Public CBRN-E Behaviour Obs Analysis ISEMI 2

See discussions, stats, and author profiles for this publication at: https://www.researchgate.
net/publication/378183508
A critical evaluation of the risk indicators of criminal conduct involving CBRN

and explosive materials - Behavioural and observational analysis in crime
detection and investigatio...
Preprint · October 2023

DOI: 10.13140/RG.2.2.27922.43205
CITATIONS READS
0 160
1 author:
Marian Kolencik
International Security and Emergency Management Institute
18 PUBLICATIONS 6 CITATIONS
SEE PROFILE
All content following this page was uploaded by Marian Kolencik on 15 February 2024.
The user has requested enhancement of the downloaded file.

A critical evaluation of the risk indicators of
criminal conduct involving CBRN and
explosive materials
Behavioural and observational analysis in crime detection and investigation
© Marián Kolenčík
October 2023
Public version N.2 (Updated - February 2024)
DOI: 10.13140/RG.2.2.27922.43205
1
A critical evaluation of the risk indicators of criminal
conduct involving CBRN and explosive materials
(Behavioural and observational analysis in crime detection and investigation)
Dr Marián Kolenčík, Ph.D.

Supervisor: Dr Hilary Miller
This publication is protected by copyright owned by the author or other parties. The
intellectual property rights of the author or such parties are in accordance with The UK
Copyright, Designs and Patents Act 1988, Berne Convention and Article 17 of the EU
Copyright Directive or any successor legislation. Any usage of the information presented
in this work must comply with the aforementioned legislation, and proper
acknowledgement must be given. Unauthorized distribution or reproduction in any
form is strictly forbidden without the consent of the copyright owner.
Attribution — You must give appropriate credit, provide a link to the license, and
indicate if changes were made. You may do so in any reasonable manner, but not in any
way that suggests the licensor endorses you or your use.
Non-Commercial — You may not use the material for commercial purposes.
No-Derivatives — If you remix, transform, or build upon the material, you may not
distribute the modified material.
Acknowledgement
This publication was produced using the MSc Diploma thesis of Dr. Marian Kolenčík,
Ph.D as a foundation. The thesis was completed as part of postgraduate studies in
Criminology and Criminal Psychology at the University of Essex. The author would like
to express gratitude to supervisor, Dr. Hilary Miller, from Essex University, who is a
former police officer, for her outstanding collaboration.
The author is very thankful to colleagues from Law enforcement and Intelligence agencies
from Belgium, Bosnia and Hercegovina, the Czech Republic, Estonia, Finland, France,
Georgia, Germany, Luxembourg, Portugal, Slovakia, United Kingdom and two EU
Agencies – Frontex and Cepol for their participation in the survey and for sharing their
valuable ideas, knowledge and experience while answering the survey questions related to
detection of risk indicators of criminal conduct involving CBRN and explosive materials.
The author is additionally thankful to the ISEM Institute for its support in providing access
to necessary case study documents and CCTV footage within the ISEMI's internal database
from the law enforcement field.
Recommended citation: Kolencik, M. (2023). A critical evaluation of the risk indicators
of criminal conduct involving CBRN and explosive materials. Behavioural and
observational analysis in crime detection and investigation. ISEM Institute. DOI:
10.13140/RG.2.2.27922.43205
Marian Kolencik A critical evaluation of the risk indicators of criminal conduct
involving CBRN and explosive materials
Abstract
Terrorist attacks using explosives and CBRN (Chemical, Biological, Radiological and
Nuclear) materials have been present throughout history. While the frequency of CBRN
terrorist attacks is relatively low compared to those with explosives and other types of
weapons, it is crucial to treat the efforts of both terrorist organizations and individuals with
appropriate gravity in order to avert catastrophic consequences. Identifying warning signs
that indicate criminal behaviour is crucial for preventing planned crimes or terrorist attacks,
and there is a need for more precise coverage of potential risk indicators related to CBRN
and explosive crimes. This research aimed at examining and scrutinizing possible warning
signs associated with planning and conducting terrorist attacks using CBRN and explosive
materials. The research was implemented in three phases. First, comprise the systematic
literature review. In the second phase, the case studies and CCTV records from past cases
from Europe, USA, Australia and Asia were analysed and the aim was to create a list of
risk indicators and categories for future reference by developing a methodological tool.
The last phase represented a survey in which the practitioners from European Law
enforcement and Intelligence Agencies critically assessed the list of risk indicators and
their categories created based on the previous two steps of the research. The last goal was
to gain the agreement and endorsement of law enforcement officials from different
European nations regarding the validity and importance of recognized risk indicators and
their categories, as well as their ranking for use in operational tasks, investigations, and
training. The majority of the respondents found the identified categories and risk indicators
as reliable and relevant for their operational activities and investigations. For the second
research question, the survey results prioritized categories of risk indicators that are most
suitable for the detection tactics of investigators and intelligence officers. The third
research question examined the ease of observing identified risk indicators, with the
category of technological detection/air sampling alarm risk indicators ranking as the easiest
to detect. Finally, the survey found that the identified risk indicators are useful for training
activities of security entities. Several final comments and recommendations from
participants were also discussed, emphasizing the importance of considering multiple
factors when identifying risk indicators and the value of the comprehensive list of identified
risk indicators. The publication also examines some terrorist theories, the advantages,
limitations, and the ongoing debate surrounding the use of profiling in protective security.
2
CONTENT
LIST OF ABBREVIATIONS ........................................................................................................ 7
TERMINOLOGY .......................................................................................................................... 8
INTRODUCTION ....................................................................................................................... 14
1. LITERATURE REVIEW – THEORETICAL FRAMEWORK ............................................... 17
2. METHODOLOGY .................................................................................................................. 19
2.1 Literature, case study and CCTV footages review .............................................................. 19
Table 1.1 Keywords as search criteria ...................................................................................... 20
Table 1.2 Key search digital repositories .................................................................................. 21
Table 1.3 Main journals/Publishers .......................................................................................... 21
Table 1.4 Inclusion and Exclusion criteria of systematic literature review................................ 22
Table 1.5 Key words as search criteria for case studies and CCTV records review .................. 24
Table 1.6 Key search digital repositories for case studies and CCTV records review................ 24
Table 1.7 Main journals/Publishers for case studies and CCTV records review ....................... 24
Table 1.8 Inclusion and Exclusion criteria of case studies and CCTV records review ............... 25
2.2 Survey methodology ........................................................................................................... 25
2.2.1 Research questions set up within the research project – qualitative method ............................ 26
2.2.2 Research hypothesis – quantitative method .......................................................................... 26
2.2.3 Questionnaire .................................................................................................................... 27
2.2.4 Participants ....................................................................................................................... 28
2.3 Trustworthiness of Data ..................................................................................................... 28
2.4 Ethical issues ...................................................................................................................... 29
3. RESULTS FROM SYSTEMATIC LITERATURE, CASE STUDIES AND CCTV RECORDS
REVIEW ..................................................................................................................................... 31
3.1 General findings ................................................................................................................. 31
3.2 Results from behavioural science and CBRN-E terrorism-related systematic literature
review ...................................................................................................................................... 32
Table 2.1 Systematic literature results tables............................................................................ 33
3.3 Results from specific case studies and CCTV records review .............................................. 45
4. RESULTS FROM SURVEY .................................................................................................... 47
4.1 Implementation of the survey ............................................................................................. 47
Graph 1 – Participants per country or EU agencies ................................................................. 47
Graph 2 – Sex of respondents ................................................................................................... 48
Graph 3 – Age groups .............................................................................................................. 48
Graph 4 – Years of experience in Law Enforcement and Intelligence agency ........................... 49
3
4.2 Survey Results .................................................................................................................... 49

5. DISCUSSION .......................................................................................................................... 59
6. CONCLUSION ........................................................................................................................ 70
7. RECOMMENDATIONS.......................................................................................................... 71
REFERENCES ............................................................................................................................ 72
BIBLIOGRAPHY........................................................................................................................ 87
APPENDIXES ............................................................................................................................. 89
APPENDIX A – SURVEY QUESTIONNAIRE ........................................................................ 89
APPENDIX B – Survey results Graphs .................................................................................... 93
Graph 1 – Participants per country or EU agencies ................................................................. 93
Graph 2 – Sex of respondents ................................................................................................... 94
Graph 3 – Age groups .............................................................................................................. 94
Graph 4 – Years of experience in Law Enforcement and Intelligence agency ........................... 94
Graphs 5.1 and 5.2 containing answers for every category and subcategory of risk indicators . 95
Graphs 6.1 – 6.9 containing results from Question 4.2 .............................................................. 96
Graphs No. 7.1 – 7.60 containing results from Question 5.2 – Relevancy of subcategories and
their risk indicators................................................................................................................ 100
Graphs 8.1 – 8.60 containing results from Question 5.3 – Observability and Detectability of
subcategories and their risk indicators ................................................................................... 131
Graph 9 containing results from Question 6.1 – Usefulness of risk indicators and their categories
for training............................................................................................................................. 160
APPENDIX C – Survey results Tables ................................................................................... 161
Table 3.1 Determining the relevance and reliability - Prioritisation of the risk indicators
categories based on results from question 4.2 ......................................................................... 161
categories based on results from question 5.2 ......................................................................... 161
subcategories within the first Category based on results from question 5.2 ............................ 162
subcategories within the second Category based on results from question 5.2 ........................ 162
subcategories within the third Category based on results from question 5.2 ........................... 163
subcategories within the fourth Category - based on results from question 5.2 ....................... 163
subcategories within the fifth Category based on results from question 5.2 ............................ 164
subcategories within the sixth Category based on results from question 5.2 ........................... 164
4
Table 3.9 Determining the relevance and reliability indicators - Prioritisation of the risk
indicators within the seventh Category based on results from question 5.2............................. 165
Table 3.10 Determining the relevance and reliability - Prioritisation of the risk indicators within
the eighth Category based on results from question 5.2 .......................................................... 165
Table 3.11 Determining the relevance and reliability - Prioritisation of the risk indicators within
the ninth Category based on results from question 5.2 ........................................................... 165
Table 3.12 Easy and possible to detect/observe the risk indicators - Prioritisation of the risk
indicators categories based on results from question 5.3......................................................... 166
indicators subcategories within the first Category based on results from question 5.3 ............ 167
indicators within the second Category based on results from question 5.3 .............................. 167
indicators within the third Category based on results from question 5.3 ................................ 168
indicators within the fourth Category based on results from question 5.3 .............................. 168
indicators within the fifth Category based on results from question 5.3.................................. 169
indicators within the sixth Category based on results from question 5.3 ................................. 169
indicators within the seventh Category based on results from question 5.3............................. 169
indicators within the eighth Category based on results from question 5.3............................... 170
indicators within the ninth Category based on results from question 5.3 ................................ 171
APPENDIX D – Survey Chi-square test results ...................................................................... 172
Table 4.1 Actual answers to question 5.2, sorted by age groups of respondents ...................... 172
Table 4.2 Expected answers to question 5.2, sorted by age groups of respondents .................. 172
Table 4.3 Results of chi-square test of independence, for question 5.2 .................................... 172
Table 4.4 Actual answers to question 5.3, sorted by age groups of respondents ...................... 173
Table 4.5 Expected answers to question 5.3, sorted by age groups of respondents .................. 173
Table 4.6 Results of chi-square test of independence, for question 5.3 .................................... 173
Table 4.7 Discrepancy between younger and older law enforcement and intelligence agencies´
officers ................................................................................................................................... 174
Table 4.8 Actual answers to question 5.2, sorted by work experience of respondents.............. 174
Table 4.9 Expected answers to question 5.2, sorted by work experience of respondents.......... 175
Table 4.10 Results of chi-square test of independence, for question 5.2 .................................. 175
Table 4.11 Actual answers to question 5.3, sorted by work experience of respondents ............ 175
5
Table 4.12 Expected answers to question 5.3, sorted by work experience of respondents ........ 175
Table 4.13 Results of chi-square test of independence, for question 5.3 .................................. 175
Table 4.14 The average value of relevancy/observability of risk indicator per age group ....... 176
APPENDIX E – The final list of risk indicators distributed across 9 categories ...................... 177
H.1 The final list of risk indicators distributed across 9 categories and prioritised according to
relevancy and reliability as the output from the research (subcategories average – new
prioritised order) ................................................................................................................... 177
H.2 The final list of risk indicators distributed across 9 categories and prioritised according to
detectability/observability ...................................................................................................... 187
APPENDIX F – Support letters from Law Enforcement and Intelligence agencies ................ 188
6
LIST OF ABBREVIATIONS
AI – Artificial Intelligence
CBRN – Chemical, Biological, Radioactive, Nuclear
CBRN-E - Chemical, Biological, Radioactive, Nuclear-Explosive
CEPOL - European Police College
CCTV - Closed-Circuit Television
CPNI – Centre for the Protection of National Infrastructure
CTS – Critical Terrorism Studies
EOD – Explosive Ordnance Disposal
EU – European Union
FRETS – Framework for research ethics in terrorism studies
FRONTEX - European Border and Coast Guard Agency
HM Government – His Majesty´s government
IA – Intelligence agency
IAEA – International Atomic Energy Agency
IED – Improvised Explosive Device
ISEMI – International Security and Emergency Management Institute
IT – Information Technologies
LEA – Law Enforcement Agency
NATO - North Atlantic Treaty Organization
ProPeSCO – Profiling in Protective Security and Covert Operations
TATP - Triacetone triperoxide
TERR Committee - Special Committee on Terrorism of the EU Parliament
UNICRI - United Nations Interregional Crime and Justice Research Institute
UK – United Kingdom
USA – United States of America
US JCAT – US Joint Counterterrorism Assessment Team
7
TERMINOLOGY
The most commonly recurring terms in this study are predictive profiling, behavioural
detection, profiling in protective security and covert operations, baseline, risk indicators,
and CBRN-E crime. To comprehend how these concepts are connected, it is crucial to
clarify their meaning.
Predictive profiling, Profiling in protective security and Covert operations

(Behavioural detection/analysis)
According to the literature review (Lammerant and de Hert, 2016; Meijer and Wessels.,
2019; Fernández, 2021; Feijoo-Fernández et al., 2023), the following definition can be
proposed: Predictive profiling is the practice of identifying individuals who may pose a
security threat based on certain pre-determined characteristics and behaviours. It involves
analysing patterns of behaviour with hostile intentions and personal characteristics to
predict the likelihood of an individual to commit a crime and conducting terrorist activities.
It can be conducted as a human or automated detection process using new technologies and
statistics.
Predictive profiling may be associated with Profiling in protective security and covert
operations or Behavioural detection, which involves observation and interpretation of
behaviour, appearance, use of objects, and sensory and technology alarms. As a result, it
encompasses the identification of hostile or suspicious behaviour followed by verification
through interviews or questioning (CPNI, HM Government, N.D.; Dankiewicz, 2012;
Frank et al., 2008).
To effectively assess risks, it is crucial to accurately identify and interpret risk indicators
after being observed, as well as verify their validity. Giving attention to how often and how
severe these indications are is essential. The primary screening and interview process is the
best way to confirm the existence of potential risks, and further investigation may be
required if doubts arise. In addition to analysing data from databases and alarm results from
detection devices, the behavioural detection system also involves monitoring the
environment and the movement of individuals and groups to detect risk indicators. The
entire process encompasses observation, detection, interpretation, analysis, evaluation,
classification, validation by secondary screening and interview, drawing conclusions, and
reporting (Frontex, 2018; Kolencik, November 2021).
Finally, according to many authors, profiling has various limitations and pros at the same
time and therefore it´s crucial to use it carefully and take into account human rights and
privacy.
Observational analysis
Observational analysis, a crucial component of profiling in protective security and covert

operations, involves systematically observing and studying alterations or deviations in
8
infrastructure, contextual settings, abandoned objects like suspicious bags, and chemical or
physical processes related to specific CBRN substances, such as evaporation accompanied
by a suspicious smell or dispersion in the air associated with a specific noise. Additionally,
it involves observing individuals or groups in connection to their appearance, use of certain
items to discern patterns, behaviours, or activities indicative of criminal conduct.
Observation may also extend to health symptoms, serving not only as indicators of a CBRN
event but potentially revealing criminal activity associated with the handling of CBRN
materials even in the absence of a specific event. For instance, if an individual has been
illicitly working with highly toxic chemicals without proper protection in a clandestine lab
for a potential attack, the effects of this substance on the body, observed when the person
is questioned by law enforcement or during travel, could serve as a risk indicator. Similarly,
the presence of radiation burns on an individual's skin may suggest contact with
radionuclides while preparing for a criminal act. Combining these symptoms with other
risk indicators necessitates appropriate actions.
The observational analysis incorporates visual, acoustic, olfactory, and tactile observation
(Kolencik, 2021; Dahl, 1952). Law enforcement, security personnel, and researchers
frequently utilize observational analysis to heighten situational awareness and identify
potential threats or criminal behaviour based on observed patterns or deviations from
established baselines. According to Bonnemain et al. (2015), there are two types of
observation. The first, "direct observation," involves directly perceiving the object. The
second, "indirect observation," pertains to phenomena that are not immediately observable
but allow for the inference of certain aspects. However, the observational analysis, though
susceptible to personal bias, must be conducted in a professional manner (Spano, 2005)
and it has to include the knowledge and skills in the respective subject matter.
Baseline concept and suspicious behaviour
Understanding behaviour considered suspicious requires an understanding of general

human behaviour, especially within its specific context – base line. As discussed by Wiliem
et al. (2012), the research on non-verbal behaviour underscores the difficulty of interpreting
human actions without considering the surrounding circumstances as mentioned above in
connection to base line. Behaviour that might be seen as suspicious in one context could
be entirely normal in another.
For instance, regularly checking the watches and backpack, looking at the information
screen for the last train departure of the day, and nervously walking from one side to
another at the railway station in the late night might be normal when a train is significantly
delayed and the person is in a hurry but could be deemed anomalous when the last train is
scheduled on time. Consequently, the notion of normal behavior needs to adapt over time
to accurately represent the current context. Moreover, the variability in normal behavior
across different contexts, combined with the impracticality of having a dataset covering all
potential human behaviours, adds complexity to the task.
9
In the first phase of this research, the study of the baseline concept was carried out. It
concerned the places where terrorist or other criminal acts were conducted and in certain
cases the individual or people’s behaviour. As there is a very limited number of reliable
sources providing the definition of the baseline concept, it is possible to suggest the
following definition according to the results of this study and using the general description
of the baseline by Zurich State Police, Research and Development Unit (Frontex, 2018),
Davis et al. (2013) and United States Marine Corps (N.D.):
The baseline can be characterized as a certain social, economic, climatic, seasonal, cultural
and religious norm generally used and accepted in a given place, in a given country, region
or continent. Suspicious behaviour cannot be defined without a valid frame of reference.
Hence, it is strategic to consider the dynamics of processes in a given situation, in a given
space and time.
Main Baseline (BL) categories identified in the case studies and CCTV records review:
I. Constant BL can be defined as a common unchanging reference that has a long-term

character and is based on the climatic, cultural, religious and socio-economic standards of
the given society and the infrastructure of the given object in which profiling techniques –
behavioural detection are used.
II. Flexible or Event BL may represent a specific norm related to an event or activity – for
example, international sports games at a specific location with specific infrastructural
characteristics, where the baseline is, for example, the travel of a large number of sports
fans from different countries using national flags, clothing, and travel of sports teams as
well dressed in national colours.
III. Individual or group BL may be characterised as the normal behaviour of a specific

person or group of persons in a normal non-crisis situation, which corresponds to the
political, climatic, cultural, religious, economic and social norms of the country from which
the person or group of persons comes. Individual baseline is also important in terms of
verbal communication when a person is interviewed or questioned for example during the
screening at the airport.
Specific categories that may be related to one, two or all three main categories. They can
be also interconnected:
1. Political, geographical, cultural and religious context. Example of the baseline: People
in Muslim countries wear specific Muslim clothes, use specific perfumes and go to the
mosque during prayers, mainly on Fridays. People in Christian countries wear crosses as
necklaces, etc. and go to churches on Sundays. Example of the risk indicator: A person
typically looking for a foreigner going to the mosque in non-Muslim clothes with a big
backpack. Is the person a tourist and why would the tourist enter the mosque with a
backpack at the time of prayer full of people?
10
2. Social-economic context. Baseline Example: Well-dressed people in a central very

expensive shopping mall in a developing country. Risk indicator: A person dressed in torn
clothes with a worn-out plastic bag in the hand entering the expensive shopping mall. To
establish the baseline specific to the region or country, it´s important to ask several
questions. Is it usual in this country, region, or area for people from lower social classes to
enter the expensive shopping mall? Is there some ongoing reconstruction or reparation
work where some workers from lower social classes can be present?
3. Transportation context. Baseline example: Driving a car on the allowed road and place
in a normal manner. Potential risk indicator: Suspicious speed of the car in certain places,
where cars normally drive slowly. Other questions when establishing base line can be
asked: Are there regularly some trucks parking in front of the border crossing point? Is it
within the local norm? Another Baseline example: Taking the subway once from point A
to point B to reach the target place. Potential risk indicator: Taking the subway several
times from one place to another one in a non-logical way or repetitively travelling between
two places.
4. Buildings and infrastructure context. Baseline Example: Presence of CCTVs. People

do not observe CCTVs repetitively. Potential risk indicators: Reconnaissance of a place of
CCTVs, exits, and an air-conditioning system for spreading CBRN agents. When
establishing the baseline, the set of questions have to be answered: e.g.: Is there some
construction work outside the building? Were they planned in advance? Do we have that
information? Is it within the local norm?
5. Items-behaviour-related. Baseline Example: Using a backpack in a routing way like a

basic traveller and not having the sharp objects in hand. Risk indicators: Sharp objects in
the hand, putting backpacks on the floor and leaving the place, monitoring the mobile
phone repetitively, putting some suspicious object on the floor, having a gas mask on the
face, etc.
6. Meteorological seasons, dressing and appearance context. Baseline Example: Wearing

clothes fitting the local weather conditions. Potential risk indicator: Wearing a winter jacket
during hot summertime.
7. Physical and chemical manifestation of substances/objects. Baseline Example: Drink in

an open bottle of mineral water without a specific odour. Potential risk indicator: A person
opens a bottle of mineral water and the liquid smells like a rotted egg potentially
representing a chemical warfare agent.
8. Data mining context. Baseline Example: According to data mining in relevant databases
from country A, there is no recent record of the pandemic spread of certain diseases.
Potential risk indicator: All passengers arriving on the plane from country A show serious
symptoms before landing indicating potential contamination with biological or chemical
agents.
11
8. General behavioural aspects
7.1 Baseline of individuals ‘behaviour linked to their travel, profession or free time
activities, like using some services, buying tickets, arriving at the airport, waiting, eating
and drinking, having a phone call, doing a sport, etc.
7.2 Group behaviour and interaction Baseline linked to their travel, profession or free time
activities, like walking, running, waiting, watching the watches, calling, discussing and
interacting with others, etc.
7.3 other
Risk indicators, Warning signs or Alert triggers
Anything that falls outside of the aforementioned baseline can be classified as a risk
anomaly or deviation from the norm, i.e., the expected behaviour given a particular context
or circumstance. When detecting risk indicators, it is important to consider excessiveness
and the repetitive manifestation of risk indicators (Brewer et al. 2018, Frontex, 2018). At
the same time, it is necessary to consider that a single risk indicator may not represent
suspicious or criminal behaviour. Many of the listed risk indicators can represent a person’s
normal behaviour due to some stress, illnesses or other individual factors if they are not
associated with other detected risk indicators (Feijoo-Fernández et al., 2023).
In the analysed criminal acts within this research, it was always a combination of risk
indicators that made up a mosaic of observed deviations from the baseline. Some of the
indicators may contain discriminatory elements from the first observation, however, they
must be considered in the frame of above mentioned “mosaic” when performing non-
discriminatory and non-racist profiling – observation and interpretation of risk indicators.
According to this research results, the risk indicator is a separate attribute or set of features
of behaviour and communication, insider threat signs, hostile activities, modus operandi,
various elements of suspicious travel, movement to specific places, radicalisation symbols,
physiological manifestations and symptoms, appearance and related context, use of certain
items/objects, digital indicators, detection technologies alarms, data mining results,
suspicious sounds and odours of various substances, clothes and items. Risk indicators
simply indicate a deviation from an existing norm in a given time and space, taking into
account the dynamics of processes.
CBRN-E crime
Crimes involving chemical, biological, radioactive, nuclear and explosive substances are
often considered an act of terrorism, however, this topic has a broader dimension that is
widely ignored. Chemical, biological, radioactive, nuclear, and explosive materials can be
exploited to cause harm to public security, environment, health, fauna, flora, property,
agricultural activities, and economy in various CBRN-E crimes, like illicit trafficking of
12
hazardous material, illicit production and public threatening, environmental crime, etc.
(Kolencik, June 2021). According to Kolencik, (June 2021) The term CBRN-E crime refers
to the intentional or unintentional commission of a crime involving hazardous materials
that pose a threat to public safety, security, health, life, nation, state, humanity, peace,
international regulations, environment, property, and the economy. These offences fall
under the relevant category of crimes outlined in the criminal or similar laws of a specific
country. Additionally, in specific crimes, CBRN materials may be dispersed using
explosives, and thus, the abbreviation "CBRN" is expanded to include the letter "E" for
explosives.
13
INTRODUCTION
Terrorist attacks utilizing explosives and CBRN materials have been a persistent threat
throughout history (Binder and Ackerman, 2021; Quillen, 2002). Presently, the trends in
terrorism in this domain are evolving due to advancements in technology and geopolitical
changes (Koehler et al., 2020; Asal et al., 2023).
Recent years have demonstrated that preparations for terrorist attacks utilizing CBRN-E
can be quantified in the hundreds or that attacks already carried out are in a similar number.
Based on the analysis of Tin et al. (2022), from 1970 to 2019, Western Europe witnessed
15,306 terrorist attacks which is 9.11% of global terrorism incidents. 8,103 attacks were
carried out using explosives as the main weapon, with 3,050 incidents involving incendiary
attacks and 2,955 incidents using firearms as the weapon of choice. CBRN weapons were
used in only 47 events. When compared to worldwide patterns, Western Europe exhibited
comparable usage of explosives, however, the usage of firearms was minimal and the
employment of CBRN was uncommon. Among Western European countries, the UK,
Spain, and France experienced the greatest frequency of terrorist attacks and fatalities.
According to Binder and Ackerman (2021), the POICN Database documented a total of
517 instances in which CBRN pursuit was involved from 1990 to 2017, with 224 of them
resulting in actual use. As we can see in the above Tin et al. (2022) study, explosive attacks
without CBRN material are still dominating.
Though the frequency of CBRN terrorist attacks is relatively low compared to those with
other types of weapons, it is crucial to treat the efforts of both terrorist organizations and
individuals with appropriate gravity in order to avert catastrophic consequences.
After the devastating terrorist act of September 11, 2001, nations around the world faced
the stark reality that traditional methods of combating terrorism were insufficient
(Haggerty et al, 2005). To enhance national security and thwart potential terrorist threats,
governmental security forces turned to predictive profiling, a controversial technique
aimed at identifying and pre-empting potential terrorists based on specific behavioural
patterns, appearance, demographic traits, and other indicators (Wigginton et al., 2014).
While proponents argue that it offers an essential advantage in countering terrorism, critics
raise concerns about efficiency, civil liberties and ethical implications (Frank et al., 2008;
Committee on Science, Space, and Technology House of Representatives, 2011, pp. 70,
72; Dankiewicz, 2012; Van der Auwera et al, 2018; Susser, 2021; Satish et al., 2023). Other
critics like Granhag and Mac Giolla (2014), Parasuraman et al. (2009) and Blandón-Gitlin
et al. (2014) also argue that behaviour detection techniques are fraught with issues and
limitations. They question the scientific validity and reliability of these methods,
suggesting that they can be influenced by biases and subjective judgments. Critics also
express concerns about potential violations of privacy rights, as behaviour detection often
involves close monitoring and profiling of individuals based on subjective assessments.
Wigginton et al. (2014) further state, that while behavioural analysis has shown some
promise in identifying potential terror threats, it is not a perfect solution. It is important to
14
take into account both the benefits and drawbacks of behavioural analysis when
considering its use in aviation security. Ultimately, the effectiveness of this approach must
be evaluated based on empirical evidence and in light of the potential risks and costs
involved.
On the other hand, as Cavusoglu and Kwark (2013) argue, according to their work, the
effectiveness of predictive profiling has been proven when the results of the screening
process using screening machines were combined with profiling techniques. Similar results
may be obtained when combining profiling with bomb-sniffing dogs (Roberts, 2016).
Another recent study also pointed out the effectiveness of the Behaviour Analysis units of
Guardia Civil in Spain when analysing travellers' behaviour, especially in identifying high-
risk situations (Fernández, 2021). Feijoo-Fernández et al. (2023) suggest that while
behaviour detection techniques have their limitations, they can play a crucial role in
enhancing airport security if implemented appropriately. Probing interactions and
observing suspicious behaviour can enable security personnel to intervene before a
potential threat escalates. Striking a balance between effective detection and protection of
individual rights requires ongoing refinement of training programs, integration of advanced
technologies, and transparent communication with the public on the purpose and
methodology of behaviour detection approaches. This holistic approach can contribute to
increased knowledge and insight into the importance of addressing anomalous behaviour
in airports while maintaining respect for fundamental rights and liberties.
Furthermore, history has shown that terrorist attacks using explosives or CBRN material
independently have forced relevant security forces to focus mainly on transportation
(Satish et al., 2023). For example, Georgia, following the Tbilisi airport attack using Yperit,
has started to enhance new CBRN security measures, including the training of different
security forces (Kolencik, June 2021). Additionally, countries such as the USA (Rudner,
2015), UK (Maguire, 2014), Canada (Émond, 2011), France (Iserte, 2008), Belgium (Van
der Auwera et al., 2018; Boelaert et al., 2021), and other EU countries (Rudner, 2015) have
begun to create new programs to detect possible terrorists and potential threats, especially
at airports, border crossing points, and public transport.
Following on from the previous paragraphs, CBRN and explosive terrorist acts are more
and more considered to be a significant threat to national and international security in all
areas of public life (European Parliament – TERR Committee, 2018; Walsh, 2021). These
types of attacks can cause mass casualties, psychological trauma, and social and economic
instability (Ackerman, 2018). It is, therefore, necessary to address vulnerabilities, enhance
preparedness, and foster international cooperation, highlighting the complexity, deterrent
effect, societal impact, and emerging technologies associated with CBRN-E terrorism (Tin
et al., 2021). Acknowledging these insights, governments, agencies, and civil society
should remain more vigilant than ever to combat such potential threats and safeguard
innocent lives. In this context, identifying warning signs that indicate criminal behaviour
is crucial for preventing planned crimes or terrorist attacks. This is particularly important
when crossing borders or initiating an attack in public areas or critical infrastructure
15
(Kolencik, 2021). Law enforcement and intelligence agencies have their own methods for
detecting signs or behaviours that indicate potential radicalization or deviation from the
norm, suggesting a possible malicious act against people or infrastructure (Segell, 2006;
Kreissl et al. 2014; Dando and Bull, 2018, Kolencik, 2018).
However, after examining the literature and internal procedures of several police agencies
based on the ISEM Institute archive, it is clear that there is a need for more precise coverage
of potential risk indicators related to CBRN and explosive crimes. It is important to
highlight, that terrorist attacks involving explosives and CBRN materials are assessed in
this work from three distinct categories: either as standalone attacks that use only
explosives, standalone attacks that utilize CBRN materials, or the dispersion of CBRN
materials onto a target using explosives. Therefore, this research aimed to examine and
scrutinize possible warning signs associated with planning and conducting terrorist attacks
using CBRN and explosive materials by analysing past cases from Europe, USA, Australia
and Asia and plausible real-life situations. It comprises, as well the indicators of
appearance, physiological warning signs, suspicious behaviour and item usage, digital
indicators, symptoms indicating the poisoning, illness or radiation exposure and
technological risk indicators that may occur prior to or during an attack and may be detected
within predictive profiling or profiling in protective security and covert operations.
Additionally, the project also included an analysis of previous case studies, using records
such as CCTV footage, court decisions, and police reports, to identify observed risk
indicators. Terminology part offers definitions of these concepts derived from literature
and examinations of CCTV footage, to attain a distinct comprehension of the research
findings.
Despite the fact, that the survey was implemented only on the European continent, the
information gathered through this research may serve the purpose of reinforcing global
policing in fighting terrorism while identifying possible risk indicators. It can also help in
determining how behavioural and observational analysis can be used in detecting such
crimes and may serve as the basis for further research.
16
1. LITERATURE REVIEW – THEORETICAL

