4.1 Criminal, Terrorist, Insider & Sociopolitical Threats

Criminal, Terrorist, Insider, and Sociopolitical Threats

Physical security assessment cannot jump from an asset list to a camera schedule. Domain 1 Task 3 on the PSP exam asks you to characterize threats—the people and groups that might harm those assets—before you estimate risk. This section stays on adversarial sources: ordinary crime, terrorism and extremism, insiders, and sociopolitical or cultural events that put a crowd at your doors. Natural events, accidents, and cyber-physical failures belong in the next section. Mixing an opportunistic thief with a hurricane in the same sentence is how findings become slogans instead of decisions.

Exam focus: Characterize the adversary with capability, intent, history, and targeting. Likelihood and severity are separate judgments. Do not treat a color-coded federal "threat level" as an exam fact.

Four Questions Before You Score Risk

A useful threat statement is not "crime is a problem" or "terrorism exists." For each asset class, describe the adversary in four dimensions, in writing, before you pick a score.

Capability is what the adversary can actually do: numbers of people, tools, weapons, vehicles, technical skill, money, and access. A smash-and-grab crew with a stolen pickup and bolt cutters is not the same capability as a single employee with a master key, and both differ from a small cell that has trained with rifles. Capability is evidence-based. It comes from incident reports, law-enforcement briefings, loss data from similar sites, and what you can observe about local offending—not from a film plot.

Intent is whether the adversary wants to cause that harm, and why. Intent may be profit (copper, pharmaceuticals, catalytic converters), ideology, grievance, coercion, notoriety, or workplace revenge. A protest group that intends to occupy a lobby has different intent than a burglar who intends to leave unseen with product. Intent can change in the same afternoon: a permitted rally can attract a splinter that intends property damage.

History is what has already happened to this site, this organization, this industry, or this neighborhood. Repeat copper theft on the same transformer pad is history. A bomb threat last year is history. A terminated employee who still texts supervisors after hours is history. History is not destiny, but it is the cheapest evidence you will ever get. A site with no recorded incidents is not "zero threat"; it may be a site that does not report, does not retain logs, or has simply not been tested yet.

Targeting is why this facility, this door, this person, or this shipment would be chosen. Targeting may be opportunistic (the dark loading dock on the way home), selective (the pharmacy cage), or symbolic (the headquarters of a controversial brand). If you cannot explain targeting, you cannot later explain why a countermeasure at this door is more important than one at that door.

Write the four answers in plain language. "Organized catalytic-converter crews with hydraulic lifts, motivated by scrap-metal prices, with three thefts on this campus in twelve months, targeting the south employee lot after 2200 because lighting is sparse" is a threat characterization. "Vehicle crime" is not.

Design-Basis Threat as a Practitioner Concept

A design-basis threat (DBT) is a documented adversary you agree to design against: how many people, what weapons, what vehicles, whether an insider assists, and what tactics they will attempt. Nuclear, aviation, and some high-security industrial programs use a formal DBT. On a typical commercial campus you may never see that phrase in a regulation, but the idea still belongs in the assessment: you are not designing against every imaginable attacker, and you are not designing against a slogan. You are designing against a stated adversary.

The DBT is a design assumption, not a prediction that this exact attack will occur on Tuesday. It lets you size barriers, delay, detection, and response. If leadership later wants protection against a heavier weapon or a larger team, that is a change to the design basis, not proof that last year's fence "failed." Do not confuse a DBT with a classified government product. Do not invent a Department of Homeland Security color chart as if the exam expects you to recite red-orange-yellow. The old color-coded Homeland Security Advisory System is not a current practitioner tool, and unclassified terrorism products change format over time. When a scenario gives you a current, published, unclassified advisory, use what the scenario gives you. When it does not, characterize the adversary from site evidence, local law enforcement, industry loss data, and your own survey.

Criminal Threats You Must Keep Separate

Crime is not one threat. PSP items expect you to keep the common property and person crimes distinct because they imply different paths, times, and countermeasures.

Theft is the quiet removal of property. A contractor walking out with a laptop in a backpack, a driver palming a high-value parcel, or a thief taking converters from a dark lot are theft problems. They often need little capability beyond access and a few minutes of concealment.

Burglary adds unlawful entry. The adversary expects the building to be closed. Forced doors, roof hatches, window attacks, and "someone left it unlocked" entries are burglary pathways. A distribution center that scores well on daytime visitor control can still fail at 0200 if the man-door next to the dock has a broken closer.

Robbery puts a person in the event. Force or the threat of force is the point. A pharmacy window, a hospital cash office, and a parking garage at shift change are robbery geometries. Cameras that only record the product cage will not address a robbery of the person walking to the car.

Vandalism is damage as the goal. It may be a prelude to burglary (camera spray, lock epoxy) or a message (graffiti on a controversial tenant). Treat camera-directed vandalism as an attack on your detection system, not as a cosmetics ticket for Facilities.

Workplace violence ranges from threats and stalking to assault and homicide. Sources include co-workers, supervisors, patients or customers, and domestic partners who follow an employee to work. Physical security does not own the human-resources file, but it owns access, parking, reception, and the ability to lock a suite. A restraining order that security never sees is a threat-characterization failure, not an HR-only miss.

Terrorism and Extremism

Terrorism is violence or the threat of violence intended to coerce a population or government for a political or ideological purpose. Extremism may stop short of a formal terrorism label and still produce arson, assault, or sabotage against a facility because of what the organization represents: a clinic, a house of worship, a government office, a laboratory, or a brand in a public controversy.

