Skip to content

Disrupting Hostile Reconnaissance

Why and how hostile reconnaissance is conducted, and the principles of how to disrupt threats during the reconnaissance phase, along with practical measures on how to reduce the vulnerability of their site

Last Updated 27 November 2023


Organisations face a variety of threats: terrorists, activists, corporate or state-sponsored spies and criminals. While these threats and their aims may vary, hostiles are united in their desire to succeed. Recognising they may not get a second chance to achieve their aims, hostiles will typically plan carefully. Generally, the more sophisticated the attack, the more complex the attack planning, and consequently the greater the need for specific, current and credible information. 

This information gathering activity can be described as hostile reconnaissance and it is a vital component of the attack planning process. NPSA defines hostile reconnaissance as

Purposeful observation with the intention of collecting information to inform the planning of a hostile act against a specific target. 

The information gathered from people, places and websites is typically used by hostiles to assess the state of security and likelihood of detection; to assess vulnerabilities in security and to assess likelihood of success. These commonalities in information requirements mean that measures put in place to disrupt hostile reconnaissance can be effective over a wide range of threats.

Understanding hostile reconnaissance and the attack planning process gives security managers and staff a crucial opportunity to disrupt the hostile by creating the perception and/or assessment of failure by hostiles in two main ways:

  • denying them the ability to obtain the information they need from their research because they simply cannot obtain it, or they could but the risk of detection to achieve this is too high
  • promoting failure - both of their ability to conduct hostile reconnaissance (they will not be able to get the information, they will be detected) and of the attack itself

These effects can be achieved because in the process of conducting hostile reconnaissance the hostiles are making themselves vulnerable to detection. 

Protective security strategies can therefore be focussed in the following manner to:

  • DENY the hostile the opportunity to gain information
  • DETECT them when they are conducting their reconnaissance
  • DETER them by promoting failure through messaging and physical demonstration of the effective security.

This approach will play on the hostiles' concerns of failure and detection.

Hostile Reconnaissance

A critical aspect of detecting and deterring hostile reconnaissance at a site is knowing the threat that you face and understanding where hostiles might conduct their reconnaissance from. This will enable the effective targeting of protective security measures to the area's most vulnerable to hostile reconnaissance.

NPSA has produced guidance to help organisations understand what hostile reconnaissance is, where it may be conducted and what can be done to deter it, while having a reassuring and recruiting effect on the regular site user.

Guidance also covers utilising existing protective security resources such as CCTV control rooms, security officers and other important resources, such as corporate communications and employees, more effectively to disrupt hostile reconnaissance.

Eyes Wide Open Video

View Video Transcript

Narrator: Terrorists like all criminals, look at the world a little differently from you and me, where we see normality, they look for opportunity. Where we see an iconic building or part of our history, they see a target to attack. Where we see services to help us live our lives, they see a chance to disrupt them. Where we see somewhere bustling and busy, they see the opportunity to kill as many people as possible. So, it’s time we too looked a little closer.

NaCTSO Security Adviser: Terrorists seek out places where they can make the biggest impact, they often target open places where it’s easy to move about unnoticed, a transport hub perhaps or a busy shopping centre or a football stadium. Places that attract large numbers of people often crowded together, enclosed spaces such as theatres, concert arenas or nightclubs also make attractive targets. Although security may be tighter, the risk of being caught is outweighed by huge publicity and the outcry a successful attack will generate. But whichever you work at, the threat is very real.

Narrator: Terrorists do careful research to ensure a successful attack, they gather all sorts of information such as how easy it is to get close to the target, whether they need passes to get in, who or what might challenge them. They will collect information when planning an attack; when the site is busiest, whether there are regular delivery times, what access there is for vehicles and they will pool information together and rehearse their plans, perhaps measuring the time in distances between entrances and exits. It is during this preparation leading up to an attack that we have the best chance of spotting suspicious behaviour, when the terrorist is at work and vulnerable to being exposed. 

NaCTSO Security Adviser: There is no profile for a terrorist so you can’t identify one by the way they look, their ethnicity, gender, age or clothing, it’s their behaviour that identifies them and in your role you are ideally placed to recognise suspicious behaviour. Be alert to the threat and you will notice that when a terrorist is preparing for an attack the way they act will seem out of the ordinary, look closely and you will see that the criminal taking photographs doesn’t always behave like a tourist taking photographs. A delivery man doing his job doesn’t behave like a terrorist scouting entrances and exits. Trust your instinct when it tells you that things don’t look right.