FRAMEWORK
This research utilised the theories of terrorism, comprising key theories discussed by Haner
and Sloan (2021) that addressee terrorism background, encompassing the aspects of how
individuals become terrorists, their experiences as terrorists when planning (Shea and
Gottron, 2004) or conducting an attack, and the process of disengaging from terrorism.
Criminal acts are often carried out by individuals or organizations who seek to advance
their political, religious or ideological goals by engaging in acts of violence when
experiencing terrorist engagement (Stelmach, 2017). Their behaviour can be divided into
two main directions, namely behaviour directed to the spiral of becoming a terrorist, where
we have to differentiate between ideological and behavioural radicalisation to violence
(Williams, 2019) and operational terrorist behaviour (Nance, 2014). One of the important
contributions to lone wolves’ digital behaviour assessment in connection with
radicalisation indicators is the work of Brynielsson et al. (2013). Although these types of
indicators lead to radicalisation to violence, they were not a primary focus of this study.
Behaviour leading to turn out a terrorist is among other factors associated with their
motives and motivations (Abrahms, 2008; Helmus, 2009; Newsome et al., 2017) as a
process of radicalisation (Silke and Brown, 2016). Behaviour connected to modus operandi
when planning and conducting the act of terrorism is associated with certain specific
patterns that might be detected by security forces under certain conditions (Nance, 2014;
Joint Chiefs of Staff, 2010). Some studies pointed out, that terrorism and terrorist behaviour
are aimed to instil fear in the population and to gain attention for their cause (Garrison,
2004), which can raise many questions related to both above directions. However, Kurtulus
(2017) argues, these conclusions are not fully supported by practical examples. In his work,
he demonstrates based on case studies, that among the main aims of terrorist organisations
are avenging their friends or the liquidation of their supposed adversaries in line with their
ideology. Ultimately, for this research, the second type of behaviour which can be detected
through predictive profiling or behavioural detection is of utmost importance. As Santifort
et al. (2013) and McCann (2023) discussed in their studies, terrorist behaviour can take
many forms such as bombings, assassinations, hijacking and other forms of violent attacks
including the use of CBRN and explosive materials. Risk indicators can therefore vary
based on the goals and selected modus operandi, and this is especially important during the
systematic review of literature and analysis of CCTV records.
Violence as such, as well as a criminal activity associated with terrorism, have been
assessed from the perspective of several scientific disciplines, comprising behavioural
science, sociology, criminology and psychology (Leistedt, 2013; Freilich & LaFree, 2015).
Terrorist theories, as already mentioned, in general often deal with the philosophy of
terrorist organizations, the reasons for their membership, the method of selecting targets,
the modus operandi, the categories of terrorist organizations and their ways of functioning
(Alexander, 2019). One of the widely used theories is the socio-economic theory, which
17
suggests that individuals who belong to a certain socio-economic class are more likely to
engage in terrorist activities. As per this theory, conditions that encourage radicalization
and extremism are created by poverty, joblessness, and inadequate schooling (Lia and
Skjølberg, 2004; Krieger and Meierrieks, 2011). Freytag et al. (2011) also confirm that the
socio-economic conditions of individuals' lives must not be underestimated when assessing
terrorist involvement and behaviour. A similar approach is discussed in the more recent
study by Sun et al. (2022). They confirm that socio-economic disparities influence
terrorism and the main factors that contribute to terrorism are the legitimacy of the state,
the fragmentation of elites, population growth, and the allocation of resources towards
healthcare and education. A similar approach is advocated by Ljujic et al. (2020). They
conclude that addressing socio-economic inequality and providing avenues for
marginalized populations to engage in constructive forms of activism may reduce the threat
of terrorism in the Netherlands.
However, Frank and Pavlovic (2023) in their recent study argue, that socio-political
inequalities are more connected to radicalisation behaviour than economic inequality. The
motives or origin of terrorist behaviour are also covered in social control, anomie/strain or
social disorganization theories or from biological and psychological perspectives (Agnew,
2016; Freilich & LaFree, 2017; O’Connor, 2018). Criminology theories provide valuable
insights into the factors that influence and motivate terrorist behaviour, which may also be
partially connected to developing the right methodology for risk indicators detection within
the radicalisation process. The radicalisation process can already include criminal activity
leading to terrorism (Decker and Pyrooz, 2011) which should be detected in behavioural
detection. In this way, terrorist criminology underscores the need for a collaborative
approach that involves law enforcement, intelligence agencies, and government officials to
address this persistent and complex problem (LaFree and Freilich, 2017). Gunning (2009)
suggests that incorporating social movement theory into the study of terrorism allows for
a more comprehensive analysis of its causes and dynamics. By examining the grievances,
mobilization strategies, and framing processes associated with terrorist activities,
policymakers can gain valuable insights to better address and mitigate the root causes of
terrorism. Gunning (2009) also advocates for a nuanced approach that considers both the
distinctiveness of terrorism and the shared characteristics it exhibits with social
movements, providing a foundation for advancing knowledge and understanding in
counterterrorism efforts.
However, the systematic literature review in this study did not identify any research on the
above theories discussing terrorist behavioural patterns while planning and conducting the
act of CBRN-E terrorism in connection to their motives and beliefs, which could be an
interesting topic for future research.
18
2. METHODOLOGY
To achieve the research goals stated above, it was necessary to set up the right
methodology. A combination of quantitative and qualitative type of research was selected
due to the specificity of the participants and of the research questions where standardized
methods and questionnaires would not work. Heesen et al. (2019) and Merteens (2010)
support the idea that employing a variety of methodologies can enhance the pursuit of truth.
Although both methods were used, the primary choice was to adopt the qualitative
approach. Creswell et al., (2007) note that qualitative research can be particularly useful in
situations where researchers need to understand a phenomenon in-depth or when
standardized measures and surveys may fail to capture the complexity of a subject.
Qualitative research is a diverse field of research approaches that concentrate on the actions
and social interactions of people, as well as their individual experiences, even though they
may not produce quantifiable results (Fossey, et al., 2002).
McNeil-Willson (2021) discusses the challenges that researchers face in studying terrorism
and critical terrorism studies (CTS) due to the sensitivity of the subject and the bias that
exists in the research. Furthermore, McNeil-Willson highlights the need for a critical
analysis of the problems related to data collection, interpretation, and presentation of
research findings. It argues that data related to terrorism can be problematic due to various
reasons such as the limited access to reliable sources, the politicization of the issue, and the
challenges linked to analysing covert operations. Despite all challenges, the author sends
the key message to researchers, not to shy away from researching terrorism, but rather to
be prepared to navigate the complexities of the subject area carefully.
To achieve success in this study, it was vital to comprehend the circumstances surrounding
terrorism and the varying methods in which it is explained and debated within diverse
political and cultural settings.
This research involved three main steps. The systematic literature review was carried out
in the first stage using online sources. The case studies were carried out at the premises of
ISEM Institute using their internal sources like analytical documents, closed prosecution
files, court decisions and CCTV footage from the law enforcement sector and online
videos. Finally, the survey with the participation of law enforcement officers from 12
countries and 2 EU agencies was implemented online using a secure and password-
protected link in the ISEMI SIENA X IT tool.
2.1 Literature, case study and CCTV footages review
Conducting a systematic literature review requires a well-structured methodology to ensure

accuracy, rigour, and credibility (Bryman, 2016). A thorough and comprehensive search,
combined with critical analysis and transparent reporting, can add value to a research study
and provide insights into gaps in the current body of knowledge (Islam and Aldaihani,
2022; Adler, 2022).
19
2.1.1 Search criteria in the systematic literature review
The search criteria were set up from the beginning to identify articles that can help in
establishing the list of risk indicators.
The search yielded three different categories of resources. The first involves research
articles accessed through the Essex University Library, Google Scholar, Microsoft
Academic, Semantic Scholar, Science Direct, Base and Science.gov and include
publications listed on Scopus and/or Web of Science. The research was carried out mainly
within Security, Counter-terrorism, Criminology, Psychology, Criminal psychology,
Behavioural analysis and detection and CBRN journals. The second category encompasses
a variety of documents, such as white papers, legal documents, publications, and
documents not present online like FRONTEX guidelines. However, only those sourced
from credible and trustworthy sources were used. Some very specific articles without
scientific verification were exceptionally also used from Research Gate. Any others were
disregarded. Finally, the third category comprises conference papers that were located and
then evaluated based on their quality and pertinence. 126 articles and papers were identified
and 103 of them were selected for review as they were more related to the research topic
after reading the summary. Keywords for search criteria, key search digital repositories,
main journals and publishers, likewise inclusion and exclusion criteria of the systematic
literature review are provided in Tables 1.1, 1.2, 1.3 and 1.4. Exclusion and Inclusion
criteria obviously contain the language, dates, countries and other parameters; however,
they were not deployed in the article search due to the specificity of the topic.
Systematic literature review methodology tables
Search criteria in the systematic literature review
Table 1.1 Keywords as search criteria

Keywords used in the literature search
Predictive profiling
Profiling in protective security
Behavioral detection (US)
Behavioural detection (UK)
Detection of suspicious behaviour
Detection of risk indicators
Detection of crime risk indicators
Detection of terrorist risk indicators involving CBRN and explosive material
Observation of suspicious activity
Factor influencing sensory observation
Aviation security
Airport security
Border security
Mass event security
Soft target security
20
Insider threat indicators

Risk indicators of terrorist attack
Warning signs of terrorist attack
CBRN risk indicators
Risk indicators related to explosive material
Radicalisation risk indicators
CBRN and explosive threats
Profiling + risk indicators
Profiling + security
Profiling + terrorism
Profiling + CBRN
Profiling + explosives
Behavioral analysis + risk indicators
Behavioural analysis + risk indicators
Detection and investigation of CBRN crime
Passengers + screening
Terrorist + profiling
CBRN agents + symptoms
Symptoms + biological toxins
Symptoms + biological pathogens
Symptoms + chemical warfare agents
Symptoms + acute irradiation
Suspicious sounds
Suspicious odours
Suspicious smell
Odours of chemical agents
Suspicious items
Suspicious objects analysis
Table 1.2 Key search digital repositories

Repositories
JSTOR
Routledge
Springer
Taylor and Francis
IEEE
Elsevier
National library of Medicine
Table 1.3 Main journals/Publishers

Journals/Publishers
Rand Corporation
Journal of Air Transport Management
Criminal Justice Studies
Journal of Applied Security Research
Terrorism and political violence
21
Journal of Peace Research

Journal of Risk Research
Behavioral Sciences & the Law
Journal of Policing, Intelligence and Counter Terrorism
The British Journal of Criminology
Counter-Terrorist Trends and Analyses
Journal of Pharmacy & Bioallied Sciences
National Defence Information Center
Security journal
International Security Journal
Journal of Applied Security Research
Journal of Operational Research and Society
Surveillance in Europe
Terrorism and political violence
Journal for Deradicalization
Cultures & conflits
International Journal of Intelligence and Counterintelligence
American Psychologist
Journal of Transportation Security
Social science for counterterrorism
Perspectives on Terrorism
Forensic science international
Table 1.4 Inclusion and Exclusion criteria of systematic literature review

Inclusion criteria Exclusion criteria
Experimental and theoretical articles Low-quality articles from
from relevant sources in the field of unverified sources
behavioural science, security,
terrorism, criminology, psychology and
medicine
Papers related to terrorist cases Articles from newspapers
involving CBRN and explosive
materials
Papers related to threat assessment and Papers related to risk indicators
risk indicators of criminal behaviour of suspicious non-criminal
behaviour
Articles from governmental portals Research gate, not peer-
demonstrating practitioners' experience reviewed articles (with some
exceptions on topics that are not
covered anywhere else)
22
2.1.2 Search criteria for case studies and CCTV records
A case studies search strategy was created on the principle of selecting terrorist attacks and
serious crimes involving CBRN and explosive materials around the world that appeared
often in media and discussed at international conferences where ISEMI participated.
Therefore 25 articles and papers were identified according to previous criteria and 20 of
them were selected for review because they included explosives and CBRN material
without involving other types of weapons. The 5 remaining articles mostly involved other
types of attacks. As mentioned, the selected cases based on the literature were also
supported by internal analytical documents (closed prosecution files, court decisions) and
CCTV records from different security forces as part of the ISEM Institute internal archive.
Keywords for search criteria, key search digital repositories, main journals and publishers,
likewise inclusion and exclusion criteria of case studies and CCTV records review are
provided in Tables 1.5, 1.6, 1.7 and 1.8. Exclusion and Inclusion criteria obviously contain
the language, dates, countries and other parameters; however, they were not deployed in
the article search due to the specificity of the topic.
Since the research topic mainly concerns terrorism and the illegal use of CBRN and
explosive materials, the systematic literature review did not take into account other types
of crime. Furthermore, case studies only included CBRN and explosive incidents, although
some risk indications may be similar to other types of terrorist attacks – such as utilizing
cold weapons, like knives or vehicles. This is because other risk indicators are already
widely covered in police guidebooks, contrary to suspicious behaviour and other warning
signs linked to explosive substances and CBRN.
Case studies from the systematic literature review contained only limited data or risk
indicators. Therefore, in most of the cases described in the next chapter, it was necessary
to study non-public documents and CCTV records available in the internal archive of the
ISEM Institute.
The video analysis involved an initial viewing of the CCTV footage to make main notes of
first impressions. The video was then divided into sequences, and each sequence was
viewed multiple times. In the first stage, the baseline was created. Subsequently, the
behavior of individuals and groups of people, especially known perpetrators of criminal
offenses, was observed, including their manipulation with various objects and
communication with others. Multiple observed behavioural patterns were compared to the
baseline. Finally, the most relevant risk indicators were generated that could be included
in the list of operational work for security forces during the observation and detection of
suspicious behaviour and objects. Many of the indicators were compared to those identified
during the systematic literature review and then sorted. The video recording was analysed
again, and the list of risk indicators that were most recently evaluated was available while
watching it. The methodology of analysing the video sequences was purposely decided for
this research based on the work of Piza, et al, 2014 and Ferenbok and Clement, 2012 and
analytical work employed by ISEM Institute.
23
Video analysis was not carried out on existing technological platforms, such as Quasi-3D,
because they primarily analyse real-time events and it would not be possible to insert the
monitored parameter required by us into them. Quasi-3D network, as stated by the authors
(Jan and Khan, 2023) has the potential to be a key tool in identifying suspicious events in
the future. The study's findings suggest that in terms of efficiency, accuracy and robustness,
the suggested network surpasses current techniques.
Search criteria for case studies and CCTV records

Table 1.5 Key words as search criteria for case studies and CCTV records review
Keywords used in the literature search
CBRN terrorist cases
CBRN crime
CBRN-E threats
Explosive crime
Attack + explosives
Bombing
Terrorist incidents involving explosives
Table 1.6 Key search digital repositories for case studies and CCTV records review
Repositories
JSTOR
Routledge
Springer
Taylor and Francis
IEEE
Elsevier
National Library of Medicine
Table 1.7 Main journals/Publishers for case studies and CCTV records review
Journals/Publishers
Psychological medicine
Columbia University Press
Intelligence and National Security
Rand Corporation
Homeland security affairs
Behavioral Sciences & the Law
Journal of Policing, Intelligence and Counter Terrorism
CTC Sentinel
Science diplomacy
Defense & Security Analysis
Presses de Sciences Po
Courrier hebdomadaire du CRISP
Leeds Beckett Repository
24
The British Journal of Criminology

Counter-Terrorist Trends and Analyses
Yuridika
Scripta medica
Archives of toxicology
Table 1.8 Inclusion and Exclusion criteria of case studies and CCTV records review
Inclusion criteria Exclusion criteria
Scientific papers and practitioners' Papers on terrorist attacks
articles on terrorist attacks using where other tools like guns,
explosives cold weapons, etc. were
involved
Scientific papers and practitioners'
articles on terrorist attacks and crime
using CBRN material
Other articles from governmental or
NGO sources related to CBRN terrorist
cases
2.2 Survey methodology
The survey was planned to be carried out among practitioners from LEAs and IAs in
different European countries through the ISEMI network based on the previous
engagement through the letters of support provided in Appendix F. Law enforcement and
intelligence agencies from twelve countries that have experienced terrorist attacks
involving explosives, CBRN terrorist plots or attacks and CBRN crime – United Kingdom,
Finland, France, Germany, Belgium, Portugal, Luxembourg, Czech Republic, Slovakia,
Estonia, Georgia and Bosnia and Hercegovina provided the letters of support. Two
European Union agencies, Frontex and Cepol also participated in the research. ISEM
Institute also provided a letter certifying the study facilitation.
Participants were requested to express their views regarding the categories, subcategories,
and risk indicators included in the list according to their expertise and knowledge.
The survey has focused on determining the relevance and priority of indicators based on
their importance. The appropriate questionnaire was developed and disseminated online
within the ISEMI SIENA X IT Tool. The anonymous way of collecting data was ensured
and all ethical aspects were incorporated from the beginning. The ISEM Institute was
involved in the research as a facilitator between the researcher and Law enforcement and
Intelligence agencies. The research activities included certain confidential documents, but
they were conducted within the ISEM Institute, which has the necessary clearance for
25
handling EU/NATO secrets. Although the study is sensitive, it is not classified and can be
integrated into academic papers.
The chosen research method is designed to remove any prejudices that can affect the
researcher during the initial stages, namely systematic literature review and case study
review. As a result, obtaining feedback from other professionals working in law
enforcement and intelligence agencies can aid in evaluating the relevancy of the identified
risk indicators in detecting CBRN and explosive-related crimes. The Chi-Square test of
independence was employed in the conclusion to ascertain whether there exists a
noteworthy correlation between the respondents' age and years of work experience, and
their assessment results of the reliability, relevance, and observability/detectability of
identified risk indicators. It was calculated in an Excel program and consequently, all
graphs and tables were developed.
2.2.1 Research questions set up within the research project – qualitative method
Are identified categories and risk indicators in literature and case studies reviews reliable
and relevant for the operational activities and investigation of the crime involving CBRN
and explosive materials?
Which identified risk indicators and categories are the most reliable and relevant to be
included in the detection tactics of investigators and operatives’ officers in the phase of an
imminent terrorist act?
Are identified risk indicators in literature and case studies reviews useful for the training
activities?
Hypotheses are not relevant to the qualitative study. However, based on the literature and
case studies review, despite the low number of responders in the qualitative survey, some
hypotheses have been created in connection to research questions as a part of quantitative
approach.
2.2.2 Research hypothesis – quantitative method
H1.0: There is no relation between age group and decision-making.

H1.1: There is a relation between age group and decision-making.
H2.0: There is no relation between the work experience of respondents and decision-
making.
H2.1: There is a relation between the work experience of respondents and decision-
making.
26
The study employed Chi-Square tests of independence to analyze responses to questions

5.2 and 5.3 based on both age groups and work experience of respondents. The goal was
to explore potential correlations between these demographic factors and respondents' views
on the relevance and observability of risk indicators. Hypotheses were formulated for each
test, with the alpha significance level set at 0.05 and 16 degrees of freedom. The critical
value for rejecting the null hypothesis was determined as 26.2962276. The results of both
tests are presented in the accompanying tables within the Appendix D.
2.2.3 Questionnaire
It was not possible to find relevant questionnaire examples in databases like PsycInfo and
PsycArticles for this specific survey, and therefore independent research methods were
necessary. Thus, the questionnaire was created based on the work of Creswell et al. (2007)
after completing the initial two steps and using data gathered from systematic reviews and
case studies.
The output from the first and second phases of the research is a list of risk indicators
categorized into nine categories. The primary intention in preparing the research project
was to compile two main categories, one describing the indicators for planning a terrorist
attack using CBRN and explosives, and the other for implementing the attack. Ultimately
this plan was abandoned because a large number of common risk indicators were identified
in both cases during CCTV video analysis and case study review.
Consequently, a list of risk indicators was created together with categories and
subcategories that have to be considered mutually between themselves and not separately
to avoid bias, discrimination and unprofessionalism. The risk indicators of excessiveness
and repetitiveness (Brewer et al. 2018) in certain baseline contexts have to be also taken
into account. All risk indicators and categories were included in the first part of the
questionnaire for review by practitioners.
The questions relate to the main research queries and involve risk indicators and crime
categories related to CBRN and explosive materials, taking into account the participants'
professional experience. The developed questionnaire was a convenient method for
gathering feedback on the list of risk indicators and their categories. It also ensured
anonymity, as no personal information was collected aside from the participant's role in the
police agency and country of origin. This method was considered the most practical and
achievable.
The survey questionnaire included informed consent as a crucial aspect in its introductory
section to ensure that participants were aware of the study's purpose before taking part, and
it maintained anonymity and Participants Information Sheet, Participants Debrief Sheet and
Risk Assessment (Appendix A). Any personal data were collected during the research.
27
2.2.4 Participants
The study has focused on investigators of terrorist acts and serious crimes, counter-
terrorism and organized crime analysts, operatives, and border guards from various
European countries who have basic or advanced knowledge in the CBRN/EOD field. The
survey was expected to involve at least 11 European countries due to ISEM Institute's
active network. The police and intelligence agencies were supposed to require their officers
to complete the questionnaires, and the active internet link was also sent to other EU
agencies working in the security field. Participants did not receive any financial
compensation for their participation as they attend to their professional duties and their
organizations cooperate with ISEMI in accordance with their letter of endorsement.
The survey's participants were selected by estimating the number of investigators, analysts,
and operatives from 11 countries who work in counter-terrorism and have knowledge of
CBRN and EOD based on available information from the ISEM Institute. Unfortunately,
it is not possible to get the exact number of officers working in this area due to limited and
restricted information in some countries.
A total of 150 police and intelligence officers working in these fields as “population” were
identified using data from ISEMI and law enforcement sources. Through the use of
Calculator.net, a sample size was determined with a 95% confidence level and a 5% margin
for error. Finally, the number of participants between 60 to 110 officers were expected with
a potential lower number due to the short period of time and summer vacations.
2.3 Trustworthiness of Data
The trustworthiness of data in a systematic literature review is an essential aspect of

research as it serves as the foundation for all the conclusions and recommendations
presented. It can impact the success of research by contributing to the overall validity and
reliability of the study's conclusions and recommendations. Data in this research originate
from various sources such as experiments, surveys, observations, case studies, CCTV
records and law enforcement secondary sources. The credibility of data becomes the utmost
concern, especially in systematic literature reviews where evidence synthesis represents
the main objective.
According to Kääriäinen et al. (2014), the trustworthiness of the data can be assessed in
terms of dependability, credibility, transferability, and confirmability. Noble and Smith
(2015) discuss about the trustworthiness of data in literature reviews and the factors that
influence the reliability and validity of the information presented. The first argument
highlights concern about the validity and generalizability of data used, as well as the
potential for researcher biases and flawed methodologies. The second argument advocates
for transparent and rigorous methodologies, as well as consensus and convergence of
findings across multiple studies. Therefore, this research involved transparency in selecting
and evaluating sources to ensure increased trust in the data used within systematic literature
reviews. The systematic literature review provided in this research demonstrates a
28
convergence of findings across different datasets and it strengthens the overall reliability
of the conclusions. The inclusion of diverse studies from different regions, populations, or
research designs can help reduce the impact of limitations inherent in individual studies.
This research critically evaluated the sources that have been used, considering factors such
as peer review, reputable publications, and the credibility of authors.
As for the data collected in the survey, their reliability depends on several factors. These
include the overall geographical coverage within Europe, the average age and work
experience in the given area, as well as the number of respondents. Therefore, the limitation
of this survey lies in the small sample and the non-existent control group. It is not easy to
involve a larger number of CBRN-E terrorism specialists - active-duty officers - for several
reasons. These include insufficient and classified information about the actual number of
officers working in the police and intelligence agencies in the field of CBRN-E terrorism,
as well as insufficient time space for data collection. At the same time, it should be noted
that this field is very specific and in fact, only a fraction of experts work in it. Despite these
deficiencies, the involvement of 12 major and minor countries from various corners of
Europe, where terrorist attacks using CBRN-E materials have been carried out or prepared,
ensures sufficient geographic coverage. The age and experience of the participating
respondents in the survey also represent a significant aspect of answer credibility. It can be
assumed that more experienced experts are able to perceive the generated risk indicators
from a different perspective than less experienced ones, which was confirmed in this study.
2.4 Ethical issues
Although the case studies analysed in the research used CCTV footage of individuals, the
ethical implications of using their images only played a limited role, as the publication does
not include any such pictures. Thus, the ethical concerns are not a major factor in this
context. The decision regarding ethics was influenced by the study conducted by Wiles, et
al. (2008) which emphasized that the utilization of visual techniques has to be ethical,
responsible, and respectful of the individuals involved.
The ISEM Institute granted ethical approval and the Law Enforcement and Intelligence
Agencies provided letters of support for the research project that included the statement of
ethical issues approval. The project, including its ethical aspects, was also approved by
Essex University. The anonymous survey conducted within the law enforcement and
intelligence sector did not represent any potential harm to individuals and did not request
personal data in the questionnaire. The survey included a questionnaire introduction that
emphasized the importance of informed consent and obtained it from the participants
before their participation.
The analyses of case studies and CCTV recordings also entailed sensitive information,
however, the risk management declaration included a detailed description of mitigation
strategies or control measures. Therefore, the ethical principles of the research were
preserved.
29
It was necessary to perceive the ethical aspects of research in the field of terrorism from
the beginning of the implementation of the systematic literature review to the collection of
data within the survey. The research methodology was therefore based on several relevant
scientific works. For example, Mills et al. (2020) argue that researchers have a
responsibility to consider the potential negative consequences of their work, including the
risk of harm to research participants and the potential for research findings to be misused
by governments and other political actors.
Although Conway (2021) focuses his work on online radicalization and terrorism research,
the conclusions can be applied to all types of terrorism research. One of the important
arguments in Conway's work is that researchers need to prioritize their own safety when
conducting research in this field and that they need to ensure that their research is conducted
with the informed consent of participants.
Conway (2021) also emphasizes the need for tailored ethical guidelines that take into
account the unique risks and challenges of researching online extremist communities.
Morrison et al. (2021) note that while ethical considerations are important in all areas of
research, they are particularly crucial in the field of terrorism studies, where research can
have significant real-world implications. The article outlines the key components of
FRETS, including guidelines for informed consent, participant selection, confidentiality,
and data collection and storage which was applied in this research.
The authors also discuss the challenges of implementing ethical research practices in the
context of terrorism studies, such as concerns over the safety and security of participants
and researchers. Ultimately, the authors argue that the development and use of ethical
research frameworks like FRETS are essential for ensuring the integrity and validity of
research in terrorism studies.
30
3. RESULTS FROM SYSTEMATIC LITERATURE, CASE

