Dams Sector Suspicious Activity Reporting

Suspicious activities are irregular or highly unusual behaviors that may be associated with pre-operational/preparatory surveillance, operational activities exploring or targeting a Dams Sector facility or system, or any possible violation of law or regulation that could compromise a sector facility or system, jeopardizing life or property.

What Owners and Operators Can Do

Suspicious incidents may actually constitute pre-operational activities and should be reported immediately.

  • Maintain awareness of your environment
  • Identify behaviors that are out of the ordinary
  • Report the activity and include as much detail as possible

Types of Suspicious Activities

Suspicious activities may include:

  • Bomb Threat: Any threat of a bomb attack on property or adjacent properties
  • Elicitation: Requests for information via telephone, email, or mail asking for:
    • Information on hours worked and the number of personnel on duty during any given hour
    • Technical data about the asset or its security system
  • Overflight: Airborne vehicles (small planes, helicopters, remotely controlled aircraft) that appear to be using a crossing pattern to survey the property or facility
  • Surveillance: Person(s) intending to gather information about the facility, its operations, or protective measures through photography, videotaping, sketching, or use of vision-enhancing devices (e.g., binoculars)
  • Test of Security: Testing of security systems, responses, and reaction times at a facility (which includes any attempts to test or penetrate physical security barriers or procedures) and attempts to acquire information, uniforms, badges, passes, or other security-related documents
  • Weapons Discovery: Discovery of weapons or a weapons cache on the property or adjacent properties

Examples of Suspicious Activities

  • Showing unusual interest in a facility (e.g., observing through binoculars, taking notes, photography, drawing maps, or drawing structures of the facility)
  • Persons parking, standing, or loitering in the same area on multiple days with no reasonable explanation for doing so
  • Persons not associated with the facility showing an increased interest in the surrounding area

Report Suspicious Activity

Suspicious activity reporting is the official documentation of observed behavior reasonably indicative of pre-operational planning related to terrorism or other criminal activity. Timely reporting helps local authorities act quickly to identify potential threats and can provide an indicator of national-level activities against similar facilities or operations. Recipients of suspicious activity reports can include the following:

  • Follow the organization's documented process for reporting suspicious activity, such as by submitting a spot report to the security shift leader, notifying a supervisor, and/or submitting a formal suspicious activity report
  • Report suspicious activity to local law enforcement
  • Report computer or network vulnerabilities to CISA Central, to help serve as part of an early-warning system in the event the attack is targeting multiple facilities and/or sectors

For additional information on Suspicious Activity Reporting, please contact the Dams Sector Management Team at DamsSector@cisa.dhs.gov.