Suspicious behaviour vs profiling
Pillar: TERRORISM · Day 70 · 20–30 min deep read · Updated 1970
This lesson is part of the open Guard.Academy library. All content is free to read. Bookmark it, share it with a colleague, and come back to the drills the next time you're on shift.
Opening Most attacks are preceded by reconnaissance. Most reconnaissance is spotted by ordinary people doing ordinary jobs — and choosing to report it.
Why this matters The UK threat from terrorism is officially 'substantial' — an attack is likely. Security operatives are often the first to spot hostile reconnaissance, insider threats and unattended items. Martyn's Law (the Terrorism (Protection of Premises) Act 2025) places new duties on venues to prepare staff for exactly this.
A short history The UK threat from terrorism has evolved from PIRA campaigns of the 1970s–90s, through 7/7 (2005), to lone-actor and marauding-style attacks of the last decade. Each phase reshaped guidance: CONTEST (the UK counter-terrorism strategy), Prevent (the safeguarding strand), and now Martyn's Law (Terrorism (Protection of Premises) Act 2025) place explicit duties on premises and venues to prepare staff. The named author of Martyn's Law — Figen Murray, mother of Martyn Hett killed at Manchester Arena — drove the campaign that turned a personal tragedy into national legislation.
International context Run-Hide-Tell mirrors the US Run-Hide-Fight and the EU Run-Hide-Call — same principle, varied final action. Hostile recon doctrine is shared with most national counter-terror programmes.
By the numbers - UK threat level has sat between 'substantial' and 'severe' for most of the last decade. - Over 75% of disrupted UK plots in the last decade involved lone actors or small cells. - ACT reporting line receives tens of thousands of public reports each year. - Hostile reconnaissance precedes most attacks — and is the phase most likely to be spotted by frontline staff.
Numbers to know by heart - 0800 789 321 — the ACT confidential reporting line. - 999 — for immediate threat to life. - 3 — typical Martyn's Law tiers (standard / enhanced / out of scope). - 5 — letters in SCOPE — your operative framework.
The framework Use **SCOPE**: **S**can, **C**hallenge politely, **O**bserve patterns, **P**rotect the public, **E**scalate via ACT.
Deep dive Counter-terrorism for the front line is mostly about pattern recognition: knowing the baseline of normal at your venue, spotting the off-baseline behaviours, and reporting clearly. SCOPE — Scan, Challenge, Observe, Protect, Escalate — is the spine. Hostile reconnaissance is the phase you're most likely to see: repeat visits, photography of security features, testing access, asking unusual questions about staffing or routines. Behaviour, not appearance, is the only legitimate trigger. Profiling by ethnicity, religion, or dress is unlawful, unprofessional, and operationally useless — it generates noise, not signal.
On shift — step by step 1. Scan your patch with a 'baseline' in mind — what's normal here? 2. Anything off-baseline → polite, professional challenge ('Can I help?'). 3. Note time, place, description, vehicle, direction of travel. 4. Move the public away first; investigate second. 5. Report via ACT (0800 789 321) or 999 if immediate threat.
Real-world scenario A CCTV operator notices the same individual photographing the staff entrance and delivery yard on three consecutive Tuesdays. She logs each sighting, gets a clear still image, and reports via the ACT line. Counter-terrorism police follow up — it turns out to be hostile reconnaissance for a planned theft, not terrorism, but the same skills caught it early.
Scenario walk-through — Person asking about staffing patterns Polite, professional challenge: 'Can I help with anything?' Note time, description, behaviour. Log it. Patterns matter more than single events.
Another scenario — Marauding attack — first contact Run if you can. Hide if you can't. Tell (999) when it's safe. Help others if you can without putting yourself in further danger.
One more — Unattended bag at a transport hub Apply HOT. If suspicious, clear the area to a safe distance, cordon, report. Never touch, never investigate, never publicly speculate about contents.
Case study — Three Tuesdays of photography A CCTV operator noticed the same individual photographing staff entrance and delivery yard on three consecutive Tuesdays. She logged each sighting, captured stills, and reported via ACT. Follow-up investigation linked it to a planned theft, not terrorism — but the skills caught it early either way.
Case study — Borough Market response Operatives and bar staff used impromptu barricades, shouted clear instructions, and used the 'run, hide, tell' framework before formal training existed for many of them. Their actions saved lives and shaped the doctrine since.