STUDIES AND CCTV RECORDS REVIEW
3.1 General findings
Studying literature, both open source and non-public security or prosecution files, and
reviewing CCTV records was the first step in the research methodology. This approach
was important in collecting necessary data before implementing further research phase.
Search methods using specific keywords in browsers on the Internet or using the internal
sources of the International Security and Emergency Management Institute are described
in the methodology subchapter 2.2.
During the preliminary literature study conducted as part of the research project
preparation, many shortcomings related to the detection of risk indicators in criminal
activities involving chemical, biological, radioactive, nuclear and explosive materials were
identified.
The review of the literature has shown that there is a very limited amount of professional
and research literature dealing with specific aspects of criminal behaviour associated with
CBRN and explosive materials. And if they are available, the critical scientific assessment
by competent and experienced authorities is missing. According to the above preliminary
study, other gaps have been identified. The risk indicators that are present in publicly
available videos of terrorist acts have not been thoroughly evaluated, grouped into
categories, and correlated with a baseline. No scientific article on this topic was found
during the systematic literature review.
The process of establishing a baseline for identifying risk indicators is not evident from the
sources examined for this research purpose. The baseline concept was partially identified
in Davis et al., (2013) work but is limited to individual-centred baseline and surveillance
and reconnaissance technological platforms. However, this study is dated from 2013 and
would require updating, as technological development has significantly progressed.
Another more detailed explanation of the baseline creation is defined by the United States
Marine Corps (N.D.). Their guidebook discusses the importance of having a baseline as a
reference point for evaluating events, and objects and creating a roadmap for decision-
making. Marine Corps uses a template of prototypical matches to create a baseline by
observing and determining the context and relevance of the situation. Baselines are
dynamic and must be constantly updated to incorporate changes and identify anomalies.
An anomaly is a deviation from the baseline and could be an absence or presence of
something that should or should not be there. Anomalies are potential indicators of
important changes and must be analysed, representing the phase of Boyd's Decision Cycle
(Richards, 2020). However, the guidebook of the United States Marine Corps (N.D.) is
limited only to combat profiling without any specific aspects of CBRN and partially
mentioned explosive material. The baseline concept is a crucial piece of the puzzle in
behavioural detection that can help to avoid false alarms related to terrorism, which are
31
often present during public events in soft targets (Barr et al., 2022). CPNI, HM Government
(N.D.) guidelines highlight the importance of understanding the standards of a given setting
and being able to distinguish anomalous or dubious occurrences, whether in situations
involving active plans or not. Neglecting this crucial element in the training process might
result in a greater probability of false positives and false negatives when recognizing truly
suspicious behaviours.
Additionally, there are only partial descriptions of the approach to baseline and risk
indicators involving CBRN agents in certain security forces´ documents, e.g., in
FRONTEX not publicly available guidelines (2018). As obviously known, criminal
activity involving CBRN and explosive substances is primarily associated with terrorism,
whereas according to the systematic literature review, a limited number of scientific articles
discuss its detection in the early stage of the attack based on the risk indicators comparing
the identified baseline. Additionally, other serious CBRN crimes and the analysis of related
criminal behaviour are hard to be found in the literature. Whereby, their incidence, is
according to the UNICRI Guide frequent (UNICRI, 2022).
Finally, although this study primarily focuses on the detection of behavioural risk
indicators, it also encompasses the so-called technological risk indicators, such as
suspicious odours (Ganesan et al., 2010; Chauhan et al., 2008; Ellison, 2007), sounds
(Rudolph, 1993; Niemann, 2010; Spicer, 2020; GENERAL ACCOUNTING OFFICE
WASHINGTON DC., 2005), suspicious objects (Morewitz, 2019) or other types of alarm
triggers described in the following chapters.
3.2 Results from behavioural science and CBRN-E terrorism-related systematic

literature review
While the important scientific works of the mentioned disciplines in Chapter 1 rather
answer the questions of why such behaviour occurs and what influences such terrorist
behaviour, this research project more exactly deals with the critical assessment of detection
of risk indicators related to specific operational behavioural patterns including the
radicalisation behaviour connected to violence, the use of certain objects and tools for
preparation and implementation of a CBRN terrorist attack, technological indicators,
physiological reactions, symptoms after contamination with CBRN agents and appearance.
In this context, the psychological disciplines can make the connection between two
concepts. In this spirit, Horgan (2017) discusses the complexity of terrorism from a
psychological perspective, exploring various topics including motivation, recruitment, and
group dynamics. Post (2010) and Horgan (2017) provide other related arguments in
connection to the “Martyrdom” term and its role in motivating individuals to engage in
terrorist activities. All those radicalisation signs, while visible and detectable, can be
included in the techniques of detection of risk indicators of a planned or ongoing criminal
act, as radicalised individuals could be involved by terrorists consciously or unconsciously
in the planning phase of the attack as it happened in a previous terrorist act described by
32
Wilner and Dubouloz (2010) or when a radicalised person enter into the “Action” phase
(Doosje et al., 2016).
Horgan (2017) further highlights the need for continued research in this field and for
evidence-based policies and interventions. Since the studies on terrorism theories are
largely present, the counter-terrorism theories, which are part of this research, are not
sufficiently represented among the research topics worldwide (Renard, 2021) and
specifically in connection to CBRN and explosive materials which is proven by this
research when searching on respective Internet sources and in libraries.
The systematic literature review was divided into two main categories of interest. The first
covered the planning phase of the CBRN terrorist act and partially included the
radicalisation process indicators. The second part concerns the terrorist act itself,
respectively the moment close to the terrorist act beginning when moving to the target place
or transporting the CBRN-E weaponised agents and dispersion devices, when initiating the
criminal act or immediately after the attack. Almost all found literature sources related only
to CBRN-E risk indicators mentioned in the Table 2.1 and the next chapters both publicly
available or restricted only to security forces have been mainly based on the practical
experience of authors or involved law enforcement practitioners, however, they lack the
empirical assessment. Therefore, the findings from the systematic literature review are not
necessarily reliable and are deeply discussed in the Discussion section.
Table 2.1 Systematic literature results tables
Note: Limitations and utilized data from analyzed articles are provided in the discussion.
Authors Study/Article Year Point of interest CBRN and
/or
explosives
topics
included
Asal, V., Avdan, Breaking taboos: 2023 Acquisition Yes
N., & Ackerman, Why insurgents and/or
G. pursue and use CBRN production of
weapons. CBRN and
explosive
materials
Asal, Victor H., The Softest of 2009 Planning of the Only
Karl Rethemeyer, Targets: A Study on terrorist attack, partially
R., Anderson, Terrorist Target Target selection
Ian, Stein, Selection
Allyson, Rizzo,
Jeffrey, & Rozea,
Matthew
Ayed, M. B., Suspicious behavior 2019 Non-verbal No
Elkosantini, S., recognition based on communication
face features cues
33
Alshaya, S. A., &

Abid, M.
Barr, D., Drury, Understanding 2022 Behavioural false No
J., & Choudhury, collective flight alarms
S. responses to (mis)
perceived hostile
threats in Britain
2010-2019: a
systematic review of
ten years of false
alarms in crowded
spaces.
Barrera, D. J. S. Bomb threats and 2017 Explosive threats Yes,
reports of suspicious and suspicious partially
items in the items
Philippines: Spatial
and temporal patterns.
Binder, M. and Introducing the 2021 CBRN incidents Yes
Ackerman, G. profiles of incidents statistics (however,
involving CBRN and no
non-state actors indicators)
(POICN) database.
Bisogni, C., Emotion recognition Non-verbal cues No
Cimmino, L., De at a distance: The
Marsico, M., robustness of machine
Hao, F., & learning based on
Narducci, F. hand-crafted facial
features vs deep
learning models.
Bland, S. A. Chemical, Biological, 2014 CBRN Yes
Radiological and symptoms as
Nuclear (CBRN) physiological
Casualty indicators
Management
Principles. Conflict
and Catastrophe
Medicine: A Practical
Guide
Blandón-Gitlin, Cognitive-load 2014 Verbal and Non- No
I., Fenn, E., approaches to detect verbal cues,
Masip, J., Yoo, deception: searching behaviour and
A.H. for cognitive profiling
mechanisms.
Bloom, C. and The Bandwagon 2017 Behavioural No
Bloom, L. Effect - Are we going patterns
to think for
ourselves? In:
Psychology today.
34
Boelaert, A., RooT37–CUTA’s 2021 Terrorist Risk No

Thys, B., & Van TRA Tool in and Threat
Hoey, M. Response to a assessment and
Changing Threat technologies
Landscape.
Bogaard, G., Scientific Content Deception No
Meijer, E., H., Analysis (SCAN) detection by
Vrij, A, Cannot Distinguish analyzing
Merckelbach, H. Between Truthful and linguistic
Fabricated Accounts patterns in
of a Negative Event. written and
spoken
statements
Bouhana, N. Recruitment of 2013 Radicalisation No
terrorists. In Capacity warning signs
building in the fight
against terrorism
Brewer, N., Wei Theory of mind and 2018 Excessiveness No
Ying, A.B., the detection of and the repetitive
Young, R.L., suspicious behavior. manifestation of
Nah, Y. risk indicators
Brynielsson, J., Harvesting and 2013 Radicalisation No
Horndahl, A., analysis of weak indicators
Johansson, F., signals for detecting
Kaati, L., lone wolf terrorists.
Mårtenson, C., &
Svenson, P.
Bulling, D., Behavioral science 2008 Insider threats No
Scalora, M., guidelines for indicators
Borum, R., assessing insider
Panuzio, J., & threats.
Donica, A.
Caber, M., Does perceived risk 2020 Behavioural risk No
González- really matter in travel indicators linked
Rodríguez, M. R., behaviour? to travel
Albayrak, T., &
Simonetti, B.
Calder, A., & CBRN considerations 2018 CBRN threat Yes
Bland, S. in a major incident. (however,
no
indicators)
Carr, A., Biswas, Airport operations 2020 Security No
T., & Wheeler, J. and security screening and
V. screening: An bias – social
examination of social justice
justice.
Cavusoglu, H., Passenger profiling 2013 Profiling during No
Kwark, Y., Mai, and screening for the screening in
B., & aviation security in aviation security
Raghunathan, S.
35
the presence of – different

strategic attackers. methods
Cerezo, L. Radiation accidents 2011 Irradiation Yes
and incidents. What symptoms
do we know about the
medical management
of acute radiation
syndrome?
Chauhan, S., Chemical warfare 2008 Chemical Yes
D’cruz, R., agents. exposure
Faruqi, S., Singh, symptoms,
K. K., Varma, S., odours
Singh, M., &
Karthik, V.
Chilcott, R. P. CBRN contamination. 2010 Physiological Yes
effects of CBRN
material to the
human body
Cole, L. A. The spectre of 2020 Biological Yes
biological weapons. weapons threat (however,
no
indicators)
Committee on Behavioral science 2011 Behavioural No
Science, Space, and security: detection
and Technology Evaluating TSA’s assessment
House of SPOT program.
Representatives
CPNI, HM Behavioural N.D. Methods and No
Government Detection Brochure – approach of
Best practice, behavioural
guidance and advice. detection
Dando, C. J., & Maximising 2018 Verbal cues No
Bull, R. opportunities to detect
verbal deception:
Training police
officers to interview
tactically.
Dankiewicz, M. Methods of detecting 2012 Methods of No
potential terrorists at terrorist
airports. detection
Davis, P. K., Using behavioral 2013 Behavioural cues No
Perry, W. L., indicators to help
Brown, R. A., detect potential
Yeung, D., violent acts.
Roshan, P., &
Voorhies, P.
Decker, S., & Gangs, terrorism, and 2011 Radicalisation No
Pyrooz, D. radicalization. signs
Denault, V., The analysis of 2020 Non-verbal cues No
Plusquellec, P., nonverbal and profiling
36
Jupe, L. M., St- communication: The

Yves, M., dangers of
Dunbar, N. E., pseudoscience in
Hartwig, M., ... security and justice
van Koppen, P. J. contexts.
Doosje, B., Terrorism, 2016 Radicalisation No
Moghaddam, F. radicalization and designs
M., Kruglanski, radicalization.
A. W., De Wolf,
A., Mann, L., &
Feddes, A. R.
Dorner, B. G., Biological toxins of 2016 Detection Yes
Zeleny, R., Harju, potential bioterrorism technologies
K., Hennekinne, risk: Current status of
J. A., Vanninen, detection and
P., Schimmel, H., identification
& Rummel, A. technology.
Ellison, D. H. Handbook of 2007 Chemical and Yes
chemical and biological agents
biological warfare and their effects
agents.
Émond, J. Flux et sécurité: le 2011 The flow of No
passager dans people at the
l'aéroport canadien airport and
related security
aspects
European Member states´ 2018 Preparedness to Yes
Parliament – preparedness for CBRN incidents (however,
TERR Committee CBRN threats. and capacity no
building indicators)
Evison, D., Chemical weapons. 2002 Chemical Yes
Hinsley, D., & weapons effects
Rice, P.
Fainberg, A. The Terrorist Threat 2009 Terrorist threats Yes
to Inbound US in airport (however,
Passenger Flights: security and no
Inadequate training of indicators)
Government professionals
Response.
Feijoo- Like a cat on hot 2023 Anomalous No
Fernández, M. C., bricks: The detection behaviour
Halty, L., & of anomalous detection
Sotoca-Plaza, A. behavior in airports.
Fernández, M. D. Guardia Civil’s 2021 Deviations from No
C. F. ÍCARO teams: normal
Behaviour analysis at behaviour
airports and ports.
Frank, M. G., Human behavior and 2008 Behavioural cues No
Menasco, M. A., deception detection. and deception
& O’Sullivan, M.
37
Fredholm, M. Lone actor terrorism 2016 CBRN-related Yes

and CBRN weapons. behaviour of lone
actors
FRONTEX Operationalisation of 2018 Various risk Yes,
Common Risk indicators (the partially
Indicators. Travelling most complex (explosives
terrorists and other document) and
‘subjects of interest’ – partially
Empowering border – chemicals)
control authorities to
make better-informed
decisions.
Ganesan, K., Chemical warfare 2010 Effects of Yes
Raza, S. K., & agents. chemical warfare
Vijayaraghavan, agents, odour
R.
GENERAL US Postal Service: 2005 Suspicious items Yes,
ACCOUNTING Guidance on and sounds partially
OFFICE Suspicious Mail
WASHINGTON Needs Further
DC. Refinement.
Greenberg, M. I., The perception of 2013 Odours Yes
Curtis, J. A., & odor is not a surrogate indicators
Vearrier, D. marker for chemical
exposure: a review of
factors influencing
human odor
perception.
Harper, J. Terrorism and 2009 Intelligence No
Security Systems, gathering – data
Cato Institute. United mining
States of America.
Joint Chiefs of Antiterrorism. 2010 Intelligence No
Staff. gathering
Jones, E. E. How do people 1976 Perception of the No
perceive the causes of causes of
behavior? behavior and the
Experiments based on practical
attribution theory applications of
offer some insights attribution theory
into how actors and in social
observers differ in psychology
viewing the causal research
structure of their
social world.
Kaluza, B. Detection of 2013 Suspicious No
Anomalous and behaviour
Suspicious Behavior
Patterns from Spatio-
38
Temporal Agent
Traces.
Kamboj, D. V., Biological warfare 2006 Biological agents Yes
Goel, A. K., & agents. effects
Singh, L.
Kaszeta, D. Suspicious Odors and 2013 Odours and Yes
Unexplained Illness. symptoms
indicators
Khalsa, S., & Forecasting terrorism: 2004 Analytic No
Gordon, M. Indicators and proven techniques and
analytic techniques. risk indicators
Koehler, D., & Mapping far-right 2020 CBRN Terrorism Yes (it is
Popella, P. chemical, biological, characteristics - possible to
radiological, and far-right CBRN deduce
nuclear (CBRN) terrorism some
terrorism efforts in indicators)
the west:
Characteristics of
plots and perpetrators
for future threat
assessment.
Kolencik, M., Role of Police and 2018 CBRN terrorism- Yes
Intelligence Agencies related behaviour
in the fight against – indicators of
CBRN terrorist the planning
threats. phase of terrorist
attack
Koller CI, Wetter What Is Suspicious 2015 Nonverbal cues No
OE, Hofer F. When Trying to be
Inconspicuous?
Criminal Intentions
Inferred From
Nonverbal Behavioral
Cues.
Lammerant, H., Predictive profiling 2016 Profiling. No
& de Hert, P. and its legal limits:
Effectiveness gone
forever.
Leistedt, S. J. Behavioural aspects 2013 Terrorist No
of terrorism. patterns.
Maguire, M. Counter-terrorism in 2014 Human and Yes,
European airports. technological partially
The anthropology of risk detection
security: Perspectives
from the frontline of
policing, counter-
terrorism and border
control.
39
Meijer, A., & Predictive policing: 2019 Predictive No

Wessels, M. Review of benefits profiling
and drawbacks.
Meloy, J. Reid, The Role of Warning 2012 Warning No
Hoffmann, Jens, Behaviors in Threat behaviours
Guldimann, Assessment: An typology
Angela, & James, Exploration and
David Suggested Typology.
Michalski, K., THE 2020 Data mining No
Jurgilewicz, M., IMPLEMENTATION indicators
Kubiak, M., & OF SELECTIVE
Grądzka, A. PASSENGER
SCREENING
SYSTEMS BASED
ON DATA
ANALYSIS AND
BEHAVIORAL
PROFILING IN THE
SMART AVIATION
SECURITY
MANAGEMENT–
CONDITIONS,
CONSEQUENCES
AND
CONTROVERSIES.
Morewitz, S.J. Suspicious Objects. 2019 Indicators – Partially
suspicious items Yes in
connection
to
explosives
Nance, M. W. The terrorist 2014 Different types Yes
recognition of risk indicators
handbook. (mostly pre-
incident)
National Homegrown violent 2017 Extremism Yes
Counterterrorism extremist indicators and
Center mobilization indicators related
indicators. to preparing for a
terrorist attack
using CBRN and
explosive agents
Newman, M. L. Lying Words: 2003 Verbal/Linguistic No
et al. Predicting Deception cues
from Linguistic
Styles.
Niemann, R. J. Common Chemicals 2010 Explosive Yes,
as Precursors in indicators, partially
Constructing Sounds
Improvised Explosive
Devices.
40
Parasuraman, R., Detecting threat- 2009 Threat detection No

de Visser, E., related intentional
Clarke, E., actions of others:
McGarry, W.R., effects of image
Hussey, E., Shaw, quality, response
T., ... Mason, G. mode, and target
cuing on vigilance.
Pressman, D. E., Internet use and 2019 Internet usage No
& Ivan, C. violent extremism: A patterns
cyber-VERA risk
assessment protocol.
Rader, N. E., & Avoidance, 2014 Weapons No
Haynes, S. H. protective, and behaviour
weapons behaviors:
An examination of
constrained behaviors
and their impact on
concerns about crime.
Richards, C. Boyd’s OODA loop. 2020 Boyd´s concept No
in military
operations
Roberts, D. Aviation Security and 2016 Challenges in Only a
the Challenges the aviation security general
Industry Faces mention of
Providing Safe and bombs
Secure
Transportation.
Rudner, M. Intelligence-led air 2015 Data mining – No
transport security: intelligence
Pre-screening for gathering
watch-lists, no-fly
lists to forestall
terrorist threats.
Rudolph, T. L. Explosives Vapor 1993 Detection Yes,
Detectors. technologies, partially
Sounds
Santifort, C., Terrorist attack and 2013 CBRN attack – Yes
Sandler, T., & target diversity: target focus (however,
Brandt, P. T. Changepoints and no
their drivers. indicators)
Satish, A. S., A systematic review 2023 Passengers No
Mangal, A., & of passenger profiling profiling
Churi, P. in airport security
system: Taking a
potential case study
of CAPPS II.
Schuurman, B., & Indicators of terrorist 2015 Terrorism threat Yes
Eijkman, Q. intent and capability: assessment. (however,
Tools for threat no
assessment. indicators)
41
Sferopoulos, R. A Review of 2009 Detection Yes

Chemical Warfare technologies
Agent (CWA)
Detector
Technologies and
Commercial-Off-The-
Shelf Items.
Shaw, E. D., & Behavioral risk 2011 Behavioural cues No
Stock, H. V. indicators of – insider theft
malicious insider theft
of intellectual
property: Misreading
the writing on the
wall.
Shea, D. A. and CRS report for 2004 CBRN attacks Yes
Gottron, F. Congress, Small-scale effects (however,
Terrorist Attacks no
Using Chemical and indicators)
Biological Agents:
An Assessment
Framework and
Preliminary
Comparisons
Silke, A. Research on 2008 Data mining, No
Terrorism: A Review Digital indicators
of the Impact of 9/11
and the Global War
on Terrorism.
Terrorism
informatics:
Knowledge
management and data
mining for homeland
security,
Sinai, J. O. S. H. A framework for 2022 Pre-incident Yes,
U. A. preempting lone-actor phase/indicators partially
terrorists during the
pre-incident phase.
Lone actor terrorism:
An integrated
framework,
Smith, B.L., Pre-Incident 2011 Pre-incident Yes,
Damphousse, Indicators of Terrorist phase/indicators, partially
K.R., Roberts, P. Incidents: The Behavioural
Identification of patterns
Behavioral,
Geographic and
Temporal Patterns of
Preparatory Conduct.
42
Spicer, B. Bomb threats and the 2020 Explosive Yes (only

case against threats, Sounds explosives)
immediate
evacuation.
Strom, K., Building on Clues: 2010 Challenges in the Yes,
Hollywood, J., Examining Successes detection of partially
Pope, M., and Failures in terrorist plots
Weintraub, G., Detecting U.S.
Daye, C. and Terrorist Plots,
Gemeinhardt, D.
Sullivan, T. and Identifying Indicators 2004 Indicators of Yes
Perry, W. L. of Chemical, CBRN Weapons
Biological, Development
Radiological and
Nuclear (CBRN)
Weapons
Development Activity
in Sub-National
Terrorist Groups.
Susser, D. Predictive policing 2021 Profiling No
and the ethics of
preemption. The
ethics of policing:
New perspectives on
law enforcement,
Taylor, R. G., Perception deception: 2016 Deception No
Brice, Jr, J., & Security risks created
Robinson, S. L. by optimistic
perceptions
Toleubayev, T., A Prosecutor's Guide 2022 CBRN related Yes
Hoile, R., Austin, to Chemical and behaviour
P., Collyer, G., Biological Crimes. indicators –
Wood, R., Minks, planning phase
S., Kolencik, M. of terrorist attack
Tuncer, T., Automated facial 2023 Non-verbal cues No
Dogan, S., & expression
Subasi, A. recognition using
novel textural
transformation.
United States Profiling and tactical N.D. Process of Yes
Marine Corps tracking. profiling and
certain risk
indicators related
to the use of
CBRN weapons
US Department Introduction to N.D. Explosives Yes,
of Homeland explosives. effects. partially
Security
43
US Joint First responders N.D. Indicators related Yes,

Counterterrorism toolbox - to explosive partially
Assessment Team TRIACETONE threat behaviour
TRIPEROXIDE
(TATP):
INDICATORS OF
ACQUISITION AND
MANUFACTURE,
AND
CONSIDERATIONS
FOR RESPONSE
Van der Auwera, Predictive profiling as 2018 Profiling No
J., Van Daele, D., a new counter-
& Vervaeke, G. terrorism measure at
Belgian airports. The
reliability and validity
of the predictive
profiling method:
preliminary results
and future research.
Vrij, A., Hartwig, Reading lies: 2019 Non-verbal cues No
M., & Granhag, Nonverbal
P. A. communication and
deception.
Walsh, P. F. Evolving chemical, 2021 Intelligence and Yes
biological, CBRN threats (however,
radiological and no
nuclear (CBRN) indicators)
terrorism: Intelligence
community response
and ethical
challenges.
Weiss, E. M., The relationship 2006 Facial expression No
Kohler, C. G., between history of
Nolan, K. A., violent and criminal
Czobor, P., behavior and
Volavka, J., Platt, recognition of facial
M. M., ... & Gur, expression of
R. C. emotions in men with
schizophrenia and
schizoaffective
disorder. Aggressive
Behavior
Wigginton M. Jr., What Is the Role of 2014 Behavioural No
Jensen, C.J., Behavioral Analysis analysis
Graves, M. & in a Multilayered
Vinson, J. Approach to Aviation
Security?
44
WILLIAMS, P., NUCLEAR 2002 Behaviour Yes