Narrator: When someone’s behaviour at your place of work raises your concerns, you have every right to approach them. Perhaps a person is in a restricted area, perhaps they don’t have the correct passes of authority to be there. Is someone you wouldn’t expect making notes, drawing diagrams, taking measurements are they taking videos or photos? What are they trying to capture? Are they hiding their camera, does it look like regular tourist photography or something out of the ordinary? Perhaps they are showing an interest in security features, even testing them. Maybe they are going out of their way to avoid being seen, hiding their face, wearing the wrong clothes for the weather or even in disguise. It is not just people on foot, vehicles are used time and again by terrorists planning attacks, be aware of vehicles parked out of place left abandoned in restricted or sensitive areas, or a vehicle retracing the same route.

Met Police- Superintendent: If it sounds like common sense, that’s because it is but you have to act on your suspicions and trust your instincts. It will help give you confidence if you have taken the time to understand what normal activity or behaviour looks like where you work so you can identify what is out of the ordinary, then if something doesn’t feel right you need to investigate to understand the situation better then you can decide whether to report the matter but approaching someone and asking them to explain their presence or behaviour could be uncomfortable for both of you, have confidence and remember the purpose of your role. Be open with the person about why you are speaking to them, if you are clear, calm and polite most members of the public will understand your concerns and remember that if someone really is gathering information, carrying out what we call hostile reconnaissance then approaching them shows that you are  your colleagues are alert and that could just be enough to deter a criminal or terrorist from continuing from their plans.

Narrator: Recognising suspicious behaviour is one thing, knowing what to do next requires a little more confidence, you need clarity, having recognised behaviour that you feel is suspicious you now need to understand the situation and decide whether your instinct is correct, listen to an example and think about how this security guard tries to understand the man’s motives for his behaviour.

Example Situation: 

Security guard:  Morning Sir, how are you today?

Suspicious man: I’m fine, thanks, yourself?

Security guard: Not too bad thanks, I’m part of security here and I would just like to ask you a few questions as to the purpose as to why you are here sir

Suspicious man: Why?

Security guard: I have noticed that you have been here since about 11:30, you have been taking some notes and you’ve been coming in and out of entrances, what’s the reason for your visit here sir?

Suspicious man: I’m here to visit a colleague

Security guard: Colleague? And who would that colleague be sir?

Suspicious man: His name is.. John

Security guard: John? Who?

Suspicious man: Um Simons?

Security guard: John Simons, have you been here before sir?

Suspicious man: No, it’s my first time

Security guard: So you’ve been here a while and as I said you’ve been here since half past 11 or so

Suspicious man: Yeah, I got here way too early

Security guard: Have you been taking notes on your paper there sir and coming in and out of the building a few times, can I ask why?

Suspicious man: It’s research

Security guard: Research, can you go into a bit more detail

Suspicious man: I’m a writer, sorry it’s bit embarrassing I don’t like to talk about my work

Security guard: It’s okay, it’s no problem. So the gentleman um which floor does he work on sir

Suspicious man: I have no idea

Security guard: You have no idea..And your appointment is at?

Suspicious man: We were meant to meet at 1 o’clock

Security guard: So you’ve got about 15 minutes or so but you’ve been here an awfully long time. Do you have a telephone number for the gentleman?

Suspicious man: I don’t I am afraid no

Security guard: An email address?

Suspicious man: That’s on my computer at home, we’ve just been conversing by email

Security guard: But you’ve been here since about half past 11?

Suspicious man: As I say I like to leave extra time…how did you know how long I’ve been here?

Security guard: So we are part of security here

Suspicious man: Yeah but I don’t see any camera’s which is unusual for a place like this 

Security guard: I can’t go into too much detail but the security is very important here but as I said-

Suspicious man: So there’s more than one of you then…is there someone watching us on a hidden camera here 

Security guard: Sir I’m not going to go into detail like that, what I’m going to do is I have taken the gentleman’s name, which was sorry`/

Suspicious man: John

Security guard: John? 

Suspicious man: John Roberts

Security guard: Okay sir, what I’m going to ask you to do is if the gentleman is going to meet you in the next 15 minutes or so and you’re at the location then bear with me for one second and I will just try and get hold of mr John for you okay, I would just like to make sure that you are on time and there are no hiccups with your meeting. If you could take a seat here for me sir.

