Threat indicators are observed behaviors, activities and/or items construed as terrorist planning efforts or impending attack:

• Gathering of target intelligence—Process of intelligence gathering precedes all terrorist operations. This often involves conducting reconnaissance visits or stationary surveillance of a target for weeks or even months. For example, an individual videotaping the outside of a water treatment plant or someone who sits at a bus stop and takes notes, but never boards a bus.
• Acquisition of materials necessary for an attack—Responders and citizens should be aware of materials, supplies, and assets in their community that may have value to terrorist’s applications. Many items used to construct and transport weapons of mass destruction are available in all communities. For example, persons buying large quantities of nitrogen-based fertilizer or someone purchasing pipe along with caps for each end of pipe.
• Preparation of weapons—Citizens should be aware of threat indicators related to the preparation and delivery of terrorist weapons. For example, strong chemical smells coming from apartments or residences, or large drums of material moved into or out of a residence or storage facility.
• First steps of executing an attack (bomb delivery, gaining access to a plane, etc.)— Responsible persons should be aware of unusual activities around potential targets. For instance, individuals attempting to gain access to restricted areas, or vans or trucks left unattended in close proximity to a potential target.