WOESSNER, P. SMUGGLING: indicators related
N. ADAPTABILITY, to the smuggling
ORGANIZED of radioactive
CRIME AND material
UNDERCOVER
OPERATIONS
Williams, T. Ideological and 2019 Radicalisation No
behavioural signs
radicalisation into
terrorism–An
alternative
sequencing.
Zhang, F., Fan, “Perception bias”: 2021 Perception bias No
Z., Kang, Y., Hu, Deciphering a in profiling
Y., & Ratti, C. mismatch between
urban crime and
perception of safety.
3.3 Results from specific case studies and CCTV records review
As can be seen in previous chapters, the limited number of scientific studies devoted to
CBRN-E risk indicators makes the analysis of real-life cases from practitioners all the more
important. The ISEMI Institute has provided an archive, consisting of numerous publicly
restricted documents acquired through analytical work for security forces and international
and European institutions, which pertained to former terrorist cases. None of the
information classified as EU/NATO restricted, confidential or higher classification level is
present in this work. Analysed information from case studies, security analysis documents
as well and court decisions, combined with the results of systematic literature review,
served to create categories of risk indicators and also assisted in a more thorough analysis
of CCTV recordings.
Video analysis was carried out through multiple viewings of individual sequences from
CCTV recordings that were publicly available, but mostly those, of some cases mentioned
above from security agency sources publicly restricted maintaining the ethics in the whole
process. Ultimately, video analysis aided in establishing the final structure of risk
indicators, their categories, subcategories and specific behavioural patterns, physiological
reactions, indicators related to appearance, digital behavioural indicators, personal
belongings and luggage during travel, technological indicators and suspicious symptoms
related to poisoning and radioactive exposure.
All indicators provided in the final list (Appendix E) are related to different phases of
terrorist radicalisation, terrorist or other criminal acts, namely the planning phase and the
imminent phase before the criminal act, during the criminal act and after its
implementation.
45
CASES SELECTED FOR CASE STUDY AND CCTV RECORDS REVIEW
The cases like USA 9/11 attacks in 2001 (Marrin, 2011), the London bombing in 2005
(Brewin et al., 2010), Mumbai multiple attacks in 2008 (Fair, 2014; Rabasa et al., 2009),
the attack on the flight from Amsterdam to Detroit in 2009 (Gruen, 2010; Harper, 2009;
Fainberg, 2009), the Breivik bombing and shooting in Norway in 2011 (Syse, 2014), Stade
de France attack in Paris in 2015 (Bonelli, 2023), Attacks at Brussels Airport and Metro in
2016 and Brussels Central Station in 2017 (Thomas, 2020), the Manchester Arena attack
in 2017 (Lowe, 2020), the Sri-Lanka bombing in 2019 (Shaffer, 2022), the Tbilisi airport
Yperite attack in 2018 (Kolencik, June 2021), the Hydrogen Sulphide terrorist plot in
Australia in 2017 (Zammit, 2020), London Parsons Green station attack in 2017 (Fenn and
Brunton-Smith, 2021), Radioactive letters case in Slovakia in 2016 (Kolencik, June 2021),
Dimethylmercury and Abrin criminal act in Czech republic in 2018 (Kolencik, June 2021),
a Chlorine bomb attack in a Shopping mall Alam Sutera, Tangerand in Indonesia in 2015
(Yeo and Rahmah, 2022), Thorium oxide plot in Indonesia in 2017 (Pusfitasari, 2018;
Soeparna and Tanega, 2022), Abrin terrorist plot in Indonesia in 2019 (Kolencik, 2021;
Yeo and Rahmah, 2022), Kuala Lumpur VX attack in 2017 (Stojiljković, 2019), Scripal
poisoning in Salisbury in 2018 (Bolt and Hengstler, 2022) and other similar criminal acts
from ISEMI archive were deeply studied and a wide range of indicators have been
identified.
46
4. RESULTS FROM SURVEY
4.1 Implementation of the survey
The survey was implemented between 22 May and 15 July 2023. 50 participants from 12
countries (Appendix B, Graph N. 1) namely, Belgium, Bosnia and Hercegovina, the Czech
Republic, Estonia, Finland, France, Georgia, Germany, Luxembourg, Portugal, Slovakia,
United Kingdom and two EU Agencies – Frontex and Cepol took part in the online survey
placed on ISEMI SIENA X IT Tool protected by a password. Although the expected
number of participants was not met, the group that did participate provides a valuable
sample of law enforcement and intelligence officers who specialize in combating CBRN-
e terrorist threats. This is a unique field with few experts, as described in the methodology
and it is very complicated to get a relevant number of existing officers to create a statistical
sample due to the sensitivity and classified data in some countries.
The highest number of participants originate from Slovakia, France, Belgium, Georgia, and
Portugal, with six participants from each of the aforementioned countries. Conversely, the
least number of participants come from Estonia and Germany, with only one participant
from each. In addition, the EU agencies, CEPOL and FRONTEX, were represented by one
participant each.
Graph 1 – Participants per country or EU agencies
PARTICIPATING COUNTRIES
FIN; 1
CEPOL; 1
SK; 6
BE; 6
FRONTEX; 1
D; 1 BIH; 3
EST; 1
CZ; 5
GRUZ; 6
UK; 3
FR; 6 PT; 6
LUX; 4
47
The basic demographic information and work experience of the participants, such as
gender, age and length of professional practice, are presented in Appendix B, Graphs No.
2, 3 and 4. The vast majority of participants were men, with only 6% being women and 4%
choosing not to respond. More than half of the respondents fall in the 35 to 45 age range.
Exactly half of the survey participants have work experience of more than 15 years, with
28% having 11 to 15 years of work experience.
Graph 2 – Sex of respondents
SEX
3 2
44
Male Female Not stated
Graph 3 – Age groups
AGE GROUP
3 2 5
14
26
less than 35 35 to 45 45 to 55
more than 55 Not stated
48
Graph 4 – Years of experience in Law Enforcement and Intelligence agency
WORK EXPERIENCE
4
25
14
0-5 years 6-10 years 11-15 years More than 15 years
4.2 Survey Results
The results of the questionnaire survey are sorted according to the defined research
questions and presented in Appendixes B, C – Tables 3.1 – 3.21 and Appendix D. They
were focused on the reliability and relevance of identified categories and risk indicators in
literature and case studies review for operational activities and investigations involving
crimes related to CBRN and explosive materials. The survey further explored the most
suitable risk indicators and categories for the detection tactics of investigators and
intelligence officers in the face of an impending terrorist act. Additionally, the text
examines the relevance of identified risk indicators for training activities. As a result,
survey participants clearly confirmed that the identified indicators and categories are
relevant and reliable for operational and training activities.
Results by Research Questions
Are identified categories and risk indicators in literature and case studies reviews reliable
and relevant for the operational activities and investigation of the crime involving CBRN
and explosive materials?
The results were generated from the respondents' answers to questions 4.1 and 5.1. As
shown in Graph 5.1, 74% of the respondents answered "Yes" to question 4.1 regarding the
categories of risk indicators, and 20% answered "Partially yes." Similarly, in response to
question 5.1 regarding the risk indicators, 74% answered: "Yes" and 18% answered,
"Partially yes" (Graph 5.2). Based on the given data, it can be concluded that the vast
majority of the respondents consider the identified categories and risk indicators as reliable
and relevant for their operational activities and investigation of crimes involving CBRN
and explosive materials.
49
In question 4.1, one of the participants selected the answer "I don't know" and added a
comment stating: "The list appears reasonable and thoroughly researched, however, there
is no own database available to evaluate the relevance of specific indicators. Therefore,
further prioritization is impossible for us." 4% of participants selected the answer "No"
without any specific comments. Two interesting comments that are further discussed in the
discussion section are found in the answers "Partly yes." The first comment is: "The
relevance of the indicators is dependent on the situation, e.g., law enforcement may look
for different indicators during a first- or second-line check at the border than during a home
search or while securing an event." The second comment is: “Don't expect a terrorist to
look the same when he/she plans an attack and when he commits the attack. One of the
terrorists of the terrorist attacks in Belgium on 22/03/2016 looked completely different
from the picture that was shown in the news afterwards. Those points can be relevant, but
you cannot get tunnel vision. You have to be aware of that.” Similar conclusions can be
substantiated based on a review of CCTV records, such as in the assessment of the chemical
attack at Tbilisi airport.
In question 5.1, the same participant chose the answer "I don't know" for the same reasons
as in question 4.1. The total number of "I don't know" responses in question 5.1 was three.
The same respondent as in question 4.1 chose the option "No" in question 5.1, meaning
that they do not consider the identified indicators to be reliable and relevant. Their
comment related to the use of publicly available literature: "The relevance of the available
literature cannot be independently verified. There is a lot of literature and information on
the internet that is quite deliberately misinformative and untrue. A professional must obtain
information from primarily non-public sources". Several interesting comments from
participants are included in the discussion section.
Graphs F No. 5.1 and 5.2 containing answers for every category and subcategory of risk
indicators
Q 4.1 Reliability and

relevancy of identified
categories of risk indicators
2% Yes
4%
20% Partially
yes
No
74%
I´dont
know
50
Q 5.1 Reliability and relevancy of

identified risk indicators
2% 6%
18% Yes
Partially yes
74% No
I´dont know
Which identified risk indicators and categories are the most reliable and relevant to be
included in the detection tactics of investigators and operatives’ officers in the phase of an
imminent terrorist act?
The answer to this research question is constructed from an analysis of responses to

questionnaire items 4.2 and 5.2, resulting in two types of rankings. The first is based on
evaluating overall categories of risk indicators, while the second involves evaluating their
subcategories that contain more detailed information, including the risk indicators
themselves.
Through analysis of survey results, individual categories of risk indicators have been
prioritized according to their relevance, from most to least relevant. This prioritization was
based on a consideration of the sum of percentages for values #1 (the most relevant), #2
(very relevant), and #3 (relevant) on the five-point scale used in the questionnaire.
Results of prioritization based on the responses to question 4.2
The results encompass the answers provided by respondents in question 4.2 who responded
"Yes" or "Partially yes" in question 4.1 (Table 1). Across all categories, the results
significantly exceeded the level of 50% of the sum of the first three values and varied on a
scale between 61.7% to 93.6% relevance.
Category No. 8, Technological Detection/Air Sampling Alarm Risk Indicators, ranked first
with a representation of 93.6% in the chosen top three values 1, 2, and 3 (Graph No. 6.8).
The second most relevant category, as indicated by the respondents, was Category No. 4,
Digital Indicators, with a share of 89.4% (Graph No 6.4). Categories No. 3, Items,
Documents, Objects, and Other Belongings Detected on the Person (Radicalisation or
Criminal Activity Signs), and No. 5, Behaviour and Communication, tied for third place
51
with a resulting percentage value of 89.3% (Graphs No. 6.3 and 6.5). Category No. 7,
Specific Indicators of Previous Radicalisation, Suspicious or Criminal Activities Obtained
from Data Mining, ranked fourth with a share of 89.1% (Graph No. 6.7). Category No. 9,
Insider Threat Risk Indicators in Connection to Facilities or Transportation Dealing with
CBRN and Explosive Materials, secured the fifth spot with a percentage share of 85.1
(Graph No. 6.9). The sixth place was occupied by Category No. 1, Appearance and
Physiological Reactions, with a resulting value of 76.6% (Graph No. 6.1). This category
emerged as irrelevant to 60% of the respondents who marked their answer to question 4.1
as "Partially Yes." Category No. 2, Body, Items, or Substances Smell, ranked seventh with
a result of 70.2% (Graph No. 6.2). The category with the lowest percentage share was
Category No. 6, Sound, at 61.7% (Graph No. 6.6). It appeared four times as irrelevant in
the answers to question 4.1 "Partially Yes."
The prioritization results based on the answers to question 5.2
The prioritization results based on the above question displayed a different average
percentage assessment of subcategories within the main categories compared to the results
from question 4.2. This discrepancy may have arisen due to a more detailed
characterization of risk indicators provided in the subcategories, as opposed to the
description offered in the main categories. Consequently, the overall ranking of the main
categories changed (see App. G.3 - Table 3.2). For example, the first two categories have
exchanged positions in both cases. The lowest percentage contribution amounted to 39.1%,
while the highest reached 91.5%. This pertained to respondents' answers to question 5.2
(Graphs No. 7), who had answered "Yes" or "Partially Yes" in question 5.1 (Graphs No.
5.2).
Category 4, Digital Indicators, came in first place. The relevance of the subcategories
ranged from 86.9% to 91.3%, as shown in Graphs No. 7. The subcategory that received the
greatest support was 4.3 Videos containing terrorist propaganda and information on CBRN
and explosive materials, while the lowest was 4.1 Applications detected by covert
operational activities in phones, computers and other electronic devices utilized often by
criminal groups to cover their activities. The overall average for the three subcategories is
88.4%.
Category number 8, Technological Detection/Air Sampling Alarm Risk Indicators,

obtained the second position in the ranking. Within this category, respondents indicated
the various subcategories' relevance at approximately the same level (Graphs No. 7). The
percentage of relevance fluctuated from 82.6% to 89.4% after adding up the first three
values representing the highest relevance, significant relevance, and relevance.
Subcategories such as 8.3 Explosive Detection Technology Alarm Indicating the presence
of explosives or precursors on the person or their belongings (must be verified by
confirmatory analysis/screening), and 8.4 Radiation Detector Alarm Confirming the
presence of nuclear and other radioactive materials on the person or their belongings, and
potentially inside the person's body, garnered the highest support from respondents, up to
52
89.4%. The lowest support, to the tune of 82.6%, was for subcategory 8.6 Ionizing
Radiation Scanning Equipment Alarm showing the presence of a forbidden item, albeit still
demonstrating high relevance. The average percentage of all seven subcategories reaches
87.6%.
The third most relevant category after averaging the results from its subcategories is
number 7 related to data mining results. In this category, respondents attributed percentages
of relevance to the subcategories ranging from 73.9% to 89.1% after adding up the first
three values. The subcategory with the highest relevance was 7.5, which concerns data on
monitored suspects obtained from other sources such as the Darkweb, websites, social
media analytical tools, CCTV analytical tools, and operational activities of law
enforcement and intelligence agencies. Conversely, the lowest relevance was attributed to
subcategory 7.1, which deals with data on the travelling of suspects obtained from travel
databases. On average, all subcategories scored 83.2%.
Next in line is category 6, whose results for its three subcategories ranged from 71.7% to
87%. On average, they scored 81.2%. According to the respondents, the most relevant
subcategory within category 6 is 6.2, which relates to suspicious or abnormal sounds of
CBRN dispersal devices. Conversely, the least relevant one is 6.3, which concerns other
suspicious sounds.
The fifth position is occupied by category number 5 – Behaviour and communication,

which encompasses the highest number of risk indicators and subcategories. The resulting
values ranged from 63.1% to 91.4%. The least relevant subcategory, as identified by
respondents, was subcategory 5.9 - Paralinguistic cues. The subcategory with the highest
value was subcategory 5.4 - CBRN and explosive threat-related behaviour close to or at
the beginning of the attack, during or after performing a criminal act involving the
transportation and use of CBRN-E material. The average percentage of relevance scores
for individual subcategories was 78.6%.
Category 9 related to insider threats concluded in sixth place with an average of 77.5%.
Subcategory 9.1, involving extensive monitoring of facility procedures or vehicles and
gathering needed information or tools from inside, was selected as the most pertinent by
the respondents at 86.7%. Conversely, the least relevant subcategory was 9.3, dealing with
changes in personal life with a value of 71.7%.
Category 3 - Items, documents, objects and other belongings detected on the person
(radicalisation or criminal activity signs) came in seventh place. The results for the
subcategories ranged from 39.1% to 91.5%, representing a relatively significant difference.
However, except for one, all subcategories approached the highest value, starting from
69.5%. Subcategory 3.5 IEDs, guns, military objects and other dangerous objects were
deemed the most relevant by the respondents with 91.5%, while subcategory 3.2 Body
accessories - glasses, earrings, rings, jewellery, caps, etc. was designated as the least
relevant, with 39.1%. The average for the subcategories is 77.3%.
53
Subcategory 3.4, which pertains to CBRN threat objects and items discovered on an
individual, as well as in their luggage or vehicle, has been ranked second with a percentage
of 89.1%. However, the indicators of this group should be linked with other indicators to
objectively assess the risks. Nevertheless, if the materials in question are CBRN agents and
not items used in their production, weaponization, storage or transportation, and if the
person in possession of such materials does not work in the field of CBRN or is not in the
possession of the necessary documentation to transport them, then it is automatically a
breach of the law. This, in turn, raises the risk of a potential attack or other CBRN-related
crime.
Category 2 related to the smell of items has ranked eighth with an average of 65.5%.
Subcategory 2.3, involving perfume containing non-alcoholic oils used in specific contexts,
has been considered by respondents as the least relevant, with a resulting value of 42.2%.
Of the five subcategories, the most relevant is subcategory 2.4 pertaining to items, clothes,
and substances associated with explosive odours and chemical precursors, with a resulting
value of 87.2%.
Category 1 connected with appearance and physiological reactions, with an overall average
of 64%, ended up in the last ninth place. Among the seven groups of indicators, subcategory
1.5, Signs of health issues caused by CBRN agents after contamination or exposure when
manipulating them, was identified as the most relevant with a resulting score of 85.1%. On
the other hand, subcategory 1.4, Body mutilation or modification - cosmetic surgery to
some extreme forms of body modification representing affiliation to a specific group,
beliefs, or a ritual before an attack, was chosen as the least relevant by the respondents with
a score of 46.7%.
It is worth noting that there is an intriguing contrast to be observed in the findings, whereby
91.5% of the respondents found subcategory 3.5 - consisting of IEDs, guns, military and
other dangerous objects - to be the most pertinent compared with all subcategories, whereas
subcategory 3.2 Body accessories - glasses, earrings, rings, jewellery, caps, etc. from the
same subcategory was designated as the least relevant, with only 39.1% from all
subcategories.
How easy or difficult is it to observe identified risk indicators?
The response to the next research question is constructed from an analysis of the
questionnaire responses in section 5.3 (App. F - Graphs No. 8). The order of the categories
is based on an assessment of the individual subcategories. The analysis of the survey results
allowed us to prioritize the individual categories of risk indicators based on
detectability/observability, taking into account the sum of percentages for the selected
values of 1 and 2 on a five-point scale in the questionnaire (1 = easy to detect/observe, 2
= possible to detect/observe, 3 = detectable/observable under certain conditions, 4 =
difficult to detect/observe, 5 = almost undetectable/observable).
54
The respondents most frequently designated category 8, Technological Detection/Air

sampling alarm risk indicators as easy to detect/observe and possible to detect/observe. On
average, the sum of results from the seven subcategories reached 67.1%. Among the
subcategories, 8.6 Ionizing Radiation Scanning Equipment alarm showing the presence of
a forbidden item achieved the highest percentage result at 72.8%, while the lowest result
was obtained by subcategory 8.7 Radio Frequency (RF) based Drone Detection System
alarm indicating the drone threat in combination with the observation of a person
manipulating the Remote-Control device, with a value of 56.8%.
Category 7 - Specific Indicators of Previous Radicalisation, Suspicious or Criminal

Activities, with an average of 57.8% across its five subcategories, has placed second in
terms of ease of detection and observation. The highest value, 66.6%, was achieved by
subcategory 7.4 - Data on Wanted Terrorists/Criminals Obtained from International or EU
Organisations/Bodies, while the lowest value, 47.7%, was obtained by subcategory 7.1 -
Data on Suspects Travel Obtained from Travel Databases.
In the third position, category 3 - Items, documents, objects, and other personal belongings
that indicate signs of radicalization or criminal activity, earned an average score of 55.8%
across the nine subcategories. Subcategory 3.5, pertaining to IEDs, guns, military objects,
and other dangerous objects achieved the highest score of 77.8%. In contrast, subcategory
3.8, concerning pills, medicines, drugs, first aid kits, and similar items, trailed behind with
only 37.8%.
Category 4 - Digital Indicators ranked fourth based on the average of three sub-categories,
with a result of 50.3%. This is the last category where the average value in terms of ease
of detection and observation is above 50%. The best-performing sub-category was 4.3
Videos containing terrorist propaganda and information on CBRN and explosive materials,
with a final score of 64.4%. The worst-performing sub-category was 4.1 Applications
detected by covert operational activities in phones, computers, and other electronic devices
often utilized by criminal groups to conceal their activities, with a score of 42.2%.
The category occupying the fifth rank in the overall ranking, with an average score below
50%, is category 2 - Body, items or substances smell with a value of 48.8%. The
respondents have achieved the highest scores in subcategory 2.5 - Objects, clothing, and
substances with odours related to warfare or toxic industrial chemical agents, reaching a
level of 60%, significantly surpassing the overall average for the category which
encompasses five subcategories. The lowest score 31,1% pertains to subcategory 2.3 -
Perfumes containing non-alcoholic oils used in a specific context.
Category 6, namely Sound, ranked sixth with an average of 45.6% across three
subcategories. The highest score of 56.8% was attained by Subcategory 6.1: Suspicious or
Abnormal Sounds of Explosive Devices, while the lowest, at 33.3%, was observed in
Subcategory 6.3: Other Suspicious Sounds.
55
The respondents marked Category 1 - Appearance and Physiological Reactions, with an

average of 43,8% across seven subcategories. Respondents identified subcategory 1.7
Clothes/Dressing in Actual Weather, Local and Religious Context, Representing a Specific
Group as the easiest to detect and observe, with a score of up to 60%. On the other hand,
only 24.4% of respondents identified subcategory 1.6 Other Physiological Reactions as
being easily detectable and observable.
Category 5 finished eighth Behaviour and Communication, with an average of 38.8% for
its 12 subcategories, as seventh in terms of ease of detection and observation. Subcategory
5.2, General Travel and Transportation Behaviour, was identified by 57.7% of respondents
as easily detectable and observable. The lowest value, 8.8%, was obtained by Subcategory
5.9, Paralinguistics, which represents the overall lowest value among all research
subcategories.
The final category is number 9 with an average of 37.8% from three subcategories.
Subcategory 9.1 Insider threat risk indicators in connection to facilities or transportation
dealing with CBRN and explosive materials achieved the best result with a value of 51.1%,
whereas subcategory 9.3 Change in personal life had the worst result with a value of 26.7%.
Upon comparing all subcategories, it can be deduced that Subcategory 3.5, pertaining to
IEDs, guns, military objects, and other dangerous objects achieved the highest score of
77.8%. In contrast, the lowest value from all subcategories, 8.8%, was obtained by
Subcategory 5.9, Paralinguistics.
Are identified risk indicators in literature and case studies reviews useful for the training
activities?
The data collected from question 6.1 of the questionnaire were examined to derive the
outcomes. The analysis of respondent answers shown in Graph 9 unequivocally confirmed
that the identified risk indicators are useful for training activities of security entities. 82%
out of 49 respondents stated that they are useful, and 10% chose the answer "Partially yes."
Only one respondent chose the answer "No" without further explanation or comment.
Several respondents who chose the answer "Yes" provided positive comments on the list
of identified indicators for training activities, such as "Crucial for training in preventive
security. It is great to have this list with assessed results" or "Very relevant for training."
56
Graphs F No. 9 containing results from Question 6.1 – Usefulness of risk indicators and
their categories for training
Q 6.1 Usefulness of risk indicators

and their categories for training
activities?
6% 2%
10% Yes
Partially yes
No
82%
I´dont know
Final comments and recommendations in the questionnaire from participants
The respondents have generally expressed their support for this research and satisfaction
with the identified risk indicators. Some examples: “The list is particularly comprehensive,
so you can't miss a thing”, “Very interesting research. Look forward to results”, “Good to
be published” or “Very useful research.” One of the respondents expressed the opinion,
that these indicators could be linked with certain situations/scenarios.
Some have also expressed the need to supplement the list with additional indicators, such
as special means of transportation, money flows, digital imprint, monitoring the content of
AI searches, thefts of old laboratory equipment, checking out individual hobbies, personal
collections of chemicals, detectors, educational background, data on past mental health
medical history (history of Suicidal behaviours, mental breakdowns, erratic or aggressive
behaviour displays, etc.), literature (finding out library´s borrowing records on specific
book titles, e.g., on war, war agents used in the past, technologies, chemistry etc.), and
financial background profiling. Regarding the risk of a State Threat, individuals with
military training and expertise may be recruited to carry out CBRN attacks. Tactics for
detecting or revealing law enforcement surveillance equipment may also be utilized to
remain undetected. These additional indicators can help identify potential CBRN threats
beyond those related to digital technologies and can enhance the ability to prevent future
attacks.
Another interesting critical opinion was presented by one of the participants in the way,
that the method of identifying risk indicators through behavioural detection requires
knowledge from various fields and is only a portion of the investigation. Relying solely on
57
this method is not advisable. Additionally, a behavioural specialist is needed for the
investigation and should be well-informed about all relevant information. However, if the
specialist is not a law enforcement officer, there is a potential security concern. The next
critical comment has to be taken into account as well: “I think your list of risk indicators is
pretty much complete. But there's a big difference between analysing a threat behind a desk
and being in the field. There are a lot of indicators in your list, which means there are a lot
of variables you have to keep track of.” This statement confirms the earlier conclusions,
emphasizing the importance of considering multiple factors when observing and
interpreting the behaviour of individuals, objects, and events in the environment, whether
it's monitoring CCTV footage or engaging in fieldwork operations.
Finally, the comprehensive and valuable comment coming from a UK police officer with
work experience of over 15 years highlights the importance of the whole list with the
following comment: “During any investigation, there is a requirement to gather every and
all information available and the list, though very extensive cannot be exhaustive. Having
experience in the gathering of this information in an investigation, and the courts' process,
then everything on the list plays a vital part in the criminal proceedings. This is evident in
some trials where the smallest, and less relevant piece of evidence, when added to the
whole 'picture', can become the vital part of the jigsaw. Therefore, the above risk
indicators are valuable both individually and as a whole. No one part should be ignored
or disregarded, especially when there are a number of them together or leading on from
one another. It may not need further investigation but enough to arouse professional
suspicion may be enough. Thank you for this list. I saw a few that I'd not really considered
and some to confirm that we are identifying the salient indicators. I was pleased to see
that the list did not explain or justify some of the indicators; and that the observer or
enquiry will have the ability to see these for what they are whether taken alone or a number
of indicators taken together”.
58
5. DISCUSSION
Criminal activities associated with CBRN materials and explosives are not prevalently
represented in statistics. Nonetheless, they cause significant strain on security forces as
they require specific intervention methods involving a wide range of responding units.
Detecting them in their early stages can thus alleviate the burden on the security system. It
is therefore appropriate to address behavioural and observational analysis in the detection
of risk indicators and connect it with different terrorist theories. Although profiling in
protective security and covert operations is often considered ineffective and raises ethical
questions, several studies mentioned in previous chapters have emphasized its necessity,
and several studies cited earlier have stressed its importance, as long as it is carried out
skilfully and not relied upon as the sole means of uncovering criminal activity.
At the beginning of the research project, the ambitions were significant and posed a
challenge. There were doubts about the accessibility, usefulness and reliability of the open-
source data required for analysis, but the involvement of ISEMI Institute and law
enforcement and intelligence agencies from several countries was reassuring and helped in
providing important inputs. The amalgamation of analysed scientific and non-scientific
literature data, case studies, and CCTV footage with the professional opinions of
experienced officers during the survey has enabled the creation of a list of risk indicators,
their respective categories, and their prioritization. However, the ensuing analytical
discourse on the identified articles in the systematic review and the subsequent unearthing
of pertinent data therein served as the bedrock for the formulation of the catalogue of risk
indicators. The following lines enumerate the most pivotal articles and scientific works that
are being discussed and interlinked with the results of other analyses like case studies
CCTV records review and the questionnaire survey.
Planning of an attack involving CBRN and/or explosive materials and radicalisation