Suspicious man: There’s not a problem is there?

Security guard: There’s no problem sir, you take a seat. Thank you very much 

Behavioural Detection Expert: Okay, now let’s review the conversation I think the security guard did a good job here, he explained who he was and why he decided to speak to this person. His tone of voice was confidence and friendly and he wasn’t making a scene in front of other people in the area, there was no reason for the man he approached to feel threatened or harassed. However, I would be weary of someone asking for details about the CCTV and security staff on site. Ask yourself why that would be of interest to him. It’s not just about the questions that people ask you, it’s also about how they answer your questions, try to get the person talking, in this case the security guard asked questions about who he was meeting and why he was here so early. The man was vague with his answers, he couldn’t remember his colleagues name properly, could provide any contact details and he’d been hanging around a long time without approaching reception. In addition, the lack of details in his responses meant for me that the story was unconvincing. What was now crucial was that the security guard went away and verified his story.

Narrator: Reporting any suspicion is very important, you may be reluctant to do so, maybe you are embarrassed or you don’t want to get involved. In some cases, you might worry about being seen to be overreacting. 

Security manager (BAA): Its recognised that we’re are in a unique position to guard from against the threat from terrorism so if you have any doubt, report it. Use the word SALUTE to help you remember what to pass on. Situation- who or what you picked up on, Activity- what was happening, what was the person or vehicle doing. Location- where exactly was this. Unit- who made the observation. Time- time and date of the incident being reported. Equipment- any equipment you used for surveillance detection such as a specific CCTV camera. Also remember to note descriptions of any individuals involved, if you don’t have a name from their ID still record their age, hair colour, height, clothes, gender, ethnicity and any distinguishing features such as facial hair or tattoos. 

Narrator: It’s important to find out what your specific procedures for reporting are at your place of work, if in doubt put any suspicions through to the number on screen. Anti-Terrorism Hotline: 0800 789 321

NaCTSO Security Adviser: Have the confidence to make the right decision, follow that simple process of recognising, understanding and reporting. It will help to protect the place Swhere we live and work, you will make those places safer for all of us. Now, there’s 3 things you can do to start this process.

Met Police- Superintendent: First, consider what ordinary behaviour looks like in your place of work, how do you expect people to dress or to behave. Will they be alone, what activities would you expect them to carry out? Do this and it will be easier to recognise suspicious behaviour. 

Met Police- Superintendent: Secondly, you need to understand someone’s behaviour, what details can you obtain by asking questions, what excuses can they give you, what questions can you ask to test the plausibility of those excuses.

Security Manager (BAA): and finally know your reporting procedures

To enhance your “Counter Terrorism Awareness” you can also attend a local police “Project Griffin” event. For further details contact your local “Counter Terrorism Security Adviser” via the local police NaCTSO website.

See, Check and Notify

See, Check and Notify (SCaN) aims to help businesses and organisations maximise safety and security using their existing resources. Your people are your biggest advantage in preventing and tackling a range of threats, including criminal activity, unlawful protest and terrorism. 

SCaN training empowers your staff to correctly identify suspicious activity and know what to do when they encounter it. In addition to this, the skills your staff learn will help them to provide an enhanced customer experience. It helps ensure that individuals or groups seeking to cause your organisation harm are unable to get the information they need to plan their actions.

SCaN logo

Action Counters Terrorism

NPSA is proud to support Counter Terrorism Policing's Action Counters Terrorism (ACT) Campaign which encourages the public to help the police tackle terrorism and save lives by reporting suspicious behaviour and activity. Further information is available on the ACT app and in the Publicly Accessible Locations (PALs) guidance.

Action Counters Terrorism logo

Project Servator

Project Servator is a policing tactic that aims to disrupt a range of criminal activity, including terrorism, while providing a reassuring presence for the public. It is used by a number of UK police forces. The approach relies on police working with the community - businesses, partners and members of the public - to build a network of vigilance and encourage anything that doesn't feel right to be reported. Project Servator has been successful in gathering intelligence that has assisted Counter Terrorism Units across the UK in investigating and preventing acts of terror. It has resulted in arrests for a multitude of offences and is responsible for removing firearms, knives and drugs from the streets since it was introduced in the City of London 2014.

Project Servator logo
Did you find this page useful? Yes No