct channel has already contributed to prevention.

Homeland security for BLET students sits at the intersection of criminal law, community policing, and emergency management: enforce statutes, earn tips through trust, and operate inside multi-agency command when an incident escalates.

Terrorism Indicators and Suspicious Activity

Terrorism is generally the unlawful use — or threat — of force or violence against persons or property to intimidate or coerce a government or civilian population in furtherance of political or social objectives. Patrol officers rarely confront a completed attack without first seeing pre-operational conduct. Training emphasizes suspicious activity that may relate to terrorism while distinguishing protected First Amendment expression from planning, surveillance, or rehearsal.

Indicator categories officers are taught to notice include:

• Surveillance: photographing, sketching, or timing security at schools, houses of worship, government buildings, stadiums, transit hubs, or utilities in ways inconsistent with ordinary tourism or journalism.
• Elicitation: unusual questions about staffing, shift changes, cameras, deliveries, or emergency exits.
• Testing security: probing doors, fences, or credential checks to measure response.
• Acquiring supplies: unusual purchases or thefts of precursors, fertilizers, wiring, or other materials inconsistent with a stated purpose — especially with other indicators.
• Dry runs: practicing approach routes or timing without completing an attack.

The doctrinal point is context and corroboration. One courthouse photo is usually not enough. A pattern of surveillance plus elicitation plus a citizen tip may justify a Suspicious Activity Report (SAR) through agency or fusion-center channels. Avoid profiling by religion, ethnicity, or politics alone. Report behaviors and facts, not stereotypes.

When indicators appear: document who, what, when, where, and how; preserve evidence; avoid unnecessary confrontation that compromises a longer investigation unless danger is imminent; and notify your supervisor and designated reporting path (terrorism liaison, fusion center, or FBI JTTF per policy).

NIMS and ICS Awareness

Large homeland-security and all-hazard incidents are managed under NIMS, the national multi-jurisdiction coordination framework. ICS is the on-scene organizational system within NIMS. BLET officers need functional awareness; every first-arriving officer may temporarily establish command.

Core ICS ideas:

• Unity of command — each person reports to one supervisor.
• Span of control — typically about 3–7 subordinates per supervisor.
• Modular organization — expand only as needed, from a single officer to sections for Operations, Planning, Logistics, and Finance/Administration.
• Common terminology and integrated communications for mutual aid.
• An Incident Action Plan, even informal: objectives, strategy, and safety messages.

On arrival at a significant incident: size up hazards and life-safety priorities; request resources; establish a command post and staging away from the hazard; broadcast a brief size-up; and transfer command when a qualified supervisor or designated Incident Commander arrives. Transfer should be face-to-face when possible and cover situation, resources, actions taken, and hazards.

Homeland-security events often become Unified Command with law enforcement, fire, EMS, emergency management, and sometimes federal partners. Your role may be perimeter, evacuation, evidence protection, or traffic control — not running the entire incident.

Information Sharing

Information sharing connects prevention. Pathways may include tip lines, agency intelligence units, regional fusion centers, FBI/JTTF contacts, and the national SAR architecture. Effective sharing is timely, specific (names, plates, photos, exact locations, verbatim statements), protected (privacy, civil liberties, need-to-know; no sensitive intel on unsecured channels), and two-way so street officers also receive relevant bulletins. Know your agency's SAR procedure, including after-hours notification.

Critical Infrastructure and Soft Targets

Critical infrastructure includes systems and assets — physical and virtual — so vital that incapacity or destruction would debilitate security, the economy, public health, or safety. Sectors relevant to North Carolina patrol include energy, water/wastewater, transportation, communications, healthcare, government facilities, chemical sites, and food/agriculture. Many facilities are privately owned; protection is a public-private partnership. Know high-consequence sites on your beat; treat unusual activity near substations, water plants, or rail yards seriously; coordinate with facility security.

Soft targets are open, accessible, lightly hardened places — schools, houses of worship, shopping centers, entertainment venues, and public gatherings. Hard targets (military bases, secured complexes) have layered access control. Soft targets rely on awareness, rapid reporting, and emergency action plans. Build relationships with administrators and private security; encourage reporting of pre-attack surveillance; understand lock-down/evacuate/shelter protocols; and recognize that many active-attacker events occur at soft targets — linking this block to rapid-deployment training.

Street Checklist

Ask: (1) Indicator-rich behavior or protected expression? (2) Imminent threat requiring immediate intervention? (3) Documented and notified per policy? (4) Expanding incident — ICS command established or transferred cleanly? (5) Critical infrastructure or soft-target populations at risk — do fire/EMS/emergency management need early notice?

Homeland security for the North Carolina officer is daily vigilance plus disciplined command and communication. The next sections apply that foundation to active attackers and explosives/HazMat emergencies.