Myths vs reality **Myth:** Counter-terror is for police. **Reality:** Counter-terror at depth is for police. Counter-terror at breadth is everyone.
Myth: ACT reports waste police time. Reality: ACT reports are triaged by specialists. Most are 'nothing' — but pattern intelligence depends on the flow.
Drills you can run before your next shift 1. Walk your patch and identify the baseline of normal — what does 'off-baseline' look like? 2. Pre-memorise the ACT number: 0800 789 321. 3. Practise saying 'Run, Hide, Tell' in your own words to a colleague.
Weekly habits - Update your sense of 'baseline normal' for your patch. - Practise a polite challenge phrase ('Can I help?') out loud. - Review your most recent ACT report — or note why you didn't make one. - Read one ProtectUK update per week.
Red flags — what to avoid - Profiling by appearance, not behaviour. - Approaching a suspicious package instead of clearing the area. - Treating Run, Hide, Tell as a slogan rather than a sequence. - Failing to report 'low-level' suspicious activity.
Green flags — what good looks like - Clear baseline awareness across the team. - Documented behavioural challenges and reports. - Visible signage and staff briefed on Martyn's Law duties. - Hostile reconnaissance reported via ACT.
Pre-shift checklist - [ ] Scan baseline. - [ ] Challenge politely. - [ ] Observe pattern. - [ ] Protect public first. - [ ] Escalate via ACT or 999.
Common pitfalls - Profiling by appearance instead of behaviour. - Approaching a suspicious package instead of clearing the area first. - Treating Run, Hide, Tell as a slogan rather than a sequence. - Failing to report 'low-level' suspicious activity — patterns matter more than single events.
Frequently asked questions **Q. Does Martyn's Law apply to my venue?** Thresholds depend on capacity and event type. Check your client's published assessment and your assignment instructions.
Q. Can I detain a suspected hostile? Almost never. Observe, report, protect the public. Let the police take it from there.
Q. What if my report is 'wrong'? Reports go to specialists who triage. Many 'wrong' reports help build pattern intelligence. The professional answer is always report and document.
How this compares elsewhere Police counter-terrorism work is intelligence-led at depth. Your job is detection at breadth — the wide-funnel reporting that gives the system signal to work with.
Notes for supervisors and team leaders Supervisors set the reporting culture. If your team has 'reported nothing' for a quarter, that is a finding — not a clean sheet.
The law behind it Terrorism Act 2000; Terrorism Act 2006; Counter-Terrorism and Security Act 2015 (Prevent duty); Terrorism (Protection of Premises) Act 2025 (Martyn's Law).
Key terms - **Hostile reconnaissance** — Pre-attack surveillance — photos, timing of patrols, testing access points. - **ACT** — Action Counters Terrorism — national reporting line: 0800 789 321. - **Run, Hide, Tell** — The official UK survival sequence for marauding attacks.
Extended glossary - **SCOPE** — Scan, Challenge, Observe, Protect, Escalate — the operative framework. - **Hostile recon** — Pre-attack surveillance — photos, timing, testing access. - **Martyn's Law** — Terrorism (Protection of Premises) Act 2025 — duties on qualifying premises. - **ACT** — Action Counters Terrorism reporting line: 0800 789 321. - **Run, Hide, Tell** — Official UK survival sequence for marauding attacks.
Further reading - **ACT Awareness e-learning** — Free, official, and updated regularly. - **Martyn's Law — government guidance** — The plain-English summary of duties on premises. - **ProtectUK platform** — The home for protective security guidance.
Exam-style tips - 'Behaviour not appearance' is almost always the right framing. - HOT and Run, Hide, Tell are exam staples — over-learn them.
Reflection prompts - What does 'baseline normal' look like on your patch? - Have you reported a suspicious behaviour this year? If not — why not?
Today's reflection on this lesson Think back to the last shift where you saw "suspicious behaviour vs profiling" come up. What did you do? What would you change with today's framework in mind? Hold that in mind as you answer the questions below — it's the reflection that turns a lesson into a habit.
Closing thoughts You will probably never face an attack. You will almost certainly see, at some point, the reconnaissance that precedes one. What you do with that moment matters.
Reminder: Guard.Academy is **not** an accredited SIA qualification. It complements your training — it does not replace it. To obtain or renew an SIA licence you still need an approved course with an accredited provider.