process indicators
The systematic literature review pointed out, that the planning phase of a CBRN-E terrorist
attack encompasses a vast array of risk indicators, particularly those related to the intent
and capabilities, the selection of targets (Asal et al., 2009) and hazardous materials to be
used in the attack based on vulnerability assessments and surveillance provided by the
terrorist group (Nance, 2014). According to Sullivan and Perry (2004), Khalsa and Gordon
(2004), Toleubayev et al. (2022) and Kolencik (2018), this phase also includes the
acquisition and/or production of CBRN and explosive materials their transportation,
acquisition of facilities and tools for their processing, and weaponization, storage,
acquisition or/and production of dispersion devices, as well as training, testing and dry
runs. The planning phase of a terrorist attack can also include illegal trade and smuggling
of radioactive materials. In this context, The International Atomic Energy Agency
published a report in 2002 on measures to prevent, intercept, and respond to illicit uses of
nuclear material and radioactive sources. As noted by Williams and Woessner (2002) in
the above report, one key point made is the difficulty in identifying risk indicators for
59
nuclear smuggling due to the variability and complexity of criminal organizations. A

similar opinion was presented in this research survey by one of the respondents in the final
comments, therefore while using the detection techniques multisectoral cooperation has to
be put in place. Among the indicators mentioned in the above study, suspicious financial
transactions, identity fraud, unusual travel patterns, unlicensed transport, unusual storage
or shipping containers, radioactivity detection equipment, links to organized crime, and
subtle indicators are highlighted. However, Williams and Woessner (2002) emphasize that
these indicators alone are not conclusive proof of nuclear smuggling and require further
investigation. The above findings were taken into account when developing the final list of
indicators as the output of this research. In connection with indicators related to the
acquisition and production of CBRN and explosive materials, there is a very limited range
of publicly available documents and systematic review from open sources was hence
hindered. However, one of the open-source documents from the US Joint Counterterrorism
Assessment Team (N.D.) contains detailed risk indicators for the acquisition and
production of TATP, which can aid in the interception of planned terrorist attacks. The
main aspects were also included in the final list of this research.
Fredholm (2016) discusses important aspects of lone-actor terrorism and the potential use
of CBRN weapons. He highlights several risk indicators that can potentially identify
individuals who are at risk of carrying out lone actor attacks using CBRN weapons, e.g.,
gun and fertilizers procurement, and specific digital behaviour. These risk indicators
include; fixation on an ideology, history of violence, access to knowledge and weapons,
and willingness to die for a cause, which was also reflected in the final list of indicators.
Fredholm concludes that although it is difficult to predict lone actor attacks, identifying
individuals who display these risk indicators can aid in prevention and intervention efforts.
The cited statement aligns with the terrorism theories identified in the literature review and
affirms the necessity to address operational terrorist behaviour and the way of acting
(Nance, 2014; Alexander, 2019). One such theory that plays a crucial role in this context
is the socio-economic theory (Sun et al., 2022), as terrorism is affected by socioeconomic
disparities.
The following identified research papers do not mention risk indicators specifically related
to CBRN and explosives, but their findings can be applied to the development of strategies
for their detection. These studies discuss warning signs for criminal behaviour in general,
such as those in Rader and Haynes (2014) and Weiss et al. (2006). Nonetheless, they can
still be useful in research that compares general crime indicators with CBRN and explosive
risks. For example, Shaw and Stock's (2011) study on the behavioural risk indicators for
malicious insider theft of intellectual property can be used as a case in point. Similarly,
Bulling et al. (2008) described the insider threat model in relation to several types of factors
influencing behaviour, in which they defined different categories of warning signs, which
finally helped in the development of the last category of risk indicators in this study.
However, this area in connection to facilities dealing with CBRN material should be more
deeply researched in future studies. All of the literary sources that have been analyzed
above need to be comprehended and assessed within the framework of terrorist theories.
60
This is because the motives of the perpetrators and the radicalisation process are crucial in
identifying indicators of risk behaviour (Decker and Pyrooz, 2011).
Smith et al. (2011) examine the pre-attack behaviours of terrorists and provide insight into
how such attacks can be prevented. The authors use a combination of empirical data,
statistical methods, and case studies to identify patterns of behaviour that are indicative of
terrorist planning and preparation. They identified key pre-incident indicators that are often
present before a terrorist attack, including prolonged observation of targets and surrounding
areas, acquisition of weapons and explosives, surveillance of potential escape routes, and
efforts to blend in with the environment. The authors also examine geographic and
temporal patterns of terrorist activity, such as the use of specific communication channels,
travel routes, and modes of transportation. The researchers argue that the identification of
pre-incident indicators can be an effective tool in preventing terrorist attacks. By
recognizing certain behaviours or patterns, law enforcement agencies and security
personnel can take proactive measures to disrupt or prevent attacks from occurring.
However, as evidenced in the Sinai study (2022), the success of prevention depends on the
quality of collaboration between various security forces, similarly as highlighted in the
comments from experienced respondents within this research survey.
Radicalisation warning signs can be also easily connected to planning an attack, especially
during the recruitment process for a specific terrorist act, especially where they are
connected to the root causes described for example by Bouhana (2013). In his work, he
analyses the recruitment of individuals into terrorist groups through various means. Two
opposing perspectives are presented on the issue of recruitment, one arguing that personal
grievances, social isolation, perceived injustice, and radical ideology are the root causes of
terrorist recruitment, while the other argues that recruitment is a strategic and intentional
process employed by terrorist groups to achieve their political objectives. The author
presents evidence supporting both arguments, citing studies showing a correlation between
socio-economic factors and terrorism, as well as studies that demonstrate the use of
sophisticated recruitment methods by terrorist groups. The author concludes that
addressing the root causes of terrorism and disrupting the recruitment process are both
necessary for effective counter-terrorism strategies. The aforementioned conclusions can
be linked to certain opinions expressed by participants of the survey conducted as part of
this study, who emphasized in their comments the necessity of timely detection of risk
indicators of radicalization to prevent planned attacks carried out by radicalized
individuals. In light of these arguments, the document "Homegrown Violent Extremist
Mobilization Indicators” developed by the US National Counterterrorism Center (2017)
concludes that there are identifiable risk indicators that can help predict whether an
individual is at risk of becoming a violent extremist. These risk indicators are divided into
three categories: A, B, and C. Category A indicators are the most concerning and include
behaviours such as expressing a desire to participate in violent extremist activities,
possessing or accessing weapons, and advocating violence to achieve a political or social
goal. Category B indicators are somewhat concerning and include behaviours such as
expressing extremist ideologies, withdrawing from social activities, and exhibiting
61
aggressive behaviour. Category C indicators are the least concerning but still warrant
monitoring. These indicators include behaviours such as social isolation, financial
problems, and drug or alcohol abuse, which is also partially connected to socio-economic
terrorist theory (Freytag et al., 2011). The above analysis including suggestions from
survey participants related to lone wolf actors was also connected with Insider threat
indicators developed in the final list.
US National Counterterrorism Center (2021) additionally developed another valuable

guide on US Violent Extremism Mobilization indicators which follows the previous
document. The text introduces three different types of indicators related to potential attacks
or violent extremist travel: Mobilization Indicators, Preparation Indicators, and Motivation
Indicators. The Mobilization and Preparation Indicators suggest that an attack or travel may
be about to happen or occur in the near future, while Motivation Indicators build or
communicate violent beliefs, but don't automatically suggest an imminent attack. The text
cautions that some of these indicators may be protected by law and shouldn't be the sole
basis for investigative activity. Hence, additional evidence is necessary to determine if the
observed behaviour is indicative of pre-operational planning associated with terrorism and
thus reportable.
Other authors who have provided specific examples of behavioural indicators generated
from real terrorist attacks are Davis et al. (2013). Their work represents a comprehensive
analysis of the research base for predicting violent acts through the observation of
behavioural indicators. The authors examine various studies that support the use of
behavioural indicators in predicting terrorist behaviour, including threat assessment
procedures, individual risk factors, and situational factors. They also identify limitations
and challenges in using these indicators. The paper concludes that using behavioural
indicators holds promise for identifying potential violent acts, but further research and
validation are necessary to improve the accuracy and reliability of this approach.
An important aspect of preparing for a terrorist attack is the intent and capabilities of the
terrorist group or lone wolf. For both groups, there are corresponding risk indicators that
help identify potential terrorist activities, which were critically discussed in Schuurman
and Eijkman's work (2015). The authors argue that traditional methods of threat assessment
are often inadequate to prevent terrorist attacks, and an analysis of indicators such as
tactical, behavioural, technological and social can be more effective. Their work provides
a framework for threat assessment based on a combination of these indicators. Schuurman
and Eijkman (2015) emphasize the importance of considering both intent and capability in
developing such a framework. They recommend the wider application of these indicators
for the improved detection and prevention of terror activities. The authors argue that
assessing intent alone is insufficient for identifying potential threats, as many individuals
or groups may have radical ideologies or beliefs without the means or opportunity to carry
out an attack. In addition to intent, the authors suggest evaluating indicators of capability,
such as access to weapons or explosives, funding sources, and prior training or experience
in carrying out attacks. Schuurman and Eijkam (2015) outline several other specific
62
indicators that may be useful in threat assessment, including surveillance of potential

targets, communication with other extremists, and attempts to acquire weapons or
explosives. Overall, the authors provide a useful framework for understanding the complex
factors involved in assessing and responding to terrorist threats and was an important input
for the survey preparation. Strom et al.'s (2010) findings support the abovementioned
concepts. They elaborate on utilizing criminal actions as signals of terrorism. Their study
discovered that more than 80 percent of foiled terrorist plots in the United States from 1999
to 2009 were recognized by law enforcement officials and ordinary citizens who observed
dubious behaviours. The authors Kelling and Bratton believe that police officers are in a
unique position to prevent terrorist attacks by quickly reacting to signals of suspicious
behaviour reported by citizens or observed firsthand. The above could have also been
applied to the Manchester attack as it was possible to notice during the case study and
CCTV footage review. Unfortunately, certain psychological or personal factors did not
allow the patrol police officer at that time to act despite the clear observed risk indicators.
Another essential input to the description of risk indicators in this research comes from
Meloy et al. (2012). Based on previous criminal and terrorist cases, they developed a
typology of warning behaviours indicating potential threats divided into eight categories in
threat assessment. The authors emphasize the need for a comprehensive approach to threat
assessment, which includes not only identifying warning behaviours but also evaluating
other factors such as access to weapons, history of violence, and mental health status. They
conclude that a better understanding of warning behaviours can help to prevent violence
and promote early intervention and treatment for individuals at risk. Data mining in
connection to risk indicators represents another strategic aspect of preventive law
enforcement work (Silke, 2008). These research survey results have confirmed similar
conclusions.
All the above-discussed items were integrated into the list of risk indicators for assessment
by respondents (Appendix A) as Category 5 - Behaviour and Communication, Category 7
– Radicalisation indicators and criminal activity from Data mining and Category 9 – Insider
threats, together with the results of the case studies review. Ultimately, the mentioned
categories were deemed important for the work of security units by the respondents.
Although, it is imperative to observe and interpret the behaviour and communication of
individuals with great caution and without tunnel vision, as mentioned by one of the survey
respondents, for example, showing interest in a subject pertaining to CBRN may not
necessarily signify an alarm trigger.
An integral aspect of planning terrorist attacks, in general, is currently the utilization of

cyberspace and new technologies, which was also confirmed by survey participants
according to some final comments in the questionnaire. Therefore, it is important to also
consider digital behavioural indicators, which can be detected by relevant security entities.
Pressman and Ivan (2019) focus in their work on how extremist groups use the Internet as
a tool to disseminate their propaganda and recruit new members. The authors lay out a
Cyber-VERA protocol, aimed at detecting individuals who are prone to participate in
63
violent extremism, by analysing their online activity. The protocol considers factors such
as the person's online social network, their search history, and patterns of online activity.
It also points out that regulatory measures, such as removing violent extremist content from
social media platforms, should be taken to prevent the spread of radicalization. Further
utilization of new technologies is being discussed, for instance, by Ayed et al. (2019). The
authors use video data of individuals exhibiting normal and suspicious behaviour to train a
machine-learning algorithm. After extracting facial features from the video data, the
algorithm is able to accurately identify suspicious behaviour in real-time. The authors
suggest that this technology could be used for security purposes in public spaces such as
airports and train stations. However, they acknowledge the need for further research to
improve the accuracy of the system and address ethical concerns related to the application
of facial recognition technology for surveillance. The expressions on a person's face hold
significant information regarding their emotional state, thoughts, feelings, and discomfort;
this is a result of the brain's response to different circumstances (Tuncer et al., 2023), which
might be interesting to investigate in connection to CBRN-E threats. Bisogni et al. (2023)
state that the estimation of emotions from facial expressions is a well-explored task in
computer vision, but it becomes more challenging in low-quality images acquired at a
distance. Most approaches and models show a decrease in performance when dealing with
these types of images. Recognizing emotions in real-time from a distance could be crucial
for smart video surveillance, particularly in managing certain situations, like political
meetings, to avoid potential negative or criminal behaviour.
The above suggests the usefulness of the application of new technologies and artificial
intelligence in the detection of risk indicators connected to facial expression while planning
terrorist acts in general or using CBRN and explosive material, but it is essential to take
into account several obstacles. Still, deeper scientific research by relevant experts should
be conducted to get more reliable data as the new technologies in this field are still under
development and testing. Digital indicators were created as a distinct category N. 4 within
the overall list for evaluation by practitioners.
Implementation of an attack involving CBRN and/or explosive material
The systematic research further highlighted that the implementation phase entails the actual
transport of CBRN and explosive agents to the target ready to be used under specific
conditions and behavioural patterns indicating the initiation of the attack by direct
dissemination or using specific devices. In some cases, it may also involve the extraction
of terrorist members from the site of the attack (Nance, 2014; Kolencik, 2018). During the
implementation, but partially also during the preparation of terrorist attacks employing
CBRN materials and explosives, so-called technological risk indicators such as their
chemical properties, activity, persistency, sound and odour, as well as physiological and
biological manifestations of an individual, such as symptoms of various illnesses or the
consequences of poisoning and ionizing radiation, play a role. However, when it comes to
the detection of CBRN materials using technological devices to uncover potential threats,
64
it is important to consider possible false alarms, as emphasized by one of the respondents

in the diploma questionnaire survey.
Kaszeta (2013) focuses on the threat of CBRN incidents at public events and the need for
greater preparedness and discusses the challenges of identifying and responding to
suspicious odours and unexplained illnesses. US Department of Homeland Security (N.D.)
provide also very useful information on different types of homemade explosives, where for
example risk indicators like smell are mentioned. In any case, Kaszeta's work was utilized
in the creation of a list of risk indicators and its significance was confirmed during the case
study analysis.
Suspicious sounds in a terrorist attack can range from escaping vapours, gunshots,
explosions, and breaking glass to screaming. While some sounds may be unmistakable,
others can be more difficult to identify or may be intentionally misleading Rudolph, 1993;
Niemann, 2010; Spicer, 2020. Therefore, it is important to take any suspicious sounds
seriously. Despite this fact, the respondents of this research survey were not entirely certain
in their responses regarding the reliability and relevance of the question. The category of
Sound was placed last in the first list of categories and fourth place in the second list, based
on an analysis of subcategories. The above could also be related to the fact that a loud noise
could be misconstrued as gunshots or an explosion, such as a car backfiring or fireworks.
Overreacting to such sounds can lead to false alarms and an unnecessary drain on resources
that could be better used elsewhere, like was the case of the Paris false alarm two days after
the attack at the Bataclan Theatre in 2015 (Kolencik, June 2021) that could be seen in the
footage of EURONEWS and Dailymotion (Euronews, 2015; Dailymotion, 2015). Several
indicators in this field were classified into separate categories for the odour of objects,
suspicious sounds, suspicious items, and technological/detection indicators.
Kaszeta (2013) highlights several real-world examples of CBRN incidents at major public
events, such as the 2001 anthrax attacks in the United States and the 1995 sarin gas attack
in the Tokyo subway. In this context, the visible symptoms following exposure to
biological pathogens, chemical substances and toxins, or ionizing radiation must also be
considered (Calder and Bland, 2018; Chilcott, 2010; Bland, 2014; Cerezo, 2011; Chauhan
et al., 2008; Cole, 2020; Dorner et al., 2016; Kamboj et al., 2006; Sferopoulos, 2009). Such
symptoms represent various risk indicators enabling the detection of potential threats from
an ongoing or planned attack, where suspicious individuals have come into contact with
CBRN materials. Some of the subcategories created from case studies were inserted into
the "Appearance and Physiological Reactions" category, along with indicators of CBRN
material contamination. However, based on the diploma questionnaire survey, it was found
that this category is less relevant in detecting criminal activity. The above was confirmed
by several respondents directly in the comments. Nevertheless, it mainly concerns the
general appearance of observed persons. Signs of health problems after potential
contamination with CBRN agents were among the more highly rated subcategories and can
certainly play a significant role in police work.
65
Non-verbal communication plays also an important role in criminal conduct, but it is not
reading the body language and making immediate conclusions. The systematic literature
review identified this category as one of the very important aspects of behavioural detection
even though without any connection to CBRN and explosive materials. However, Denault
et al. (2020) argue that a lack of critical analysis has resulted in the widespread use of
scientifically unfounded techniques, which have the potential to lead to false accusations
and wrongful convictions. The authors also emphasize the importance of using
scientifically validated methods for analysing nonverbal communication to ensure that
these techniques remain credible and reliable in legal settings. Koller et al. (2015)
implemented an interesting experiment. The results showed that participants could infer
criminal intentions from nonverbal cues such as manipulating a mobile phone without any
purpose, fidgeting, frequent glances, and avoiding eye contact. The study suggests that
nonverbal behaviour can provide important clues to criminal intentions, and can potentially
be used to identify and prevent criminal behaviour when the baseline is preliminary set in
the right way and when all scale of different behavioural indicators is taken into account.
Suspicious manipulation with certain objects as part of criminal behaviour (Koller et al.
2015a) is necessary to connect with suspicious items well analyzed by Morewitz (2019)
and also by Barrera (2017) in connection to Bomb threats in the Philippines, which can be
certainly applied also to other parts of the world due to the general modus operandi seen
also during the CCTV footages review in this diploma study.
Vrij et al., (2019) state that while nonverbal cues can aid in detecting deception, they should
not be solely relied upon, and instead, a combination of verbal and nonverbal cues should
be considered for accurate deception detection, which was also confirmed by this research
during the survey and the work of Newman et al. (2003). Vrij et al., (2019) provide valuable
insights into how nonverbal communication can be used to detect deception and highlight
the importance of understanding the limitations and potential biases associated with the use
of nonverbal cues in deception detection. However, another authors, Bogaard et al., (2016)
discuss, that verbal cues are less variable, but even so, several investigative techniques have
not clearly demonstrated effectiveness. As sorted from respondents’ comments in this
research survey, identifying falsehoods is a complex undertaking that demands expertise
and consistent practice while acknowledging that personal biases and decision-making
capabilities can interfere with our lie-detection abilities. One of the primary issues is the
incorrect interpretation of deceitful cues.
The aforementioned scientific papers and articles often encompass highly general groups
of risk indicators. Nevertheless, by virtue of amalgamating them with case study analyses
and CCTV recordings of terrorist incidents, it was feasible to particularize specific human
activities, objects, or phenomena evocative of suspect behaviour.
66
Interconnection of the literature, case studies, and CCTV footage review with the survey
results
Analysis of multiple cases based on document study and CCTV footage revealed that the
behaviour of terrorists using explosives and CBRN materials has a specific character.
Almost all cases shared the common feature of preparation for the attack in the form of a
dry run or testing specific actions at the location of the attack. In many instances, as also
stated by one of the questionnaire respondents, the perpetrators were dressed differently
during the reconnaissance phase of the target than during the actual attack, or their
appearance was altered, which can hinder the work of security forces. Another common
feature, observed in some cases such as the Yperite attack at the Tbilisi airport, was the
fact that the attacker returned to the scene of the crime several hours after the actual act,
dressed differently. Wearing head coverings and avoiding the camera system were
additional elements that were incorporated into the risk indicators in a large number of
analysed cases, such as the Manchester Arena, Sri Lanka churches, and Tbilisi airport
terrorist acts.
Following the previous discussion primarily based on the literature and case studies review,
it is necessary to also discuss the results of the questionnaire survey. There are multiple
perspectives from which one can interpret them. One angle is the assessment of their
relevance and reliability, and how easily they can be detected within profiling in protective
security. Due to the small sample size of respondents, it is not possible to confidently
declare that the acceptance of identified risk indicators in this study as relevant and reliable
can be universally considered a valid practice. However, because of the limited number of
experts working in the field of CBRN-E terrorism in Europe, the results may hold some
informative value.
The ability to perceive the behaviour of other people and phenomena around us and
consequently to identify risk indicators is influenced by various factors, as extensively
discussed in numerous literary sources (Jones, 1976; Malle, 2011; Greenberg et al., 2013;
Bloom and Bloom, 2017; Taylor et al., 2016; Caber et al., 2020; Zhang et al., 2021;
Kolencik, November 2021). These aspects pertain to both internal and external factors that
affect the observers' perception, such as experience, knowledge, needs, bandwagon effect,
overall health conditions, etc. as well as those of the criminals, who possess sophisticated
capacities to conceal their criminal behaviour. The aforementioned concept may have
played a role in the evaluation of the generated risk indicators by experienced officers of
law enforcement and intelligence agencies. Furthermore, the participants' discernment of
the detectability and observability of the identified risk indicators in this research survey
was validated as being linked to their expertise and their age. According to the Chi-Square
test, the survey results demonstrate (Appendix D) a marked significant disparity between
younger and older individuals with longer expertise in the field. It appears that those who
are younger with less working experience tend to place less importance on provided risk
indicators and find them more difficult to detect and observe, whereas their older
counterparts tend to hold the opposite view. Furthermore, the data suggests that those aged
67
55 and above tend to find the provided risk indicators in this study more relevant than their
younger colleagues. It is necessary to reiterate that the sample of respondents is too small
to qualify the confirmation of these findings, therefore further research would be important
to implement.
The results of the survey also confirmed another interesting fact. The highest relevance was
achieved with those risk indicators and their categories that contained more tangible
evidence and did not rely solely on behavioural detection, which is often ineffective.
Although several literary sources cited in the previous chapters confirmed the importance
of profiling activities, their combination with the use of biometric and risk-based screening,
thermal imaging and detection devices at border crossings and airports during passenger
inspection is much more effective (Cavusoglu et. al, 2013; Dankiewicz, 2012). This is also
confirmed by the conclusions of the prioritization of risk indicators in the survey, where
Technological/Detection alarm risk indicators achieved placement on the first two ranks of
relevance and reliability in both lists. This category also ranked first in terms of ease of
detection/observation of risk indicators. The Behaviour and Communication category
ranked lower in all results and finished in eighth place in the response to question 5.3
regarding ease of detecting/observing. This theory is also confirmed by other results, in
which physical evidence, such as the presence of a weapon or explosives in a passenger's
luggage - subcategory 3.5, or data from official databases on the previous criminal
behaviour of a suspect from category 7, were perceived by survey respondents as easier to
detect than people's behaviour, which cannot be easily read. Subcategories 5.8 Non-verbal
and 5.9 Paralinguistic cues obtained the lowest scores among all the subcategories, as
respondents marked them as the least easy to detect and observe. The aforementioned
conclusions also corroborate several identified theories and works cited in the literature
and systematic literature review emphasizing the unreliability of relying solely on
behavioural techniques for detecting suspicious behaviour, respectively recommending
cautious and professional employment of profiling methods (Wigginton et al., 2014; Satish,
et al., 2023) in conjunction with other methods (Cavusoglu and Kwark, 2013).
Despite the above findings of the questionnaire survey, it is necessary to consider all risk
indicators, including the behaviour and communication of suspicious or observed
individuals. Their relevance is indisputable, but as mentioned by some respondents in their
comments, it requires a professional approach in profiling based on objective assessment,
observation, and interpretation without prejudice, the results of which must be thoroughly
vetted, primarily through an interview and the use of relevant detection technologies.
As can be gleaned from the responses of the respondents with regard to the relevance of
the identified risk indicators for training activities, a significant majority deem them
pertinent. Furthermore, several comments unequivocally attest to the necessity of regularly
implementing training in this area, which is also established in the conclusions of various
aforementioned scientific studies (CPNI, HM Government, N.D.; Feijoo-Fernández et al.,
2023; Van der Auwera et al., 2018; Boelaert et al., 2021).
68
Limitations
Among the weaknesses of the research, it is possible to include the inability to assess how
authors publishing risk indicators in several identified literature have arrived at their
conclusions or executed the research. Only some of the scholarly articles reviewed
contained a description of the methodology used to achieve their results, e.g., using
experiments or case studies. Therefore, the informative value of some indicators from the
systematic literature review might be weak, although, on the other hand, the generated
indicators were confirmed by analysed case studies, video analysis and practitioner analysis
within the survey. As stated by one of the survey respondents, there is no recognized
methodology for comparing and evaluating developed risk indicators. It is also crucial to
emphasize that the number of respondents who participated in the survey is not adequate
to validate the accuracy of these results while using quantitative methods. On the other
hand, the number of experts working in this specific field within the security forces is very
limited. We did not explore the extent of respondents' practical experience in uncovering
CBRN and explosive criminal activities, identifying risk indicators, and the degree to
which subjective assessment influenced their responses to the questionnaire.
69
6. CONCLUSION
The analysis of literature, case studies, and CCTV records unequivocally confirmed the
conclusions drawn from the preliminary literature review during the research project
preparation. It highlighted the lack of long-term research in the detection of criminal
activity risk indicators, involving CBRN and explosive materials.
On the other hand, a broad spectrum of intriguing scientific works based on experiments,
previous cases, or hypothetical scenarios defining risk indicators related primarily to
radical extremism, terrorism in general, has been identified. It is worthy of note, however,
that while not the focal point of this study, such literature is not as comprehensive when it
comes to criminal activities concerning CBRN materials, aside from a few exceptions, and
only partially touches upon explosive materials. Similarly, there are various signs typically
associated with different forms of terrorist incidents that could apply to CBRN and
explosive substances, given they are correctly identified, understood, and contrasted with
the existing baseline within a specific setting.
At the same time, several investigated and identified research articles pointed out the
necessity of using predictive profiling in detecting risk indicators in connection with
terrorist attacks (Fernández, 2021; Cavusoglu and Kwark (2013). However, other articles
emphasized caution when using it in protective security because there are various
challenges (Kaluza, 2013; Frank et al., 2008; Committee on Science, Space, and
Technology House of Representatives, 2011, pp. 70, 72; Dankiewicz, 2012;) and possible
negative impacts (Barr et.al, 2022; Denault et al., 2020; Michalski et.al., 2020; Carr et al.,
2020). It was also found that there is no scientifically verified methodology for detecting
risk indicators, despite some attempts.
Thus, an exhaustive roster of risk indicators and classifications was developed (enclosed
in Appendix A) and assessed by proficient Law enforcement and Intelligence agencies
personnel working in counterterrorism related to CBRN and explosives. Following analysis
and interpretation of the survey outcomes, the catalogue was subsequently revised (found
in Appendix E).
The survey explored the most suitable risk indicators and categories for detection tactics
and training activities. Results showed that the majority of respondents considered the
identified categories and risk indicators as reliable and relevant to their work. Prioritization
of individual categories and subcategories by relevance, ease of detection/observability,
and usefulness for training was also conducted. The findings revealed that technological
detection/air sampling alarm risk indicators were considered the most reliable and easiest
to detect/observe, while appearance and physiological reactions were deemed the least
reliable and hardest to detect/observe. All of the identified risk indicators were considered
useful for training activities.
70
7. RECOMMENDATIONS
The research results might become the first tool for further study in developing the
recognised methodology. Additionally, it would be appropriate to stimulate more critical
discussion within the systematic literature review, but the lack of specific articles on risk
indicators associated with CBRNE criminal activity has hindered this possibility.
As evidenced by the survey results and comments of the respondents, the generated list of
risk indicators is a useful tool not only for operational and investigative activities of
security forces but also for training purposes. It is recommended that for further
improvement of the list, specific subcategories and indicators could be assigned to
scenarios related to possible CBRN-E terrorist attacks and that they be tested through
simulated experiments and consequent training and exercises in natural settings. However,
the created list of indicators can also be regularly updated in conjunction with national
threat assessments and national security analyses. It is also recommended to be
disseminated to various worldwide Law enforcement and Intelligence agencies.
It would be equally advantageous to undertake corresponding research in a different

geographical area as set up in this study to compare the findings after the identification of
relevant agencies able to provide experienced practitioners. Another important aspect to be
included in future research is an analysis of selected CCTV records by various security
actors to examine risk indicators from an alternate perspective and to compare with results
generated in this study. An all-encompassing investigation of the application of novel
technologies in conjunction with a human behavioural detection system for the purpose of
detecting warning signs of explosive and CBRN dangers would prove to be particularly
advantageous.
Lastly, it is important to mention that subcategory 2.3 may appear discriminatory at first
glance, as it may be related to a certain type of religion. However, it is crucial to perceive
it in a specific context based on the analysis of previous terrorist cases. Any form of
discrimination, as repeatedly mentioned in previous chapters, cannot be integrated into
profiling methods, as it would violate human rights and undermine ethical principles. In
light of the results of the questionnaire survey as well as the aforementioned scientific
studies, it would be imperative to ensure continuous training in the area of risk indicator
detection, which could equally address the age gaps identified in the survey concerning the
assessment of the relevance, reliability and detectability of risk indicators.
71
REFERENCES
1. Abrahms, M. (2008). What Terrorists Really Want: Terrorist Motives and
Counterterrorism Strategy. International Security, 32(4), 78–105.
doi:10.1162/isec.2008.32.4.78
2. Ackerman, G. A. (2018). Chemical, biological, radiological and nuclear (CBRN)

terrorism. In Routledge handbook of terrorism and counterterrorism (pp. 240-252).
Routledge.
3. Adler, R. H. (2022). Trustworthiness in qualitative research. Journal of Human

