When it comes to personal safety and security it’s very easy to believe that we know what something is, but we try to articulate it, we find that we lack a clear definition, which is where having the correct and appropriate terminology can be extremely helpful. One of the terms/definitions where this becomes apparent is that of “risk”, a term which is often equated with “likelihood”, though it is somewhat more complex, and the two are not synonymous. It is not my intention to discuss risk in this article, however if you’re interested in looking at “risk” further, you can click here, for a link to an article concerning it. In this article I want to take a look at defining what is “suspicious”, and the difference between what is suspicious and what is “odd” or “abnormal”.

One of the classic definitions of situational awareness (SA) is, “the presence of the abnormal and the absence of the normal” i.e., when this occurs, it should pique our interest and cause us to be suspicious etc. However, we may encounter “odd” or “abnormal” things that don’t indicate harmful intent e.g., a drunk, homeless person half asleep on a bench in a public park, where everyone else is sunbathing, reading books, or talking in a group etc. may be “abnormal” or “odd” considering the situation but it doesn’t mean that they harbor harmful intent towards anyone, or represent a threat or danger etc. There is little or nothing about their presence that concerns us or that we should be suspicious about. What we are doing when we look at them is profiling a person rather than a behaviour or set of behaviours, and this is where overly simplistic definitions that lack depth to them, or research behind them, can create a vulnerability.

This is one of the dangers of racial profiling but is also illustrated in the example above. When we attribute actions, behaviors and intents to various groups e.g., that homeless drunks are a threat or that black people are more likely to commit violent offenses than white people, we have a tendency to assume everyone who isn’t in these groups is “safe”. We may be so focused on the homeless person who is half asleep as a potential threat, that we fail to pick up on the “normal” person who has synchronized their movement to ours and is coming to intercept us. This is why when we “profile” people it should be based solely on their actions and behaviours and not “who” they are. On May 30th, 1972, the Japanese Red Army carried out an attack at Lod Airport near Tel Aviv, killing 24 and injuring 80 more (excluding the perpetrators). At the time there was little focus on Japanese terrorist groups, as most were interested in promoting socialist/communist agendas, which didn’t involve Israel. However, the Japanese Red Army had entered into a “reciprocal” agreement with the PFLP (Popular Front for the Liberation of Palestine), where they would attack an Israeli target, and the PFLP would conduct a terrorist attack in Japan. The PFLP knew that Israeli Security (at the time) wouldn’t pay much attention to some tourists from Japan, and that as Arabs, if they tried to conduct the attack, they would likely come under extra scrutiny from the Israeli security forces. This illustrates why it is far better to identify and raise suspicion around a behavior than a “person”.

It is also important to note that what should raise our suspicions are sets of behaviors and actions that have been consistently proven to indicate the potential for violence before, and that reasonably suggest that violence may occur in the future. There is a certain type of person I encounter, who for whatever reason, insists that it isn’t worth taking an interest in personal safety and self-defense etc., because there are certain scenarios in which nothing would work e.g., they create scenarios where you are woken up in the night surrounded by eight, jacked, trained aggressors, each armed with an AK-47, with four highly-trained Rottweilers, foaming at the mouth and ready to pounce on command, and then they ask, “So what would you do?” This is a scenario that is fitting for an episode of Reacher, or a John Wick movie etc. It isn’t relatable or likely for someone living in a two-family house in Boston. We can all create complex storylines with multiple stages and contingencies etc., and fit our narratives to them, but these should not be the basis for identifying “suspicious” behaviour e.g., the teenager and his friends hanging around near our house, are very unlikely to be carrying out surveillance on us on behalf of a Colombian drug cartel, and transmitting information back to them, in Morse Code using a concealed transmitter in their jacket etc. When we determine what suspicious behavior is, it should not be that which is simply abnormal, and it needs to be founded in reality i.e., is it believable.

One of the things I try to convey to people concerning what constitutes a “suspicious” behavior versus an “abnormal” one, is that what usually arouses suspicion, is a cluster of behaviors. Two things which can indicate that someone is conducting surveillance in order to initiate and attack, are “target glancing” and “scanning”. Each on its own is enough to gain our interest, but when combined we should be suspicious. Target glancing involves a person looking at us and looking away in a repeated fashion. Scanning involves someone looking around. Each on their own has a “reasonable” explanation, which shouldn’t be used as a form of denial e.g., a person may be “scanning” because they are looking for a friend in that space that they have arranged to meet, and someone who is “target glancing” may think that they recognize us from somewhere else, but are unsure, and are trying to confirm if they do before approaching us etc. However, if someone is doing both together that becomes suspicious i.e., it is very unlikely that a person is looking for a friend and ascertaining whether or not they know you, at the same time.