Suspicious Activity: Objective Observation and Reporting
Notice behaviour — not appearance — describe it objectively and report it quickly through the right channel.
Why it matters
Many incidents are preceded by observable behaviour. Staff who report clearly and without bias give responders useful, fair information.
Who it's for: All staff, reception, security officers and event volunteers.
Learning objectives — by the end you can:
- Describe behaviour-based indicators without relying on appearance, ethnicity or religion.
- Write a factual description using who, what, where, when.
- Know when to call emergency services versus internal reporting.
Key terms
- Behavioural indicator
- An action out of place for the context, e.g. photographing access points and avoiding staff.
- Objective description
- What you saw and heard, without interpretation.
- Hostile reconnaissance
- Information gathering that may precede an attack; report it, do not investigate yourself.
Lesson notes
Focus on behaviour
Ask: is this behaviour unusual for this place and time? Examples: persistent interest in security arrangements, attempts to access restricted areas, leaving items unattended and walking away. Never profile people based on how they look.
Describe it well
| Element | Example |
|---|---|
| Who | Adult, approx. 1.8 m, grey jacket, black backpack |
| What | Photographed staff entrance and card reader for ~3 minutes |
| Where | North gate, staff entrance |
| When | 14:20, 3 Oct |
| Direction | Left on foot towards bus stop |
Reporting
- 1Immediate danger: call local emergency services first.
- 2Otherwise report to your security control room or supervisor.
- 3Do not confront, follow or detain.
- 4Write notes as soon as possible; separate facts from opinions.
Video lesson
Video to be added
A verified video from an official or reputable channel has not yet been selected for this topic. The text lesson above covers the full content.
Search YouTube for related videosPractical story: The unattended bag at the conference
Fictional teaching example
Situation. A volunteer saw a bag left under a seat after a session ended.
Known facts
- Nobody nearby claimed it.
- The volunteer used the HOT principle: Hidden? Obviously suspicious? Typical of the area?
Decisions
- Asked people nearby, then reported to the event control without touching it.
Outcome. Control reviewed CCTV; the owner was traced to the café. Event resumed in 10 minutes.
Lessons
- Most items are innocent; a calm process still matters.
- Do not touch; report.
- Clear descriptions save time.
Worked example
Worked example: rewriting a biased report
| Poor | Objective |
|---|---|
| 'Shady-looking guy hanging around' | 'Man in blue hoodie stood by gate 2 for 25 min, repeatedly checked staff badges' |
| 'He was definitely up to something' | 'He left when approached by staff at 18:05' |
Practice exercise
Rewrite: 'A suspicious woman was snooping around the car park looking dodgy.'
Incident report template (CSV)Quiz
Sign in to save quiz results.
References
- Official guidanceProtectUK — ACT Awareness e-learning
- Official guidanceCISA — Recognize and report suspicious activity
Verify current editions and applicability. Standards are copyrighted; consult licensed copies for exact requirements.
Report an issue with this contentRelated topics
Facility & Event Security
Event and Public-Facing Venue Security Awareness
Plan crowd flow, entry, communications and emergency coordination for events and busy public venues.
Access Control
Access Control and Visitor Management
Control who goes where and when — using credentials, zones, visitor processes and regular access reviews.
Preparedness
Tabletop Exercises, Drills and After-Action Reviews
Test plans safely through discussion and drills, then capture lessons and track corrective actions to closure.