Lactation, 38(4), 598-602.
4. Agnew, R. (2016). General strain theory and terrorism. The handbook of the criminology
of terrorism, 119-132. John Wiley & Sons, Inc.
5. Alexander, L. M. (2019). Terrorism: Theory and practice. Routledge.
6. Asal, V., Avdan, N., & Ackerman, G. (2023). Breaking taboos: Why insurgents pursue
and use CBRN weapons. Journal of Peace Research, 60(2), 193-208.
7. Asal, Victor H., Karl Rethemeyer, R., Anderson, Ian, Stein, Allyson, Rizzo, Jeffrey, &
Rozea, Matthew (2009). The Softest of Targets: A Study on Terrorist Target Selection.
Journal of Applied Security Research, 4(3), 258–278. doi:10.1080/19361610902929990
8. Ayed, M. B., Elkosantini, S., Alshaya, S. A., & Abid, M. (2019). Suspicious behavior
recognition based on face features. IEEE Access, 7, 149952-149958.
9. Barr, D., Drury, J., & Choudhury, S. (2022). Understanding collective flight responses
to (mis) perceived hostile threats in Britain 2010-2019: a systematic review of ten years of
false alarms in crowded spaces. Journal of risk research, 25(7), 825-843.
10. Barrera, D. J. S. (2017). Bomb threats and reports of suspicious items in the Philippines:
Spatial and temporal patterns. Security Journal, 30, 665-685.
11. Binder, M. and Ackerman, G. (2021). Pick your POICN: Introducing the profiles of
incidents involving CBRN and non-state actors (POICN) database. Studies in Conflict and
Terrorism 44(9): 730–754.
12. Binder, M. K., & Ackerman, G. A. (2021). Pick your POICN: Introducing the profiles
of incidents involving CBRN and non-state actors (POICN) database. Studies in Conflict
& Terrorism, 44(9), 730-754.
72
13. Bisogni, C., Cimmino, L., De Marsico, M., Hao, F., & Narducci, F. (2023). Emotion
recognition at a distance: The robustness of machine learning based on hand-crafted facial
features vs deep learning models. Image and Vision Computing, 104724.
14. Bland, S. A. (2014). Chemical, Biological, Radiological and Nuclear (CBRN) Casualty
Management Principles. Conflict and Catastrophe Medicine: A Practical Guide, 747-770.
15. Blandón-Gitlin, I., Fenn, E., Masip, J., Yoo, A.H. (2014). Cognitive-load approaches
to detect deception: searching for cognitive mechanisms. Trends Cogn Sci 18(9):441–444.
https://doi.org/10.1016/j.tics.2014.05.004
16. Bloom, C. and Bloom, L. (2017). The Bandwagon Effect - Are we going to think for
ourselves? In: Psychology today. Available at:
https://www.psychologytoday.com/us/blog/stronger-the-broken-places/201708/the-
bandwagon-effect
17. Boelaert, A., Thys, B., & Van Hoey, M. (2021). RooT37–CUTA’s TRA Tool in
Response to a Changing Threat Landscape. In Terrorism Risk Assessment Instruments (pp.
193-204). IOS Press.
18. Bogaard, G., Meijer, E., H., Vrij, A, Merckelbach, H. (2016) Scientific Content
Analysis (SCAN) Cannot Distinguish Between Truthful and Fabricated Accounts of a
Negative Event. In: JOURNAL Frontiers in Psychology, Volume 7, 2016,
DOI=10.3389/fpsyg.2016.00243. Available at:
https://www.frontiersin.org/article/10.3389/fpsyg.2016.00243
19. Bolt, H. M., & Hengstler, J. G. (2022). Recent research on Novichok. Archives of
toxicology, 96(5), 1137-1140. DOI: https://doi.org/10.1007/s00204-022-03273-7
20. Bonelli, L. (2023). Chapitre 9. Renseignement intérieur et antiterrorisme en France. In

Police et société en France (pp. 199-220). Presses de Sciences Po.
21. Bonnemain, A., Perrot, É., & Kostulski, K. (2015). Le processus d’observation, son
développement et ses effets dans la méthode des autoconfrontations croisées en clinique de
l’activité. Activités, 12(12-2). Available at: https://doi.org/10.4000/activites.1111
22. Bouhana, N. (2013). Recruitment of terrorists. In Capacity building in the fight against
terrorism (pp. 70-73). IOS Press.
23. Brewer, N., Wei Ying, A.B., Young, R.L., Nah, Y. (2018). Theory of mind and the
detection of suspicious behavior. J Appl Res Mem Cogn 7(1): 123–131.
https://doi.org/10.1016/j.jarmac.2017.09.006
73
24. Brewin, C. R., Fuchkan, N., Huntley, Z., Robertson, M., Thompson, M., Scragg, P., ...
& Ehlers, A. (2010). Outreach and screening following the 2005 London bombings: usage
and outcomes. Psychological medicine, 40(12), 2049-2057.
25. Bryman, A. (2016). Social research methods. Oxford University Press.
26. Brynielsson, J., Horndahl, A., Johansson, F., Kaati, L., Mårtenson, C., & Svenson, P.
(2013). Harvesting and analysis of weak signals for detecting lone wolf terrorists. Security
Informatics, 2, 1-15.
27. Bulling, D., Scalora, M., Borum, R., Panuzio, J., & Donica, A. (2008). Behavioral
science guidelines for assessing insider threats. Public Policy Center, University of
Nebraska. Available at:
https://digitalcommons.unl.edu/cgi/viewcontent.cgi?article=1036&context=publicpolicyp
ublications
28. Caber, M., González-Rodríguez, M. R., Albayrak, T., & Simonetti, B. (2020). Does
perceived risk really matter in travel behaviour? Journal of Vacation Marketing, 26(3),
334-353.
29. Calder, A., & Bland, S. (2018). CBRN considerations in a major incident. Surgery
(Oxford), 36(8), 417-423.
30. Carr, A., Biswas, T., & Wheeler, J. V. (2020). Airport operations and security
screening: An examination of social justice. Journal of Air Transport Management, 85,
101814.
31. Cavusoglu, H., Kwark, Y., Mai, B., & Raghunathan, S. (2013). Passenger profiling and
screening for aviation security in the presence of strategic attackers. Decision Analysis,
10(1), 63-81.
32. Cerezo, L. (2011). Radiation accidents and incidents. What do we know about the
medical management of acute radiation syndrome? Reports of Practical Oncology and
Radiotherapy, 16(4), 119-122.
33. Chauhan, S., D’cruz, R., Faruqi, S., Singh, K. K., Varma, S., Singh, M., & Karthik, V.
(2008). Chemical warfare agents. Environmental Toxicology and Pharmacology, 26(2),
113-122. https://doi.org/10.1016/j.etap.2008.03.003
34. Gunning, J. (2009). Social movement theory and the study of terrorism. Critical
terrorism studies: A new research agenda, 156-177.
35. Chilcott, R. P. (2010). CBRN contamination. Textbook of Environmental Medicine.

London: Hodder Arnold, 475-486.
74
36. Cole, L. A. (2020). The spectre of biological weapons. In Bioterrorism: The History of
a Crisis in American Society (pp. 100-105). Routledge.
37. Committee on Science, Space, and Technology House of Representatives. (2011).

Behavioral science and security: Evaluating TSA’s SPOT program. Hearing before the
subcommittee on investigations and oversight committee on science, space, and
technology: House of Representatives. Retrieved from
http://www.gpo.gov/fdsys/pkg/CHRG-112hhrg65053/pdf/CHRG-112hhrg65053.pdf
38. Conway, M. (2021). Online extremism and terrorism research ethics: Researcher safety,
informed consent, and the need for tailored guidelines. Terrorism and political violence,
33(2), 367-380.
39. CPNI, HM Government (N.D.). Behavioural Detection Brochure – Best practise,

guidance and advice. Available at:
https://www.cpni.gov.uk/system/files/documents/03/73/CPNI0068_Behavioural_Detectio
n_Brochure_DIGITAL_V8.pdf
40. Creswell, J. W., Hanson, W. E., Clark Plano, V. L., & Morales, A. (2007). Qualitative
research designs: Selection and implementation. The counseling psychologist, 35(2), 236-
264.
41. Dahl, R. A. (1952). Importance of observation in law enforcement. The Journal of

Criminal Law, Criminology, and Police Science, 43(1), 103-113. Available at:
https://doi.org/10.2307/1139010
42. Dailymotion. (2015, November 16). Attentats de Paris: mouvements de foule sur les
lieux de recueillement. [Video]. https://www.dailymotion.com/video/x3dx13z
43. Dando, C. J., & Bull, R. (2018). Maximising opportunities to detect verbal deception:
Training police officers to interview tactically. In Investigating the Truth (pp. 190-205).
Routledge.
44. Dankiewicz, M. (2012). Methods of detecting potential terrorists at airports. Security

Dimensions. International and National Studies, (07), 33-46.
45. Davis, P. K., Perry, W. L., Brown, R. A., Yeung, D., Roshan, P., & Voorhies, P. (2013).
Using behavioral indicators to help detect potential violent acts: A review of the science
base (p. 306). Santa Monica, CA: RAND. Available at:
https://apps.dtic.mil/sti/trecms/pdf/AD1157639.pdf
46. Decker, S., & Pyrooz, D. (2011). Gangs, terrorism, and radicalization. Journal of
Strategic Security, 4(4), 151-166.
75
47. Denault, V., Plusquellec, P., Jupe, L. M., St-Yves, M., Dunbar, N. E., Hartwig, M., ...
van Koppen, P. J. (2020). The analysis of nonverbal communication: The dangers of
pseudoscience in security and justice contexts. Anuario de Psicología Jurídica, 30, 1-12.
https://doi.org/10.5093/apj2019a9
48. Doosje, B., Moghaddam, F. M., Kruglanski, A. W., De Wolf, A., Mann, L., & Feddes,
A. R. (2016). Terrorism, radicalization and de-radicalization. Current Opinion in
Psychology, 11, 79-84.
49. Dorner, B. G., Zeleny, R., Harju, K., Hennekinne, J. A., Vanninen, P., Schimmel, H.,
& Rummel, A. (2016). Biological toxins of potential bioterrorism risk: Current status of
detection and identification technology. TrAC Trends in Analytical Chemistry, 85, 89-102.
50. Ellison, D. H. (2007). Handbook of chemical and biological warfare agents. CRC press.
51. Émond, J. (2011). Flux et sécurité: le passager dans l'aéroport canadien (Doctoral
dissertation, University of Ottawa (Canada).
52. Euronews. (2015, November 16). Paris attacks: Crowd erupts into panic at memorial,
false alarm. [Video]. https://www.youtube.com/watch?v=yDJvnWgREQw
53. European Parliament – TERR Committee (2018). Member states´ preparedness for
CBRN threats. Available at:
https://www.europarl.europa.eu/RegData/etudes/STUD/2018/604960/IPOL_STU(2018)6
04960_EN.pdf
54. Evison, D., Hinsley, D., & Rice, P. (2002). Chemical weapons. Bmj, 324(7333), 332-
335. https://doi.org/10.1136/bmj.324.7333.332
55. Exploring the boundaries of big data (Vol. 32, pp. 145-173 ). Amsterdam University
Press/WRR.
56. Fainberg, A. (2009). The Terrorist Threat to Inbound US Passenger Flights: Inadequate
Government Response. Homeland Security Affairs, 5(1).
57. Fair, C. C. (2014). The 2008 Mumbai Attack. In The Evolution of the Global Terrorist
Threat: From 9/11 to Osama bin Laden's Death (pp. 571-599). Columbia University Press.
58. Feijoo-Fernández, M. C., Halty, L., & Sotoca-Plaza, A. (2023). Like a cat on hot bricks:
The detection of anomalous behavior in airports. Journal of Police and Criminal
Psychology, 38(1), 72-82.
59. Fenn, L., & Brunton-Smith, I. (2021). The effects of terrorist incidents on public worry
of future attacks, views of the police and social cohesion. The British Journal of
Criminology, 61(2), 497-518.
76
60. Ferenbok, J., & Clement, A. (2012). Hidden Changes: from CCTV to ‘Smart ’ video
surveillance. Eyes everywhere: The global growth of camera surveillance, 218-234.
61. Fernández, M. D. C. F. (2021). Guardia Civil’s ÍCARO teams: Behaviour analysis at

airports and ports. Cuadernos de la Guardia Civil: Revista de seguridad pública, (66), 111-
125. ISSN: 2341-3263.
62. Fossey, E., Harvey, C., McDermott, F., & Davidson, L. (2002). Understanding and
evaluating qualitative research. Australian & New Zealand journal of psychiatry, 36(6),
717-732.
63. Franc, R., & Pavlović, T. (2023). Inequality and radicalisation: systematic review of
quantitative studies. Terrorism and political violence, 35(4), 785-810.
64. Frank, M. G., Menasco, M. A., & O’Sullivan, M. (2008). Human behavior and
deception detection. Handbook of science and technology for homeland security, 5, 1-12.
65. Fredholm, M. (2016). Lone actor terrorism and CBRN weapons. In Understanding
Lone Actor Terrorism (pp. 220-234). Routledge.
66. Freilich, J. D., & LaFree, G. (Eds.). (2017). Criminology theory and terrorism: New
applications and approaches. Routledge.
67. Freytag, A., Krüger, J. J., Meierrieks, D., & Schneider, F. (2011). The origins of
terrorism: Cross-country estimates of socio-economic determinants of terrorism. European
Journal of Political Economy, 27, S5-S16.
68. FRONTEX, Operationalisation of Common Risk Indicators. Travelling terrorists and

other ‘subjects of interest’ – Empowering border – control authorities to make better-
informed decisions. FRONTEX, 2018 – 42 p.
69. Ganesan, K., Raza, S. K., & Vijayaraghavan, R. (2010). Chemical warfare agents.
Journal of pharmacy & bioallied sciences, 2(3), 166–178. https://doi.org/10.4103/0975-
7406.68498
70. Garrison, A. H. (2004). Defining terrorism: Philosophy of the bomb, propaganda by

deed and change through fear and violence. Criminal Justice Studies, 17(3), 259-279.
71. GENERAL ACCOUNTING OFFICE WASHINGTON DC. (2005). US Postal Service:

Guidance on Suspicious Mail Needs Further Refinement. Defence Technical Information
Center. Available at: https://apps.dtic.mil/sti/pdfs/ADA436161.pdf
72. Granhag, P.A., Mac Giolla, E. (2014). Preventing future crimes. Eur Psychol
19(3):195–206. https://doi.org/10.1027/1016-9040/a000202
77
73. Greenberg, M. I., Curtis, J. A., & Vearrier, D. (2013). The perception of odor is not a
surrogate marker for chemical exposure: a review of factors influencing human odor
perception. Clinical Toxicology, 51(2), 70-76.
74. Gruen, N. S. A. M. (2010). The Attempted Christmas Day 2009 Attack on Northwest
Flight 253. Available at:
https://citeseerx.ist.psu.edu/document?repid=rep1&type=pdf&doi=6d00d5a1ac92c82631
b262b0a20bebbfe4bdb70e
75. Haner, M., & Sloan, M. M. (Eds.). (2021). Theories of Terrorism: Contemporary
Perspectives. Routledge.
76. Harper, J. (2009). Terrorism and Security Systems, Cato Institute. United States of
America. Retrieved from https://policycommons.net/artifacts/1314450/terrorism-and-
security-systems/1917741/ on 20 Jul 2023. CID: 20.500.12592/3z7b04.
77. Heesen, R., Bright, L.K. & Zucker, A. (2019) Vindicating methodological
triangulation. Synthese 196, 3067–3081. Available at: https://doi.org/10.1007/s11229-016-
1294-7
78. Helmus, T. C. (2009). Why and how some people become terrorists. Social science for
counterterrorism, 74(06-C), 71.
79. Horgan, J. G. (2017). Psychology of terrorism: Introduction to the special issue.

American Psychologist, 72(3), 199.
80. Iserte, M. (2008). Enquête en «zone d’attente réservée» de l’aéroport de Paris-Charles

de Gaulle: vers une gestion sécuritaire des «flux migratoires». Cultures & conflits, 71, 31-
53.
81. Islam, M. A., & Aldaihani, F. M. F. (2022). Justification for adopting qualitative
research method, research approaches, sampling strategy, sample size, interview method,
saturation, and data analysis. Journal of International Business and Management, 5(1), 01-
11.
82. Jan, A., & Khan, G. M. (2023). Real-world malicious event recognition in CCTV
recording using Quasi-3D network. Journal of Ambient Intelligence and Humanized
Computing, 14(8), 10457-10472.
83. Joint Chiefs of Staff. (2010). Antiterrorism. Available at:

http://www.dtic.mil/doctrine/docnet/courses/operations/icdjo/resources/JP3_07X2.pdf
84. Jones, E. E. (1976). How do people perceive the causes of behavior? Experiments based
on attribution theory offer some insights into how actors and observers differ in viewing
the causal structure of their social world. American Scientist, 64(3), 300-305.
78
85. Joshua D. Freilich & Gary LaFree (2015) Criminology Theory and Terrorism:
Introduction to the Special Issue, Terrorism and Political Violence, 27:1, 1-8,
DOI:10.1080/09546553.2014.959405
86. Kaluza, B. (2013). Detection of Anomalous and Suspicious Behavior Patterns from
Spatio-Temporal Agent Traces. Available at: https://slais.ijs.si/theses/2013-05-30-
Kaluza.pdf
87. Kamboj, D. V., Goel, A. K., & Singh, L. (2006). Biological warfare agents. Defence
Science Journal, 56(4), 495.
88. Kaszeta, D. (2013). Suspicious Odors and Unexplained Illness. CBRN and Hazmat
Incidents at Major Public Events, 351.
89. Kääriäinen, E.S., Kanste, Pölkki, M. O., Utriainen, T. K. & Kyngäs, H. (2014).
Qualitative Content Analysis: A Focus on Trustworthiness. SAGE Open, 4(1).
https://doi.org/10.1177/2158244014522633
90. Khalsa, S., & Gordon, M. (2004). Forecasting terrorism: Indicators and proven analytic
techniques. Lanham, MD: Scarecrow Press. Available at:
https://citeseerx.ist.psu.edu/document?repid=rep1&type=pdf&doi=b6f110741ec89451da
b0fab46eeb70265f291a96
91. Koehler, D., & Popella, P. (2020). Mapping far-right chemical, biological, radiological,
and nuclear (CBRN) terrorism efforts in the west: Characteristics of plots and perpetrators
for future threat assessment. Terrorism and Political Violence, 32(8), 1666-1690.
92. Kolencik, M. (June, 2021). CBRN-E crime and offenders' motives, ISEM Institute,
Slovakia, Version 5. DOI: 10.13140/RG.2.2.11835.34083
93. Kolencik, M. (2021). Criminal and Terrorist Profiling (Lecture I. – Law Enforcement
in Central Asia – www.project.leica.eu, EU funded project). November 2021, ISEM
Institute, www.isemi.sk. https://doi.org/10.52824/BMER5598
94. Kolencik, M. (November 2021). National ToT on the identification of FTF and
profiling techniques - Criminal and Terrorist Profiling, Law Enforcement In Central Asia
(LEICA) funded by the EU. DOI: 10.52824/BMER5598
95. Kolencik, M. (2023). Research project. A critical evaluation of the risk indicators of
criminal conduct involving CBRN and explosive materials. University of Essex
96. Kolencik, M., (2018). Role of Police and Intelligence Agencies in the fight against
CBRN terrorist threats. Postgraduate diploma thesis, CBRN Security Management,
University of Lodz.
79
97. Koller CI, Wetter OE, Hofer F. (2015). What Is Suspicious When Trying to be
Inconspicuous? Criminal Intentions Inferred From Nonverbal Behavioral Cues.
Perception. 44(6), 679–708. https://doi.org/10.1177/0301006615594271
98. Koller, C.I., Wetter, O.E., Hofer, F. (2015a). What is suspicious when trying to be
inconspicuous? criminal intentions inferred from nonverbal behavioral cues. Perception
44(6):679–708. https://doi.org/10.1177/0301006615594271
99. Kreissl, R., Norris, C., Krlic, M., Groves, L., & Amicelle, A. (2014). Preventing and
detecting crime and terrorism. Surveillance in Europe, 150-210.
100. Krieger, T., & Meierrieks, D. (2011). What causes terrorism? Public Choice, 147, 3-
27.
101. Kurtulus, E. N. (2017). Terrorism and fear: do terrorists really want to scare? Critical
Studies on Terrorism, 10(3), 501-522.
102. LaFree, G., & Freilich, J. D. (2017). Bringing criminology into the study of terrorism.
The handbook of the criminology of terrorism, 3-14.
103. Lammerant, H., & de Hert, P. (2016). Predictive profiling and its legal limits:
Effectiveness gone forever. In B. van der Sloot, D. Broeders, & E. Schrijvers (Eds.),
104. Leistedt, S. J. (2013). Behavioural aspects of terrorism. Forensic Science

International, 228(1-3), 21-27.
105. Lia, B. and Skjølberg, K. (2004). Causes of Terrorism: An Expanded and Updated
Review of the Literature, FFI/RAPPORT-2004/04307, Norwegian Defence Research
Establishment, Kjeller
106. Ljujic, V., Versteegt, I., Weerman, F., Thijs, F., van Prooijen, J. W., El Bouk, F., &
van de Weijer, S. (2020). Testing a Threat Model of Terrorism: A multi-method study
about socio-economic and psychological influences on terrorism involvement in the
Netherlands. Understanding recruitment to organized crime and terrorism, 147-171.
107. Lowe, D. (2020). Manchester Arena Bombings: main lessons that have been learnt.
Counter IED Report. Available at:
https://eprints.leedsbeckett.ac.uk/id/eprint/7450/1/ManchesterArenaBombingsMainLesso
nsThatHaveBeenLearntPV-LOWE.pdf
108. Maguire, M. (2014). Counter-terrorism in European airports. The anthropology of

security: Perspectives from the frontline of policing, counter-terrorism and border control,
118-38. Pluto-press.
80
109. Malle, B. F. (2011). Attribution theories: How people make sense of behavior.
Theories in social psychology, 23, 72-95.
110. Marrin, S. (2011). The 9/11 terrorist attacks: A failure of policy not strategic
intelligence analysis. Intelligence and National Security, 26(2-3), 182-202.
111. McCann, W. S. (2023). Islamic extremism and CBRN terrorism. Terrorism and
political violence, 35(3), 594-614.
112. McNeil-Willson, R. (2021). Here be dragons: Navigating the problems of researching

‘terrorism ’ and critical terrorism studies. In Lorraine CHARLES, Ilan PAPPE and Monica
RONCHI (eds), Researching the Middle East: cultural, conceptual, theoretical and practical
issues, Edinburgh: Edinburgh University Press, pp. 88-114 -
https://hdl.handle.net/1814/72078. Retrieved from Cadmus, EUI Research Repository
113. Meijer, A., & Wessels, M. (2019). Predictive policing: Review of benefits and
drawbacks. International Journal of Public Administration, 42(12), 1031-1039.
114. Meloy, J. Reid, Hoffmann, Jens, Guldimann, Angela, & James, David (2012). The
Role of Warning Behaviors in Threat Assessment: An Exploration and Suggested
Typology. Behavioral Sciences & The Law, 30(3), 256–279. doi:10.1002/bsl.999
115. Mertens, D. M. (2010). Transformative mixed methods research. Qualitative Inquiry,

16, 469-474.
116. Michalski, K., Jurgilewicz, M., Kubiak, M., & Grądzka, A. (2020). THE
IMPLEMENTATION OF SELECTIVE PASSENGER SCREENING SYSTEMS BASED
ON DATA ANALYSIS AND BEHAVIORAL PROFILING IN THE SMART
AVIATION SECURITY MANAGEMENT–CONDITIONS, CONSEQUENCES AND
CONTROVERSIES. Journal of Security & Sustainability Issues, 9(4).
117. Mills, T., Massoumi, N., & Miller, D. (2020). The ethics of researching ‘terrorism ’
and political violence: a sociological approach. Contemporary Social Science, 15(2), 119-
133.
118. Morewitz, S.J. (2019). Suspicious Objects. In: Clinical and Psychological
Perspectives on Foul Play. Springer, Cham. https://doi.org/10.1007/978-3-030-26840-4_9
119. Morrison, J., Silke, A., & Bont, E. (2021). The development of the framework for
research ethics in terrorism studies (FRETS). Terrorism and political violence, 33(2), 271-
289.
120. Nance, M. W. (2014). The terrorist recognition handbook. Third edition. Taylor and
Francis Group. ISBN – 13:978-1-4665-5457-3.
81
121. National Counterterrorism Center (2017). Homegrown violent extremist mobilization

indicators. Available at:
https://www.larimer.org/sites/default/files/uploads/2017/2017_homegrown_violent_extre
mist_mobilization_indicators.pdf
122. National Counterterrorism Center (2021). US Violent Extremism Mobilization

Indicators.
https://www.dni.gov/files/NCTC/documents/news_documents/Mobilization_Indicators_
Booklet_2021.pdf
123. Newman, M. L. et al. (2003). ‘Lying Words: Predicting Deception from Linguistic
Styles’, Personality and Social Psychology Bulletin, 29(5), pp. 665–675. doi:
10.1177/0146167203029005010.
124. Newsome, B. O., Stewart, J. W., & Mosavi, A. (2017). Countering New (est)
Terrorism: Hostage-Taking, Kidnapping, and Active Violence—Assessing, Negotiating,
and Assaulting. CRC Press.
125. Niemann, R. J. (2010). Common Chemicals as Precursors in Constructing Improvised

Explosive Devices. In Terrorism and Homeland Security. CRS Press. ISBN:
9780429250477.
126. Noble, H., & Smith, J. (2015). Issues of validity and reliability in qualitative research.
Evidence-based nursing, 18(2), 34-35.
127. O’Connor, T. R. (2018). The Criminology of Terrorism. Terrorism in America.