Do not wait for a classified briefing to decide whether a site is a symbolic target. Open-source targeting indicators include prior threats, public controversy, the presence of a named official, and attacks on similar occupancies. Capability still matters: a lone actor with a vehicle is a different design problem than a small team with incendiary devices. History at peer sites is often stronger evidence than a national mood. Targeting is often symbolic—the front entrance, a sign, a specific tenant—rather than the highest-value warehouse in back.

A recurring trap is treating "terrorism" as automatically more important than crime. For most commercial sites, expected losses from theft, burglary, and workplace violence dwarf expected losses from a terrorist attack. That does not mean you ignore terrorism. It means you characterize it, then let likelihood and severity compete with other threats instead of leaping to blast film because the word is frightening.

Insider Threats: Employees, Contractors, and Privileged Vendors

An insider is anyone who already has legitimate access, knowledge, or trust. Payroll status is the wrong test. Keep three classes in view.

Employees have badges, schedules, social cover, and knowledge of which cameras actually work. Theft, sabotage, workplace violence, and data removal all travel on employee pathways. Pre-employment screening, access recertification after transfers, and prompt badge recovery at termination are physical-security tasks, not only HR tasks. A badge that still opens doors two weeks after a firing is an insider capability you issued.

Contractors often have more after-hours access than employees and less supervision. Construction, janitorial, and information-technology contractors learn floor plans, hide spots, and which doors are propped. A multi-year janitorial crew can be a more capable burglary insider than a new hire in accounting.

Privileged vendors—heating and cooling, elevator, waste, copier, pest control, and the security integrator itself—hold keys, alarm codes, or unescorted access to intermediate-distribution-frame closets, mechanical rooms, and loading docks. A vendor who services the access-control server is an insider with a toolkit. Vendor management (escort rules, work-order windows, key control, and badge expiration) is threat characterization, not a purchasing nicety.

Insider capability is usually high because the access is already granted. Intent may be profit, grievance, coercion, or ideology. History may be prior investigations, "near miss" inventory losses, or a pattern of alarms that staff treat as nuisance. Targeting is often precise: the pharmacy, the tool crib, the executive suite, the closet that holds the door controllers.

Sociopolitical and Cultural Events

Not every crowd is an adversary, and not every adversary is a crowd. Sociopolitical and cultural events—lawful protest, labor action, civil unrest, and gatherings near the property—still change the threat picture because they concentrate people, cameras, and emotion at your perimeter.

A lawful demonstration on the public sidewalk is not automatically a crime. Physical security still has work: keep fire exits clear, protect people arriving for work, prevent opportunistic theft during distraction, and document any shift from speech to property damage or assault. Civil unrest in a nearby corridor can produce smashed storefronts, vehicle ramming of street furniture, and copycat damage even when the original grievance has nothing to do with your tenant mix.

Cultural events (parades, festivals, sports) change traffic, parking, and the number of strangers at your doors. A stadium event two blocks away can turn your garage into overflow parking and your lobby into a restroom. That is targeting by geography, not by ideology.

Characterize protest and unrest with the same four questions. Capability: expected crowd size, history of property damage at similar events, presence of counter-protesters. Intent: message versus occupation versus damage. History: last year's rally at this address. Targeting: your logo, a specific tenant, or simply the glass on the street.

Likelihood Versus Severity

After characterization, you still need two separate judgments.

Likelihood is how credible it is that this adversary will act against this asset in the period you are assessing—often a year, sometimes a mission window. Use history, local crime data, industry loss data, and the targeting story. Do not confuse "possible" with "probable." Almost every crime is possible.

Severity (impact, consequence) is how bad it would be if the event occurred: harm to people, downtime, regulatory exposure, and reputational damage. A graffiti tag on a loading-dock door can be low severity. A robbery of a night nurse in the garage can be high severity even if cash loss is small.

A frequent, moderate-severity copper theft can justify more spend than a rare, catastrophic scenario you have no evidence of targeting. The exam will punish the candidate who funds only the dramatic event. It will also punish the candidate who ignores a high-severity event the site actually attracts—for example, a clinic that has been firebombed twice in the same region is not "too rare to consider."

Plot threats so that likelihood and severity are visible as two axes, not one "risk vibe." Then you can talk residual risk after existing countermeasures—the operating-environment work in a later section.

Worked Scenario: Mixed-Use Headquarters

A six-story headquarters sits above street-level retail in a downtown that hosts frequent demonstrations. In twelve months the site logged catalytic-converter thefts in the south garage, two after-hours burglaries of a first-floor tenant through a propped stair door, a pharmacy robbery two blocks away, a terminated employee who still appears at reception, and three lawful protests on the sidewalk that blocked a marked fire exit with signs.

If the assessment writes "urban crime and protest risk" and recommends a new video-management system, it has not characterized anything. Converter crews have capability (lifts, night work) and targeting (dark stalls). The burglar has history (propped door) and a pathway. The terminated employee is an insider-class problem even after payroll ends if the badge still works or if reception has no photo to compare. The protests show low intent to damage this logo but high ability to block egress. Terrorism is not absent from the universe, but this site's evidence does not currently support treating a complex attack as more likely than the garage thefts. The design basis for day-to-day protection is the thief, the burglar, the aggrieved former employee, and the crowd that can pin a door—not a classified color code.