Schedule a CallContact
February 28, 2021

Stopping an Attack Before It Happens: The “Gathering Information” Phase

In this blog you will learn how to stop an attack before it happens.


The key to stopping perpetrators before they commit any sort of crime is understanding the process that organized criminals use to scout their targets.

The information gathering stage involves surveillance that helps offenders gain a better understanding of the location and people that will be the center of their attack. Learning how to identify suspicious behavior during this period, and whether or not you, your business, or your organization are being surveilled can help you identify would-be attackers. Not only this, but once suspicious behavior has been noted, you and your team need to have a plan of action in order to respond effectively and prevent worst-case scenarios from playing out.

What is the “Information Gathering Phase?”

Before an attack is actually carried out, the people organizing the attack will spend time gathering information about their target. If it is a business or organization, this most likely entail detailed surveillance that makes note of employees, customers or patrons, operating hours, entrances and exits, security measures and their weaknesses and more. Gathering all of this information is no easy task, and requires some suspicious behavior on the part of the perpetrator. The better you become at identifying this behavior, the easier preventing attacks becomes.

What Does Suspicious Behavior Look Like?

There are two main behaviors to look out for in terms of suspicious individuals: covert surveillance and elicitation.

Covert surveillance involves monitoring, recording or capturing information in some way, usually with phones or cameras. A would-be attacker may take photos of security cameras, attempt to film video of floor plans or make note of exits. This could be done surreptitiously or under the guise of something like a selfie or facetime video. Covert surveillance may also include security tests, where an individual leaves a bag or other item unattended to see the amount of time it takes for the object to be reported or checked on by security.

Elicitation is the gathering of information through direct conversation. Someone attempting to elicit sensitive information may try to turn an otherwise normal conversation towards the security measures of your building, the security guard schedule, or other topics. Individuals attempting this method of information gathering may ask these questions under the guise of a charity or maintenance worker, or other authority. Taking care to only share what information is necessary for the average patron of your business or organization unless the identity of an individual is confirmed should be the standard for every employee.

Suspicious behavior can fall outside of these two examples, and don’t necessarily mean that an individual is actively gathering information. Regardless, it is good to keep your eye out for people exhibiting the above behaviors as well as individuals who:

  • Are seemingly wandering around without a specific purpose
  • Are dressed unusually for your organization or for the weather/season
  • Are breaking social norms or physical boundaries with you or others
  • Are entering or exiting with unusual items
  • Don’t seem to be interested or involved in your organization.

How to Respond to Information Gathering

Before you or your team notices any of these behaviors, it’s important to have protocol in place to handle the situation. First off, the patrons of your business or organization should have a clear idea of who and where to report suspicious activity to.

Next, when it comes to covert surveillance, your team should be trained to take note of the individual and report them to your security team as soon as possible. From there, your security team should be put on alert for this person or more suspicious behavior. Employees should never confront suspicious individuals alone or without the security team’s knowledge. In terms of elicitation, your team should take care to only share relevant information with patrons. If someone is asking questions that they feel are suspicious, a higher authority should always get involved. This goes for uniformed workers seeking information about the building.

In general, if clearly suspicious behavior is noticed fairly consistently, it should be reported to local law enforcement who can work with you to determine the next steps.


Subscribe to Our Newsletter

Join our mailing list for more information about ITAC’s events, security advice, case studies, and more.