Routledge
128. Parasuraman, R., de Visser, E., Clarke, E., McGarry, W.R., Hussey, E., Shaw, T., ...
Mason, G. (2009). Detecting threat-related intentional actions of others: effects of image
quality, response mode, and target cuing on vigilance. J Exp Psychol, 15(4), 275. doi:
https://doi.org/10.1037/a0017132
129. Piza, E. L., Caplan, J. M., & Kennedy, L. W. (2014). Analyzing the influence of micro-
level factors on CCTV camera effect. Journal of Quantitative Criminology, 30, 237-264.
130. Post, J. M. (2010). “When hatred is bred in the bone:” the social psychology of
terrorism. Annals of the New York Academy of Sciences, 1208(1), 15-23.
131. Pressman, D. E., & Ivan, C. (2019). Internet use and violent extremism: A cyber-
VERA risk assessment protocol. In Violent Extremism: Breakthroughs in Research and
Practice (pp. 43-61). IGI Global.
82
132. Pusfitasari, E. D. (2018). Steps to Enhancing Chemical Security in Indonesia. Science

diplomacy. Available at: https://www.sciencediplomacy.org/letter-field/2018/steps-
enhancing-chemical-security-in-indonesia
133. Quillen, C. (2002). A historical analysis of mass casualty bombers. Studies in Conflict
and Terrorism, 25(5), 279-292.
134. Rabasa, A., Blackwill, R. D., Chalk, P., Cragin, K., Fair, C., Jackson, B. A., Jenkins,
B. M., Jones, S. G., Shestak, N., Tellis, A. J. (2009). The lessons of Mumbai (Vol. 249).
Rand Corporation.
135. Rader, N. E., & Haynes, S. H. (2014). Avoidance, protective, and weapons behaviors:
An examination of constrained behaviors and their impact on concerns about crime. Journal
of Crime and Justice, 37(2), 197-213.
136. Renard, T. (2021). Counter-Terrorism as a Public Policy: Theoretical Insights and

Broader Reflections on the State of Counter-Terrorism Research. Perspectives on
Terrorism, 15(4), 2–10. https://www.jstor.org/stable/27044231
137. Richards, C. (2020). Boyd’s OODA loop. Available at: https://fhs.brage.unit.no/fhs-

xmlui/bitstream/handle/11250/2683228/Boyds%20OODA%20Loop%20Necesse%20vol
%205%20nr%201.pdf?sequence=1&isAllowed=y
138. Roberts, D. (2016). Aviation Security and the Challenges the Industry Faces Providing
Safe and Secure Transportation. Available at:
https://www.researchgate.net/profile/Dexter-Roberts-
2/publication/316539988_Aviation_Security_and_the_Challenges_the_Industry_Faces_P
roviding_Safe_and_Secure_Transportation/links/5abae9810f7e9bad209bc3b7/Aviation-
Security-and-the-Challenges-the-Industry-Faces-Providing-Safe-and-Secure-
Transportation.pdf
139. Rudner, M. (2015). Intelligence-led air transport security: Pre-screening for watch-
lists, no-fly lists to forestall terrorist threats. International Journal of Intelligence and
Counterintelligence, 28(1), 38-63.
140. Rudolph, T. L. (1993). Explosives Vapor Detectors. FBI L. Enforcement Bull., 62,
19.
141. Santifort, C., Sandler, T., & Brandt, P. T. (2013). Terrorist attack and target diversity:
Changepoints and their drivers. Journal of peace research, 50(1), 75-90.
142. Satish, A. S., Mangal, A., & Churi, P. (2023). A systematic review of passenger
profiling in airport security system: Taking a potential case study of CAPPS II. Journal of
Transportation Security, 16(1), 1-41.
83
143. Schuurman, B., & Eijkman, Q. (2015). Indicators of terrorist intent and capability:
Tools for threat assessment. Dynamics of Asymmetric Conflict, 8(3), 215-231.
144. Segell, G. M. (2006). Terrorism on London public transport. Defense & Security
Analysis, 22(1), 45-59.
145. Sferopoulos, R. (2009). A Review of Chemical Warfare Agent (CWA) Detector

Technologies and Commercial-Off-The-Shelf Items. Defence Technical Information
Center. Available at: https://apps.dtic.mil/sti/pdfs/ADA502856.pdf
146. Shaffer, R. (2022). Counter-terrorism, intelligence and policing in Sri Lanka: a case
study of the 2019 easter terror attacks. Journal of Policing, Intelligence and Counter
Terrorism, 1-17.
147. Shaw, E. D., & Stock, H. V. (2011). Behavioral risk indicators of malicious insider
theft of intellectual property: Misreading the writing on the wall. White Paper, Symantec,
Mountain View, CA.
148. Shea, D. A. and Gottron, F. (2004). CRS report for Congress, Small-scale Terrorist
Attacks Using Chemical and Biological Agents: An Assessment Framework and
Preliminary Comparisons, Congressional Research Service ˜ The Library of US Congress
149. Silke, A., & Brown, K. (2016). ‘Radicalisation’: The transformation of modern
understanding of terrorist origins, psychology and motivation. In State, Society and
National Security: Challenges and Opportunities in the 21st Century (pp. 129-150).
150. Silke, A. (2008). Research on Terrorism: A Review of the Impact of 9/11 and the
Global War on Terrorism. Terrorism informatics: Knowledge management and data
mining for homeland security, 27-50.
151. Sinai, J. O. S. H. U. A. (2022). A framework for preempting lone-actor terrorists

during the pre-incident phase. Lone actor terrorism: An integrated framework, 304-329.
152. Smith, B.L., Damphousse, K.R., Roberts, P. (2011). Pre-Incident Indicators of

Terrorist Incidents: The Identification of Behavioral, Geographic and Temporal Patterns of
Preparatory Conduct. DIANE Publishing.
153. Soeparna, I., & Tanega, J. (2022). A Critical Assessment on Nuclear Security Measure
in Indonesia. Yuridika, 37(2), 317.
154. Spano, R. (2005). Potential sources of observer bias in police observational data.
Social science research, 34(3), 591-617. Available at:
https://doi.org/10.1016/j.ssresearch.2004.05.003
84
155. Spicer, B. (2020). Bomb threats and the case against immediate evacuation. In The
Professional Protection Officer (pp. 337-347). Butterworth-Heinemann.
156. Stelmach, J. (2017). Goals of terrorist attacks in the perspective of the indirect strategy
of terrorism. Zeszyty Naukowe/Wyższa Szkoła Oficerska Wojsk Lądowych im. gen. T.
Kościuszki.
157. Stojiljković, M. P. (2019). Nerve agents - a clear and present danger to mankind.
Scripta Medica, 50(3), 109-111.
158. Strom, K., Hollywood, J., Pope, M., Weintraub, G., Daye, C. and Gemeinhardt, D.
(2010). Building on Clues: Examining Successes and Failures in Detecting U.S. Terrorist
Plots, 1999-2009. Institute for Homeland Security Solutions. Available at:
http://sites.duke.edu/ihss/files/2011/12/Building_on_Clues_Strom.pdf
159. Sullivan, T. and Perry, W. L. (2004). Identifying Indicators of Chemical, Biological,

Radiological and Nuclear (CBRN) Weapons Development Activity in Sub-National
Terrorist Groups,” Journal of Operational Research and Society, Vol. 55, No. 4, April 2004,
pp. 361–374.
160. Sun, C., Abbas, H. S. M., Xu, X., & Abbas, S. (2022). The impact of socio-economic
and fractionalization determinants on terrorism in ESNA. Socio-Economic Planning
Sciences, 79, 101138.
161. Susser, D. (2021). Predictive policing and the ethics of preemption. The ethics of
policing: New perspectives on law enforcement, 268-292.
162. Syse, A. (2014). Breivik–the Norwegian terrorist case. Behavioral Sciences & the
Law, 32(3), 389-407.
163. Taylor, R. G., Brice, Jr, J., & Robinson, S. L. (2016). Perception deception: Security
risks created by optimistic perceptions. Journal of Systems and Information Technology,
18(1), 2-17.
164. Thomas, C. (2020). L’organisation fédérale de la lutte antiterroriste en Belgique.

Courrier hebdomadaire du CRISP, 24632464(18), 5-66.
165. Tin, D., Barten, D. G., De Cauwer, H., Mortelmans, L. J., & Ciottone, G. R. (2022).
Terrorist attacks in Western Europe: a counter-terrorism medicine analysis. Prehospital and
disaster medicine, 37(1), 19-24.
166. Tin, D., Granholm, F., Hart, A., & Ciottone, G. R. (2021). Terrorism-related chemical,
biological, radiation, and nuclear attacks: a historical global comparison influencing the
emergence of counter-terrorism medicine. Prehospital and disaster medicine, 36(4), 399-
402.
85
167. Toleubayev, T., Hoile, R., Austin, P., Collyer, G., Wood, R., Minks, S., Kolencik, M.
(2022) A Prosecutor's Guide to Chemical and Biological Crimes. UNITED NATIONS
INTERREGIONAL CRIME AND JUSTICE RESEARCH INSTITUTE. Available at:
https://www.researchgate.net/publication/360803303_A_Prosecutor's_Guide_to_Chemic
al_and_Biological_Crimes or https://unicri.it/Publication/Prosecutor-Guide-Chemical-
Biological-Crimes
168. Tuncer, T., Dogan, S., & Subasi, A. (2023). Automated facial expression recognition
using novel textural transformation. Journal of Ambient Intelligence and Humanized
Computing, 1-15.
169. United States Marine Corps (N.D.). Profiling and tactical tracking. Available at:
https://usmcofficer.com/wp-content/uploads/2014/02/Combat-Hunter-Profiling.pdf
170. US Department of Homeland Security (N.D.). Introduction to explosives. Available

at: https://info.publicintelligence.net/DHS-Explosives.pdf
171. US Joint Counterterrorism Assessment Team (N.D.). First responders toolbox -

TRIACETONE TRIPEROXIDE (TATP): INDICATORS OF ACQUISITION AND
MANUFACTURE, AND CONSIDERATIONS FOR RESPONSE
172. Van der Auwera, J., Van Daele, D., & Vervaeke, G. (2018). Predictive profiling as a
new counter-terrorism measure at Belgian airports. The reliability and validity of the
predictive profiling method: preliminary results and future research. In International
Conference On Behavioural And Social Sciences In Security (BASS 18).
173. Vrij, A., Hartwig, M., & Granhag, P. A. (2019). Reading lies: Nonverbal
communication and deception. Annual review of psychology, 70, 295-317.
174. Walsh, P. F. (2021). Evolving chemical, biological, radiological and nuclear (CBRN)
terrorism: Intelligence community response and ethical challenges. In National Security
Intelligence and Ethics (pp. 261-279). Routledge.
175. Weiss, E. M., Kohler, C. G., Nolan, K. A., Czobor, P., Volavka, J., Platt, M. M., ... &
Gur, R. C. (2006). The relationship between history of violent and criminal behavior and
recognition of facial expression of emotions in men with schizophrenia and schizoaffective
disorder. Aggressive Behavior: Official Journal of the International Society for Research
on Aggression, 32(3), 187-194.
176. Wigginton M. Jr., Jensen, C.J., Graves, M. & Vinson, J. (2014). What Is the Role of
Behavioral Analysis in a Multilayered Approach to Aviation Security?, Journal of Applied
Security Research, 9:4, 393-417, DOI: 10.1080/19361610.2014.942828
86
177. Wiles, R., Prosser, J., Bagnoli, A., Clark, A., Davies, K., Holland, S., & Renold, E.
(2008). Visual ethics: Ethical issues in visual research. Available at:
https://eprints.ncrm.ac.uk/id/eprint/421/1/MethodsReviewPaperNCRM-011.pdf
178. Wiliem, A., Madasu, V., Boles, W., & Yarlagadda, P. (2012). A suspicious behaviour
detection using a context space model for smart surveillance systems. Computer Vision
and Image Understanding, 116(2), 194-209. Available at:
https://doi.org/10.1016/j.cviu.2011.10.001
179. WILLIAMS, P., WOESSNER, P. N. (2002). NUCLEAR SMUGGLING:

ADAPTABILITY, ORGANIZED CRIME AND UNDERCOVER OPERATIONS In:
Measures to Prevent, Intercept and Respond to Illicit Uses of Nuclear Material and
Radioactive Sources, ISBN 92–0–116302–9, ISSN 1563–0153
180. Williams, T. (2019). Ideological and behavioural radicalisation into terrorism–An

alternative sequencing. Journal for Deradicalization, (19), 85-121.
181. Wilner, A. S., & Dubouloz, C. J. (2010). Homegrown terrorism and transformative
learning: an interdisciplinary approach to understanding radicalization. Global Change,
Peace & Security, 22(1), 33-51.
182. Yeo, K., & Rahmah, U. (2022). Change, Continuity and Trajectories. Counter
Terrorist Trends and Analyses, 14(5), 29-40.
183. Zammit, A. (2020). Operation Silves: Inside the 2017 Islamic State Sydney Plane Plot.
CTC Sentinel, 13(4), 1-13.
184. Zhang, F., Fan, Z., Kang, Y., Hu, Y., & Ratti, C. (2021). “Perception bias”:
Deciphering a mismatch between urban crime and perception of safety. Landscape and
Urban Planning, 207, 104003.
BIBLIOGRAPHY
1. Brayne, S., Rosenblat, A., & Boyd, D. (2015). Predictive policing. Data & Civil Rights:
A New Era Of Policing And Justice, 2015-1027.
2. Dolnik, A. (2008). 13 Years since Tokyo: Re-Visiting the “Superterrorism” Debate.

Perspectives on Terrorism, 2(2), 3-11.
3. Freilich, J. D. & LaFree, G. (2015). Criminology Theory and Terrorism: Introduction to

the Special Issue, Terrorism and Political Violence, 27:1, 1-8, DOI:
10.1080/09546553.2014.959405
4. Jiang, M., Cui, P., & Faloutsos, C. (2016). Suspicious behavior detection: Current trends
and future directions. IEEE intelligent systems, 31(1), 31-39.
87
5. McGuirk, N. K. (2019). An evaluation of the theory and the practice of terrorist profiling
in the identification of terrorist characteristics. University of Birmingham. Ph.D. Available
at: https://etheses.bham.ac.uk/id/eprint/8917/
6. McGuirk, N. K. (2021) Terrorist profiling and law enforcement – detection, prevention,

deterrence. Routledge. ISBN: 978-0-367-43776-3
7. Mehran, R., Oyama, A., & Shah, M. (2009, June). Abnormal crowd behavior detection
using social force model. In 2009 IEEE conference on computer vision and pattern
recognition (pp. 935-942). IEEE.
8. Vennam, P., TC, P., BM, T., Kim, Y. G., & BN, P. K. (2021). Attacks and preventive
measures on video surveillance systems: A review. Applied Sciences, 11(12), 5571.
9. Vrij, A., & Granhag, P. A. (2012). Eliciting cues to deception and truth: What matters
are the questions asked. Journal of Applied Research in Memory and Cognition, 1(2), 110-
117.
88
APPENDIXES
APPENDIX A – SURVEY QUESTIONNAIRE
Questionnaire including the preliminary list of risk indicators after systematic literature,
case studies and CCTV records review.
Full version of this appendix containing the preliminary list of all risk indicators is intended
solely for the law enforcement and intelligence agencies and archives of the University of
Essex. Therefore, it is not fully provided in this publication. Questionnaire parts 1 – 3 and
details from parts 4 - 6 are not publicly available.
A CRITICAL EVALUATION OF THE RISK INDICATORS OF

CRIMINAL CONDUCT INVOLVING CBRN AND EXPLOSIVE
MATERIALS
(BEHAVIOURAL AND OBSERVATIONAL ANALYSIS IN CRIME DETECTION AND
INVESTIGATION)
Survey
4. RELIABILITY AND RELEVANCY OF IDENTIFIED CATEGORIES OF RISK

INDICATORS FOR LAW ENFORCEMENT OR INTELLIGENCE AGENCIES
DUTIES
4.1 According to your experience in the detection and investigation of Crime, are all the
above-identified categories in the literature and case studies review reliable and relevant for
the operational activities and investigation of the crime involving CBRN and explosive
materials?
YES☐ PARTIALLY YES ☐ NO ☐ I DON’T KNOW
☐
If Partially yes, please select
one or more of those
categories that are not If No, explain why in the comments!
reliable and relevant and
describe the reason why in
the comments:
1. APPEARANCE AND
PHYSIOLOGICAL
REACTIONS ☐
2. BODY, ITEMS OR
SUBSTANCES SMELL
☐
89
3. ITEMS, DOCUMENTS,
OBJECTS AND OTHER
BELONGINGS DETECTED ON
THE PERSON
(RADICALIZATION OR
CRIMINAL ACTIVITY SIGNS)
☐
4. DIGITAL INDICATORS
☐
5. BEHAVIOUR AND
COMMUNICATION
☐
6. SOUND ☐
7. SPECIFIC INDICATORS
OF PREVIOUS
RADICALIZATION,
SUSPICIOUS OR CRIMINAL
ACTIVITIES OBTAINED
FROM DATA MINING
☐
8. TECHNOLOGICAL
DETECTION/AIR
SAMPLING ALARM RISK
INDICATORS ☐
9. INSIDER THREAT RISK

INDICATORS IN
CONNECTION TO
FACILITIES OR
TRANSPORTATION
DEALING WITH CBRN
AND EXPLOSIVE
MATERIALS ☐
Comments:
90
4.2 If you have answered Yes or Partially Yes to the previous question, according to your
experience in the detection and investigation of Crime, prioritize all above-identified categories
starting from the most relevant (1) until the less relevant (5) for your operational activities and
investigation of the crime involving CBRN and explosive material.
Values (1 = the most relevant, 2 = very relevant, 3 = relevant, 4 = relevant under certain
conditions, 5 = less relevant)
If you consider two or more categories to be on the same level, mark them with the same value,
E.g., you consider categories 1 and 4 to be equally relevant at the highest level, then you will mark
them both with the value 1 and mark the remaining categories with other values from 2 to 5. Other
examples: If you think all 9 categories have the same value of relevancy, mark them all with N. 1.
If you mark four categories with N. 1 and consider the remaining three categories less relevant but
at the same level, you mark them with N.2, etc.
1. APPEARANCE AND PHYSIOLOGICAL REACTIONS
2. BODY, ITEMS OR SUBSTANCES SMELL
3. ITEMS, DOCUMENTS, OBJECTS AND OTHER BELONGINGS DETECTED ON THE PERSON
(RADICALIZATION OR CRIMINAL ACTIVITY SIGNS)
4. DIGITAL INDICATORS
5. BEHAVIOUR AND COMMUNICATION
6. SOUND
7. SPECIFIC INDICATORS OF PREVIOUS RADICALIZATION, SUSPICIOUS OR CRIMINAL ACTIVITIES
OBTAINED FROM DATA MINING
8. TECHNOLOGICAL DETECTION/AIR SAMPLING ALARM RISK INDICATORS

9. INSIDER THREAT RISK INDICATORS IN CONNECTION TO FACILITIES OR
TRANSPORTATION DEALING WITH CBRN AND EXPLOSIVE MATERIALS
5. RELIABILITY AND RELEVANCY OF IDENTIFIED RISK INDICATORS FOR

LAW ENFORCEMENT OR INTELLIGENCE AGENCIES DUTIES
5.1 Are all above-identified risk indicators in the literature and case studies review reliable
and relevant for the operational activities and investigation of crime involving CBRN and
explosive materials?
YES☐ PARTIALLY YES ☐ NO ☐ I DON’T KNOW
☐
If Partially yes, please
select one or more of those
risk indicators that are not If No, explain why in the comments!
reliable and relevant and
the comments:
Comments:
5.2 If you have answered Yes or Partially Yes to the previous question, according to your
91
experience in the detection and investigation of Crime, mark the provided risk indicators and in
some cases sub-categories of risk indicators for each of the 9 categories and prioritise them for your
operational activities and investigation of crime involving CBRN and explosive material, starting
from the most relevant until the less.
Values (1 = the most relevant, 2 = very relevant, 3 = relevant, 4 = relevant under certain
conditions, 5 = less relevant)
Comments:
5.3 If you have answered Yes or Partially Yes to question 5.1, according to your experience in
the detection and investigation of Crime, assign to all provided risk indicators and in some cases to
their sub-categories a relevant value related to detectability/observability.
Values (1 = easy to detect/observe, 2 = possible to detect/observe, 3 = detectable/observable
under certain conditions, 4 = difficult to detect/observe, 5 = almost undetectable/observable)
Comments:
6. USEFULNESS OF IDENTIFIED RISK INDICATORS FOR TRAINING
6.1 Are risk indicators and their categories marked by you as reliable and relevant in this
questionnaire also useful to the training activities?
YES☐ PARTIALLY YES ☐ NO ☐ I DON’T KNOW ☐
If Partially Yes, please

select one or more risk
indicators that will not be If NO, please explain why in the comments.
useful and relevant for
your training activities and
the comments:
Comments:
92
7. OTHER IMPORTANT NOTES
1. Please identify any other risk categories or risk indicators not included in this questionnaire
which you think are relevant and useful for profiling in protective security and operational
activities concerning crime involving CBRN and explosive material.
2. Please provide any other information, comments or suggestions you think can be relevant and
useful for developing the categories and risk indicators.
END OF DOCUMENT
THANK YOU VERY MUCH FOR YOUR PARTICIPATION AND VALUABLE CONTRIBUTION!
APPENDIX B – Survey results Graphs
Graph 1 – Participants per country or EU agencies
PARTICIPATING COUNTRIES
FIN; 1
CEPOL; 1
SK; 6
BE; 6
FRONTEX; 1
D; 1 BIH; 3
EST; 1
CZ; 5
GRUZ; 6
UK; 3
FR; 6 PT; 6
LUX; 4
93
Graph 2 – Sex of respondents
SEX
3 2
44
Male Female Not stated
Graph 3 – Age groups
AGE GROUP
3 2 5
14
26
less than 35 35 to 45 45 to 55
more than 55 Not stated
Graph 4 – Years of experience in Law Enforcement and Intelligence agency
WORK EXPERIENCE
4
25
14
0-5 years 6-10 years 11-15 years More than 15 years
94
Graphs 5.1 and 5.2 containing answers for every category and subcategory of risk
indicators

identified categories of risk indicators
2%
4%
Yes
20%
Partially yes
74% No
I´dont know

identified risk indicators
2% 6%
18% Yes
Partially yes
74% No
I´dont know
95
Graphs 6.1 – 6.9 containing results from Question 4.2
The sum of 1, 2 and 3 = 76,6 %
The sum of 1, 2 and 3 = 70,2 %
96
The sum of 1, 2 and 3 = 89,3 %
The sum of 1, 2 and 3 = 89,4%
97
The sum of 1, 2 and 3 = 89,3%
The sum of 1, 2 and 3 = 61,7 %
98
The sum of 1, 2 and 3 = 89,1 %
The sum of 1, 2 and 3 = 93,6 %
99
The sum of 1, 2 and 3 = 85,1 %
Graphs No. 7.1 – 7.60 containing results from Question 5.2 – Relevancy of
subcategories and their risk indicators
The sum of 1, 2 and 3 = 69,5%
100
The sum of 1, 2 and 3 = 56,5 %
The sum of 1, 2 and 3 = 56,5%
101
The sum of 1, 2 and 3 = 46,7%
The sum of 1, 2 and 3 = 85,1
102
The sum of 1, 2 and 3 = 73,9
The sum of 1, 2 and 3 = 60,1%
103
The sum of 1, 2 and 3 = 54,3%
The sum of 1, 2 and 3 = 60,9%
104
The sum of 1, 2 and 3 = 42,2%
The sum of 1, 2 and 3 = 87,2%
105
The sum of 1, 2 and 3 = 83%
The sum of 1, 2 and 3 = 78,3%
106
The sum of 1, 2 and 3 = 39,1%
The sum of 1, 2 and 3 = 69,5%
107
The sum of 1, 2 and 3 = 89,1
The sum of 1, 2 and 3 = 91,5%
108
The sum of 1, 2 and 3 = 91,3%
The sum of 1, 2 and 3 = 84,4%
109
The sum of 1, 2 and 3 = 72,4%
The sum of 1, 2 and 3 = 80,5%
110
The sum of 1, 2 and 3 = 86,9%
111
The sum of 1, 2 and 3 = 91,3%
The sum of 1, 2 and 3 = 80,5%
112
The sum of 1, 2 and 3 = 78,3%
The sum of 1, 2 and 3 = 89,2%
113
The sum of 1, 2 and 3 = 93,4%
The sum of 1, 2 and 3 = 91,5%
114
The sum of 1, 2 and 3 = 91,6%
The sum of 1, 2 and 3 = 91,5%
115
The sum of 1, 2 and 3 = 91,5%
The sum of 1, 2 and 3 = 88,9%
116
The sum of 1, 2 and 3 = 91,4%
The sum of 1, 2 and 3 = 80,4%
117
The sum of 1, 2 and 3 = 82,2%
The sum of 1, 2 and 3 = 71,7%
118
The sum of 1, 2 and 3 = 67,4%
The sum of 1, 2 and 3 = 63,1%
119
The sum of 1, 2 and 3 = 84,7%
120
The sum of 1, 2 and 3 = 78,2%
The sum of 1, 2 and 3 = 84,8%
121
The sum of 1, 2 and 3 = 71,7%
122
The sum of 1, 2 and 3 = 73,9%
The sum of 1, 2 and 3 = 80,4%
123
The sum of 1, 2 and 3 = 84,8%
The sum of 1, 2 and 3 = 86,9%
124
The sum of 1, 2 and 3 = 89,1%
The sum of 1, 2 and 3 = 89,3%
125
The sum of 1, 2 and 3 = 89,3%
The sum of 1, 2 and 3 = 89,4%
126
The sum of 1, 2 and 3 = 89,4%
The sum of 1, 2 and 3 = 86,7%
127
The sum of 1, 2 and 3 = 82,6%
The sum of 1, 2 and 3 = 86,7%
128
The sum of 1, 2 and 3 = 86,7%
129
The sum of 1, 2 and 3 = 71,7%
130
Graphs 8.1 – 8.60 containing results from Question 5.3 – Observability and
Detectability of subcategories and their risk indicators
The sum of 1 and 2 = 48,9%
131
132
1
The sum of 1 and 2 = 53,3 %
133
The sum of 1 and 2 = 60%, Average for category: 43,8%
134
135
The sum of 1 and 2 = 60%, Everage for category = 48,8%
136
137
The sum of 1 and 2 = 60%
138
139
The sum of 1 and 2 = 55,6%, Everage for category: 55,8%
140
141
The sum of 1 and 2 = 57,7
142
143
The sum of 1 and 2 = 46,7
144
145
146
147
The sum of 1 and 2 = 28%
148
149
The sum of 1 and 2 = 40,9%, Everage for category = 38,8%
150
151
The sum of 1 and 2 = 33,3, Everage for category = 45,6%
152
153
154
155
156
157
158
159
Graph 9 containing results from Question 6.1 – Usefulness of risk indicators and their
categories for training
(49 responses)
Q 6.1 Usefulness of risk indicators and

their categories for training activities?
6% 2%
10%
Yes
Partially yes
No
82%
I´dont know
160
APPENDIX C – Survey results Tables

Table 3.1 Determining the relevance and reliability - Prioritisation of the risk
indicators categories based on results from question 4.2
Order Categories of risk indicators The sum of
the first three
values as a
percentage
1. Technological Detection/Air sampling alarm risk 93,6%
indicators
2. Digital indicators 89,4%
3. Items, documents, objects and other belongings 89,3%
detected on the person (radicalisation or criminal
activity signs)
3. Behaviour and communication 89,3%
5. Specific indicators of previous radicalisation, 89,1%
suspicious or criminal activities obtained from Data
mining
6. Insider threat risk indicators in connection to 85,1%
facilities or transportation dealing with CBRN and
explosive materials
7. Appearance and physiological reactions 76,6%
8. Body, items or substances smell 70,2%
9. Sound 61,7%
indicators categories based on results from question 5.2
Order Categories of risk indicators The average
of the sum of
the
percentage
results of
each
subcategory
expressed in
%
2. Technological Detection/Air sampling alarm risk 87,6%
indicators
suspicious or criminal activities obtained from
Data mining
4. Sound 81,2%
facilities or transportation dealing with CBRN
and explosive materials
161
7. Items, documents, objects and other belongings 77,3%

detected on the person (radicalisation or criminal
activity signs)
9. Appearance and physiological reactions 64%
indicators subcategories within the first Category based on results from question 5.2
Order Subcategories of the first Category - Digital The sum of
indicators the first two
values as a
percentage
1. Videos containing terrorist propaganda and 91,3%
information on CBRN and explosive materials
2. Application on browser searches detected by 87%
operational covert activities
3. Applications detected by covert operational 86,9%
activities in phones, computers and other
electronic devices utilised often by criminal
groups to cover their activities
indicators subcategories within the second Category based on results from question
5.2
Order Subcategories of the second Category - The sum of
Technological Detection/Air sampling alarm the first two
risk indicators values as a
percentage
1. Explosive detection technology alarm indicating 89,4%
the presence of the explosives or precursors on the
person or their belongings (must be verified by
confirmatory analysis/screening)
1. Radiation detector alarm confirming the presence 89,4%
of the nuclear and other radioactive materials on
the person or their belongings, eventually inside
the body of the person
3. Chemical detector alarm indicating the presence 89,3%
of the chemical hazard on the person or their
belongings (must be verified by confirmatory
analysis)
3. Biological detection technology alarm indicating 89,3%
the presence of the biological hazard on the person
or their belongings (must be verified by
confirmatory analysis)
5. Non-ionizing Radiation Scanning Equipment 86,7%
alarm showing the presence of a forbidden metal
item
162
6. Radio Frequency (RF) based Drone Detection 86,7%

