Definitions.  See section 1 of Attachment 2 for a definition of "suspicious activity" and Attachment 3 for a glossary of the categories of suspicious activity.

Releasability.  This DTM is approved for public release.  Copies may be obtained through the Internet from the DoD Issuances Web Site at http://www.dtic.mil/whs/directives. Attachments:
As stated ATTACHMENT 1

POLICY ON FORCE PROTECTION THREAT INFORMATION


1.  It is DoD policy that:
a.  The terrorist threat remains one of our Nation's most pervasive challenges.  History has shown that DoD personnel, facilities, and activities make high-value terrorist targets, and no change is predicted for the future.

b.  Force protection threat information guides DoD efforts to:


(1)  Identify threats to the Department of Defense at the earliest opportunity.


(2)  Implement information-driven and risk-based detection, prevention, deterrence, response, and protection efforts immediately.


(3)  Identify persons involved in terrorism-related activities and long-term threats to the Department of Defense.

c.  To strengthen DoD efforts to fight the terrorist threat:

(1)  Those responsible for protecting DoD resources must have timely access to force protection threat information, particularly information that indicates a potential threat regarding those who want to attack us, their plans and activities, and the targets that they intend to attack.


(2)  Force protection threat information shall be immediately available to, administered by, and shared among appropriate DoD law enforcement, force protection, antiterrorism, and security personnel in support of DoD missions.


(3)  In addition, this information will be made available to other DoD Components to the maximum extent permitted by law, executive order, and directives for force protection purposes.

d.  The DoD Components and sub-components shall document, store, and exchange personally-identifiable information concerning U.S. persons, in strict conformance with Federal law and DoD regulations.  The sharing of this information, although critical to the success of the U.S. Government's terrorist-related efforts, must comply with all existing laws and regulations safeguarding personal freedoms, civil liberties, and information privacy. 2.  This policy does not affect existing policies governing:
a.  DoD Intelligence Component activities.  DoD Intelligence Components may collect, retain, and disseminate information concerning U.S. persons pursuant to procedures set forth in DoD 5240.1-R Reference (a).

b.  DoD Component acquisition of information concerning non-DoD personnel and organizations and the sharing of terrorism information in accordance with Executive Order 13388 Reference (b).


ATTACHMENT 2

PROCEDURES FOR REPORTING SUSPICIOUS ACTIVITY 1.  IDENTIFYING SUSPICIOUS ACTIVITY.  Suspicious activity is any behavior that is indicative of criminal activities, intelligence gathering, or other pre-operational planning related to a security threat to DoD interests worldwide.  Although it is often difficult to determine whether a local incident has a terrorist nexus, similar incidents across many local jurisdictions may indicate the existence of a national threat.

2.  REPORTING SUSPICIOUS ACTIVITY.  The DoD Components shall:


a.  Conduct suspicious activity reporting in accordance with the procedures in Deputy Secretary of Defense Memorandum Reference (c).  These procedures shall remain in effect until the Department of Defense approves and implements a permanent force protection threat reporting system.

b.  Submit to Defense Criminal Investigative Organizations and other DoD law enforcement or security authorities un-vetted Suspicious Activity Reports and other DoD non-intelligence reports dealing with information regarding a potential threat or suspicious activity, such as those listed in Attachment 3, that is related to DoD personnel, facilities, or forces in transit.  The DoD
Components shall share these reports with Combatant Command force protection and antiterrorism personnel.

c.  NOT report information related to a U.S. person's ethnicity, race, religion, or lawful exercise of rights guaranteed by the Constitution or Federal law unless reasonable grounds exist that show a direct relationship of such information to a specific criminal act or behavior that may pose a threat to DoD personnel, facilities, and forces in transit.

d.  In compliance with DoD Directive 5400.11 Reference (d):

(1)  Establish rules of conduct for all persons involved in the design, development, operation, and maintenance of all threat reporting systems and associated processes.


(2)  Train these persons with respect to these rules.


(3)  Protect the rights of U.S. persons by ensuring personal information is not disseminated or disclosed to anyone who does not have the right and need to access such information.

e.  Ensure subordinate organizations comply with these procedures and the policy in this DTM.

ATTACHMENT 3

GLOSSARY OF CATEGORIES OF SUSPICIOUS ACTIVITY

These terms and their definitions are for the purposes of this DTM.

acquisition of expertise.  Unjustified attempts to obtain or conduct specialized training in security concepts, military weapons or tactics, or other unusual capabilities such as specialized transport or handling capabilities. breach or attempted intrusion.  Unauthorized entry or attempted entry into a restricted area or protected site; impersonation of authorized personnel (e.g., police, security, or janitorial personnel).


eliciting information for an unlawful purpose.  Suspicious questioning of personnel by any means about particular DoD structures, functions, personnel, or procedures at the facility or infrastructure.

expressed or implied threat.  A threat to DoD personnel or threatened damage to or compromise of a DoD facility or infrastructure.

flyover and/or landing.  Suspicious overflight of and/or landing near a DoD facility or infrastructure by any type of flying vehicle (e.g., airplane, helicopter, unmanned aerial vehicle, hang glider).

materials acquisition and/or storage.  Acquisition of unusual quantities of precursor material
(e.g., cell phones, pagers, fuel, and timers); unauthorized or unlicensed individual or group attempts to obtain precursor chemicals, agents, or toxic materials; and/or rental of storage units for the purpose of storing precursor material, chemicals, or apparatuses for mixing chemicals.


misrepresentation.  Misusing or presenting false insignia, documents, or identification or engaging in any other activity to misrepresent one's affiliation. recruiting.  Building operations teams and contacts, personnel data, banking data, or travel data under circumstances that would cause a reasonable person to perceive a threat to DoD personnel, facilities, or forces in transit.

sabotage, tampering, and/or vandalism.  Damaging, manipulating, or defacing part of a DoD
facility, infrastructure, or protected site.

surveillance.  Monitoring the activity of DoD personnel, facilities, processes, or systems including showing unusual interest in a facility, infrastructure, or personnel (e.g., observation through binoculars, taking notes, drawing maps or diagrams of the facility, and taking pictures or video of a facility, infrastructure, personnel, or the surrounding environment) under circumstances that would cause a reasonable person to perceive a threat to DoD personnel, facilities, or forces in transit.

testing of security.  Interactions with or challenges to DoD installations, vessels, personnel, or systems that could reveal physical, personnel, or cyber security capabilities including attempts to compromise or disrupt DoD information technology infrastructures.

theft, loss, and/or diversion.  Theft or loss associated with a DoD facility or infrastructure (e.g., of badges, uniforms, identification cards, emergency vehicles, technology, or documents whether classified or unclassified) that are proprietary to the facility, and/or a diversion of attention from a DoD facility or infrastructure that is related to a theft or loss associated with that facility.


weapons discovery.  Discovery of weapons or explosives.