System alarm indicating the drone threat in
combination with the observation of a person
manipulating the Remote-Control device
7. Ionizing Radiation Scanning Equipment alarm 82,6%
showing the presence of a forbidden item
indicators subcategories within the third Category based on results from question 5.2
Order Subcategories of the third Category - Specific The sum of
indicators of previous radicalisation, suspicious the first two
or criminal activities obtained from Data values as a
mining percentage
1. Data on monitored suspects obtained from other 89,1%

sources, e.g., Darkweb, Websites and social media
analytical tools, CCTVs analytical tools,
Operational activities of Law enforcement and
Intelligence agencies
2. Data on wanted terrorists/criminals obtained from 86,9%
international or EU organisations/bodies, e.g.,
Advance information – Terrorist watch list,
Interpol Red Notices, Stolen Administrative
Documents database, (SAD), Europol CBRN
incident database and European Bomb Data
System (EPE/EBDS), Europol information
system, etc.
3. Data on incidents with nuclear and other 84,8%
radioactive materials obtained from
Radiation/Nuclear authorities or IAEA
4. Data on diseases or chemical and biological 80,4%
incidents obtained from industrial, health and
environmental databases (outbreak - spreading of
certain diseases in certain regions, presence of
certain diseases close to the chemical facility, etc.)
5. Data on the travelling of suspects obtained from 73,9
travel databases
indicators subcategories within the fourth Category - based on results from question
5.2
Order Subcategories of the fourth Category - Sound The sum of
the first two
values as a
percentage
1. Suspicious or abnormal sounds of CBRN 87%
dispersal devices
163
2. Suspicious or abnormal sounds of explosive 84,8%

devices
3. Other suspicious sounds 71,7%
indicators subcategories within the fifth Category based on results from question 5.2
Order Subcategories of the fifth Category - Behaviour The sum of
and communication the first two
values as a
percentage
1. CBRN and explosive threat-related behaviour 91,4%
close to or at the beginning of the attack
(transportation and use of CBRN-E material),
during or after performing a criminal act
before the attack
3. Affiliation to groups through specific approach - 84,7%
behavioural radicalisation sign
4. UAV -unmanned aerial vehicles, UGV – 82,2%
unmanned ground vehicles and UWV – unmanned
water vehicles, etc. using related behaviour
5. Travel arrangement -the way of booking the travel 80,5/%
and hotel, means of payment, destinations – risk
countries, sudden change of destination, etc.
6. Vehicle driving-parking-related behaviour 80,4%
7. General travel and transportation behaviour 78,3%
8. Communication and interaction with other people 78,2%
– using symbols/putting them on buildings,
infrastructure or various objects
9. Verbal cues and written text 76%
10 Infrastructure related-behaviour 71,7%
11. Non-verbal cues 67,4%
12. Paralinguistic cues 63,1%
indicators subcategories within the sixth Category based on results from question 5.2
Order Subcategories of the sixth Category - Insider The sum of
threat risk indicators in connection to facilities the first two
or transportation dealing with CBRN and values as a
explosive materials percentage
1. Extensive monitoring of facility procedures or 86,7%
transportation vehicles and gathering needed
information or tools from inside
2. Change in professional behaviour 74%
3. Change in personal life 71,7%
164
Table 3.9 Determining the relevance and reliability indicators - Prioritisation of the
risk indicators within the seventh Category based on results from question 5.2
Order Subcategories of the seventh Category - Items, The sum of
documents, objects and other belongings the first two
detected on the person (radicalisation or values as a
criminal activity signs) percentage
1. IEDs, guns, military objects and other dangerous 91,5%
objects
2. Information and communication technologies – 91,3%
electronic devices
3. CBRN threat objects and items found on a person, 89,1%
in their luggage or car
4. Objects from illegal trafficking like artefacts, 84,4%
CITES species, drugs, etc.
5. Travel and personal documents 80,5%
6. Travel bags, suitcases, boxes and other related 78,3
items
7. Pills, medicines, drugs, first aid kit, etc. 72,4%
8. Belongings 69,5%
9. Body accessories - glasses, earrings, rings, 39,1%
jewellery, caps, etc.
indicators within the eighth Category based on results from question 5.2
Order Subcategories of the eighth Category - Body, The sum of
items or substances smell the first two
values as a
percentage
1. Items, clothes and substances smell related to 87,2%
explosives – chemical precursors
2. Objects, clothes and substances smell related to 83%
warfare or toxic industrial chemical agents
3. Items smell after being a long time closed in 60,9%
unventilated premises
4. Body smell due to poor hygiene or sudden change 54,3%
of the body smell
5. Parfum containing non-alcoholic oil used in a 42,2%
specific context
indicators within the ninth Category based on results from question 5.2
Order Subcategories of the ninth Category - The sum of
Appearance and physiological reactions the first two
values as a
percentage
165
1. Signs of health problems caused by CBRN agents 85,1%

after contamination or exposure when
manipulating them
2. Other physiological reactions 73,9

3. Body parts that raise suspicion – intention to hide 69,5%
something or as a part of a ritual or sign of
affiliation to a group
4. Clothes/dressing in the actual weather, local, 60,1%
religious and cultural context and representing a
specific group
5. Tattoos and other symbols - neo-nazist or ISIS 56,5%

tattoos, CBRN hazard tattoos, etc.
6. Wounds, injuries, amputations, battle or martial 56,5%
arts signs, combat fatigue, loss of vision and
hearing etc.
7. Body mutilation or modification - cosmetic 46,7%
surgery to some extreme forms of body
modification representing affiliation to a specific
group, beliefs or a ritual before an attack
Table 3.12 Easy and possible to detect/observe the risk indicators - Prioritisation of
the risk indicators categories based on results from question 5.3
Order Categories of risk indicators The average of
the sum of the
percentage
results of each
subcategory
expressed in %
1. Technological Detection/Air sampling alarm 67,1%
risk indicators
suspicious or criminal activities obtained from
Data mining
3. Items, documents, objects and other 55,8%
belongings detected on the person
(radicalisation or criminal activity signs)
6. Sound 45,6%
7. Appearance and physiological reactions 43,8%
facilities or transportation dealing with CBRN
and explosive materials
166
the risk indicators subcategories within the first Category based on results from
question 5.3
Order Subcategories of the first Category - The sum of
Technological Detection/Air sampling alarm the first two
risk indicators values as a
percentage
1. Ionizing Radiation Scanning Equipment alarm 72,8%
showing the presence of a forbidden item
2. Chemical detector alarm indicating the presence 71,1%
of the chemical hazard on the person or their
belongings (must be verified by confirmatory
analysis)
3. Explosive detection technology alarm indicating 71,1%
the presence of the explosives or precursors on the
person or their belongings (must be verified by
confirmatory analysis/screening)
4. Radiation detector alarm confirming the presence 68,9%
of the nuclear and other radioactive materials on
the person or their belongings, eventually inside
the body of the person
5. Non-ionizing Radiation Scanning Equipment 66,7%
alarm showing the presence of a forbidden metal
item
6. Biological detection technology alarm indicating 62,2%
the presence of the biological hazard on the person
or their belongings (must be verified by
7. Radio Frequency (RF) based Drone Detection 56,8%
System alarm indicating the drone threat in
combination with the observation of a person
manipulating the Remote-Control device
the risk indicators within the second Category based on results from question 5.3
Order Subcategories of the second Category - Specific The sum of
indicators of previous radicalisation, suspicious the first two
or criminal activities obtained from Data values as a
mining percentage
1. Data on wanted terrorists/criminals obtained from 66,6%
international or EU organisations/bodies, e.g.,
Advance information – Terrorist watch list,
Interpol Red Notices, Stolen Administrative
Documents database, (SAD), Europol CBRN
incident database and European Bomb Data
System (EPE/EBDS), Europol information
system, etc.
167
2. Data on monitored suspects obtained from other 62,2%

sources, e.g., Darkweb, Websites and social media
analytical tools, CCTVs analytical tools,
Operational activities of Law enforcement and
3. Data on incidents with nuclear and other 57,7%
radioactive materials obtained from
Radiation/Nuclear authorities or IAEA
4. Data on diseases or chemical and biological 54,6%
incidents obtained from industrial, health and
environmental databases (outbreak - spreading of
certain diseases in certain regions, presence of
certain diseases close to the chemical facility, etc.)
5. Data on the travelling of suspects obtained from 47,7%
travel databases
the risk indicators within the third Category based on results from question 5.3
Order Subcategories of the third Category - Items, The sum of
documents, objects and other belongings the first two
detected on the person (radicalisation or values as a
criminal activity signs) percentage
1. IEDs, guns, military objects and other dangerous 77,8%

objects
2. Travel bags, suitcases, boxes and other related 68,9%
items
3. CBRN threat objects and items found on a 66,6%
person, in their luggage or car
4. Information and communication technologies – 60%
electronic devices
5. Travel and personal documents 55,6%
6. Belongings 46,7
7. Body accessories - glasses, earrings, rings, 44,5%
jewellery, caps, etc.
8. Objects from illegal trafficking like artefacts, 44,4
CITES species, drugs, etc.
9. Pills, medicines, drugs, first aid kit, etc. 37,8
the risk indicators within the fourth Category based on results from question 5.3
Order Subcategories of the fourth Category - Digital The sum of
indicators the first two
values as a
percentage
1. Videos containing terrorist propaganda and 64,4%
168
information on CBRN and explosive materials

2. Application or browser searches detected by 44,4%
operational covert activities
3. Applications detected by covert operational 42,2
activities in phones, computers and other
electronic devices utilised often by criminal
the risk indicators within the fifth Category based on results from question 5.3
Order Subcategories of the fifth Category - Body, The sum of
items or substances smell the first two
values as a
percentage
1. Objects, clothes and substances smell related to 60%
warfare or toxic industrial chemical agents
2. Items, clothes and substances smell related to 57,8%
explosives – chemical precursors
3. Body smell due to poor hygiene or sudden change 48,9%
of the body smell
4. Items smell after being in a long time closed in 44,4%
unventilated premises
5. Parfum containing non-alcoholic oil used in a 31,1%
specific context
the risk indicators within the sixth Category based on results from question 5.3
Order Subcategories of the sixth Category - Sound The sum of
the first two
values as a
percentage
1. Suspicious or abnormal sounds of explosive 56,8%
devices
2. Suspicious or abnormal sounds of CBRN 46,6%
dispersal devices
3. Other suspicious sounds 33,3%
the risk indicators within the seventh Category based on results from question 5.3
Order Subcategories of the seventh Category - The sum of
Appearance and physiological reactions the first two
values as a
percentage
169
1. Clothes/dressing in the actual weather, local, 60%

religious and cultural context and representing a
specific group
2. Signs of health problems caused by CBRN agents 53,3%
after contamination or exposure when
manipulating them
3. Body parts that raise the suspicion – intention to 48,9%
hide something or as a part of a ritual or sign of
affiliation to a group
4. Wounds, injuries, amputations, battle or martial 46,6%
arts signs, combat fatigue, loss of vision and
hearing etc.
5. Tattoos and other symbols - neo-nazist or ISIS 37,8%
tattoos, CBRN hazard tattoos, etc.
6. Body mutilation or modification - cosmetic 35,5%
surgery to some extreme forms of body
modification representing affiliation to a specific
group, beliefs or a ritual before an attack
7. Other physiological reactions 24,4%
the risk indicators within the eighth Category based on results from question 5.3
Order Subcategories of the eighth Category - The sum of
Behaviour and communication the first two
values as a
percentage
1. General travel and transportation behaviour 57,7%
before the attack
close to or at the beginning of the attack
(transportation and use of CBRN-E material),
during or after performing a criminal act
4. Travel arrangement -the way of booking the travel 48,9%
and hotel, means of payment, destinations – risk
countries, sudden change of destination, etc.
5. UAV – unmanned aerial vehicles, UGV – 48,9%
unmanned ground vehicles and UWV – unmanned
water vehicles, etc. using related behaviour
6. Vehicle driving-parking-related behaviour 44,4%
7. Communication and interaction with other people 40,9%
– using symbols/putting them on buildings,
infrastructure or various objects
8. Verbal cues and written text 38,6%
9. Affiliation to groups through specific approach - 28,9%
behavioural radicalisation sign
10. Infrastructure related behaviour 28%
170
11. Non-verbal cues 13,3%

12. Paralinguistic cues 8,8%
the risk indicators within the ninth Category based on results from question 5.3
Order Subcategories of the ninth Category - Insider The sum of
threat risk indicators in connection to facilities the first two
or transportation dealing with CBRN and values as a
explosive materials percentage
1. Extensive monitoring of facility procedures or 51,1%
transportation vehicles and gathering needed
information or tools from inside
2. Change in professional behaviour 35,6%
3. Change in personal life 26,7%
171
APPENDIX D – Survey Chi-square test results
Testing all responses to questions 5.2 and 5.3 with a Chi-Square test of independence
according to the age group of respondents.
The aim was to investigate the potential correlation between respondents' age groups and
their responses pertaining to the relevance and observability of risk indicators. In order to
assess this matter, the chi-square test of independence was employed. It was applied to the
cumulative data derived from respondents' answers for both question 5.2 and question 5.3.
The hypotheses were set up as follows:
H0: There is no relation between age group and decision-making.
H1: There is a relation between age group and decision-making.
The alpha significance level employed for the testing was set at 0.05. The statistical
assessment was determined based on 16 degrees of freedom, resulting in a critical value of
26.2962276 for the rejection of the null hypothesis. The test results may be reviewed in the
accompanying tables provided below.
Tables of chi-square test of independence, for question 5.2

Table 4.1 Actual answers to question 5.2, sorted by age groups of respondents
Table 4.2 Expected answers to question 5.2, sorted by age groups of respondents
Table 4.3 Results of chi-square test of independence, for question 5.2
172
The chi-square test statistic is 139.951078, indicating rejection of the null hypothesis, H0,
in favour of the alternative hypothesis, H1. Thus, inferring that there exists a correlation
between the age group and their decision-making concerning question 5.2.
Tables of chi-square test of independence, for question 5.3

Table 4.4 Actual answers to question 5.3, sorted by age groups of respondents
Table 4.5 Expected answers to question 5.3, sorted by age groups of respondents
The chi-square test value of 129.021013 clearly indicates that it is possible to reject the
null hypothesis and accept the alternative hypothesis H1, which posits a significant
association between age group and decision-making for question 5.3.
The aforementioned outcomes can be validated through examination of the average value
of response per age group, as depicted in the graph and table underneath:
Graph 4.1 The average value of relevancy/observability of risk indicator per age group
173
Table 4.7 Discrepancy between younger and older law enforcement and intelligence
agencies´ officers
The above chart and table indicate a discrepancy between younger and older law
enforcement and intelligence agencies´ officers. The younger individuals tend to view risk
indicators as less significant and more challenging to detect, while their older counterparts
tend to view them in the opposite manner. Furthermore, professionals over the age of 55
attach more importance to risk indicators than their younger peers do.
Testing all responses to questions 5.2 and 5.3 with a Chi-Square test of independence
according to the work experience of respondents.
The same method used in the previous question was utilized. The hypotheses were
formulated as follows:
H0: There is no relation between the work experience of respondents and decision-
making.
H1: There is a relation between the work experience of respondents and decision-
making.
Similar alpha value of 0.05 was utilized and had 16 degrees of freedom for the testing as
in previous assessments, resulting in a critical value of 26.2962276 for the null hypothesis
rejection. The outcomes of the test are available in the tables included below.
Table 4.8 Actual answers to question 5.2, sorted by work experience of respondents
174
Table 4.9 Expected answers to question 5.2, sorted by work experience of

respondents
Based on the data, it can be observed that the chi-square test value is 149.308884, leading
to the rejection of hypothesis H0 and the acceptance of hypothesis H1. This means that
there is a strong link between the work experience of participants and their decision-making
ability regarding question 5.2.
Table 4.11 Actual answers to question 5.3, sorted by work experience of respondents
Table 4.12 Expected answers to question 5.3, sorted by work experience of

respondents
Based on the outcome illustrated, we nullify the H0 hypothesis and validate the H1
hypothesis, indicating that there exists a connection between the decision-making process
175
for question 5.3 and the work experience of participants, as evidenced by the chi-square
test score of 125.232217. To affirm these findings, we can refer to the table and chart
provided below, displaying the average value response per work experience group.
Graph 4.2 Average value of relevancy/observability of risk indicator per age group
Table 4.14 The average value of relevancy/observability of risk indicator per age
group in the table
The data featured in the graphs and tables reveals a notable discrepancy in the viewpoints
of those with varying levels of expertise. Those with shorter professional experience
display a tendency to regard risk indicators as less noteworthy and challenging to detect,
while their more seasoned colleagues adhere to the opposite conviction. Moreover, a
significant disparity emerges between the 0-5-year experience group and the other cohorts,
notwithstanding their corresponding averages.
176
APPENDIX E – The final list of risk indicators distributed across 9

categories
This appendix is intended solely for the law enforcement and intelligence agencies and
archives of the ISEM Institute and the University of Essex. Hence, the comprehensive list
of risk indicators is not included in this publication accessible to the public. In the event
that you are a representative of a law enforcement or intelligence agency and desire to
acquire the definitive detailed list, kindly send a formal request from an official
governmental email to kolencik@isemi.sk.
H.1 The final list of risk indicators distributed across 9 categories and prioritised
according to relevancy and reliability as the output from the research (subcategories
average – new prioritised order)
Category 1. Digital indicators

Subcategory 1.1 Videos containing terrorist propaganda and information on
CBRN and explosive materials
Risk indicators
Subcategory 1.2 Application or browser searches detected by operational covert

activities
Risk Indicators
Subcategory 1.3 Applications detected by covert operational activities in phones,

computers and other electronic devices utilised often by criminal
Risk Indicators
Category 2. Technological Detection/Air sampling alarm risk indicators

Subcategory 2.1 Explosive detection technology alarm indicating the presence of
the explosives or precursors on the person or their belongings (must
be verified by confirmatory analysis/screening)
Risk Indicators
177
Subcategory 2.2 Radiation detector alarm confirming the presence of the nuclear
and other radioactive materials on the person or their belongings,
eventually inside the body of the person
Risk Indicators
Subcategory 2.3 Chemical detector alarm indicating the presence of the chemical
hazard on the person or their belongings (must be verified by
Risk Indicators
Subcategory 2.4 Biological detection technology alarm indicating the presence of

the biological hazard on the person or their belongings (must be
verified by confirmatory analysis)
Risk Indicators
Subcategory 2.5 Non-ionizing Radiation Scanning Equipment alarm showing the

presence of a forbidden metal item
Risk Indicators
Subcategory 2.6 Radio Frequency (RF) based Drone Detection System alarm
indicating the drone threat in combination with the observation of
a person manipulating the Remote-Control device
Subcategory 2.7 Ionizing Radiation Scanning Equipment alarm showing the
presence of a forbidden item
Risk Indicators
Category 3. Specific indicators of previous radicalisation, suspicious or

criminal activities obtained from Data mining
Subcategory 3.1 Data on monitored suspects obtained from other sources, e.g.,
Darkweb, Websites and social media analytical tools, CCTVs
analytical tools, Operational activities of Law enforcement and
Risk Indicators
Subcategory 3.2 Data on wanted terrorists/criminals obtained from international

or EU organisations/bodies, e.g., Advance information – Terrorist
watch list, Interpol Red Notices, Stolen Administrative Documents
178
database, (SAD), Europol CBRN incident database and European

Bomb Data System (EPE/EBDS), Europol information system, etc.
Subcategory 3.3 Data on incidents with nuclear and other radioactive materials
obtained from Radiation/Nuclear authorities or IAEA
Risk Indicators
Subcategory 3.4 Data on diseases or chemical and biological incidents obtained

from industrial, health and environmental databases (outbreak -
spreading of certain diseases in certain regions, presence of certain
diseases close to the chemical facility, etc.)
Risk Indicators
Subcategory 3.5 Data on the travelling of suspects obtained from travel databases
Risk Indicators
Category 4. Sound
Subcategory 4.1 Suspicious or abnormal sounds of CBRN dispersal devices
Risk Indicators
Subcategory 4.2 Suspicious or abnormal sounds of explosive devices

Risk Indicators
Subcategory 4.3 Other suspicious sounds

Risk Indicators
Category 5. Behaviour and communication

5.1 CBRN and explosive threat-related behaviour close to or at the
Subcategory beginning of the attack (transportation and use of CBRN-E
material), during or after performing a criminal act
Risk Indicators
179
180
Subcategory 5.2 CBRN and explosive threat-related behaviour before the attack
Risk Indicators
5.2.1 Target Place and CBRN agent selection
5.2.2 Looking for and contacting experts in the CBRN field

5.2.3 Procuring, developing or attempting to acquire CBRN and explosive
material, e.g., buying legally or illegally, taking from nature or from illegally
dumped waste stealing from specific premises, transportation vehicles, storages,
industrial and medical facilities, laboratories, landfill for hazardous waste or
production of CBRN and explosive material:
5.2.4 Procuring, developing or attempt to acquire laboratory items,

weaponization tools, storage items, transportation and delivery/dispersion
mechanism
5.3.5 Weaponizing and storage of CBRN Material
5.2.6 Behaviour Related to Training
181
Subcategory 5.3 Affiliation to groups through specific approach - behavioural

radicalisation sign
Risk Indicators
Subcategory 5.4 UAV -unmanned aerial vehicles, UGV – unmanned ground

vehicles and UWV – unmanned water vehicles, etc. using related
behaviour
Risk Indicators
Subcategory 5.5 Travel arrangement -the way of booking the travel and hotel,
means of payment, destinations – risk countries, sudden change of
destination, etc.
Risk Indicators
Subcategory 5.6 Vehicle driving-parking-related behaviour

Risk Indicators
Subcategory 5.7 General travel and transportation behaviour

Risk Indicators
182
Subcategory 5.8 Communication and interaction with other people – using

symbols/putting them on buildings, infrastructure or various
objects
Risk Indicators
Subcategory 5.9 Verbal cues and written text

Risk Indicators
Subcategory 5.10 Infrastructure related-behaviour

Risk Indicators
Subcategory 5.11 Non-verbal cues

Risk Indicators
Subcategory 5.12 Paralinguistic cue

Risk Indicators
183
Category 6. Insider threat risk indicators in connection to facilities or

transportation dealing with CBRN and explosive materials
Subcategory 6.1 Extensive monitoring of facility procedures or transportation
vehicles and gathering needed information or tools from inside
Risk Indicators
Subcategory 6.2 Change in professional behaviour

Risk Indicators
Subcategory 6.3 Change in his personal life

Risk Indicators
Category 7. Items, documents, objects and other belongings detected on the

person (radicalisation or criminal activity signs)
Subcategory 7.1 IEDs, guns, military objects and other dangerous objects
184
Risk Indicators
Subcategory 7.2 Information and communication technologies – electronic

devices
Risk Indicators
Subcategory 7.3 CBRN threat objects and items found on a person, in their
luggage or car
Risk Indicators
Subcategory 7.4 Objects from illegal trafficking like artefacts, CITES species,
drugs, etc.
Subcategory 7.5 Travel and personal documents
Risk Indicators
Subcategory 7.6 Travel bags, suitcases, boxes and other related items
Risk Indicators
Subcategory 7.7 Pills, medicines, drugs, first aid kit, etc.

Risk Indicators
Subcategory 7.8 Belongings

Risk Indicators
185
Subcategory 7.9 Body accessories - glasses, earrings, rings, jewellery, caps, etc.
Risk Indicators
Category 8. Items, clothes and substances smell

Subcategory 8.1 Items, clothes and substances smell related to explosives –
chemical precursors
Risk Indicators
Subcategory 8.2 Objects, clothes and substances smell related to warfare or toxic
industrial chemical agents
Risk Indicators
Subcategory 8.3 Items smell after being a long time closed in unventilated
premises
Subcategory 8.4 Body smell due to poor hygiene or sudden change of the body
smell
Subcategory 8.5 Parfum containing non-alcoholic oil used in a specific context
Category 9. Appearance and physiological reactions
Subcategory 9.1 Signs of health problems caused by CBRN agents after
contamination or exposure when manipulating them
Risk Indicators
186
Subcategory 9.2 Other physiological reactions

Risk Indicators
Subcategory 9.3 Body parts that raise the suspicion – intention to hide something
or as a part of a ritual or sign of affiliation to a group
Risk Indicators
Subcategory 9.4 Clothes/dressing in the actual weather, local, religious and

cultural context and representing a specific group
Risk Indicators
Subcategory 9.5 Tattoos and other symbols - neo-nazist or ISIS tattoos, CBRN
hazard tattoos, etc.
Subcategory 9.6 Wounds, injuries, amputations, battle or martial arts signs,
combat fatigue, loss of vision and hearing etc.
Subcategory 9.7 Body mutilation or modification - cosmetic surgery to some
extreme forms of body modification representing affiliation to a
specific group, beliefs or a ritual before an attack
H.2 The final list of risk indicators distributed across 9 categories and prioritised
according to detectability/observability
187
APPENDIX F – Support letters from Law Enforcement and Intelligence

agencies
This appendix is intended solely for the law enforcement and intelligence agencies and
archives of the ISEM Institute and the University of Essex. It is not available to the public.
188
View publication stats

Public CBRN-E Behaviour Obs Analysis ISEMI 2

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Public CBRN-E Behaviour Obs Analysis ISEMI 2

Uploaded by

Copyright:

Available Formats

See discussions, stats, and author profiles for this publication at: https://www.researchgate.

A critical evaluation of the risk indicators of criminal conduct involving CBRN

Preprint · October 2023

The user has requested enhancement of the downloaded file.

Public version N.2 (Updated - February 2024)

Dr Marián Kolenčík, Ph.D.

4.2 Survey Results .................................................................................................................... 49

Predictive profiling, Profiling in protective security and Covert operations

Observational analysis, a crucial component of profiling in protective security and covert

Baseline concept and suspicious behaviour

Understanding behaviour considered suspicious requires an understanding of general

I. Constant BL can be defined as a common unchanging reference that has a long-term

III. Individual or group BL may be characterised as the normal behaviour of a specific

2. Social-economic context. Baseline Example: Well-dressed people in a central very

4. Buildings and infrastructure context. Baseline Example: Presence of CCTVs. People

5. Items-behaviour-related. Baseline Example: Using a backpack in a routing way like a

6. Meteorological seasons, dressing and appearance context. Baseline Example: Wearing

7. Physical and chemical manifestation of substances/objects. Baseline Example: Drink in

8. General behavioural aspects

Risk indicators, Warning signs or Alert triggers

1. LITERATURE REVIEW – THEORETICAL

2.1 Literature, case study and CCTV footages review

Conducting a systematic literature review requires a well-structured methodology to ensure

2.1.1 Search criteria in the systematic literature review

Systematic literature review methodology tables

Search criteria in the systematic literature review

Table 1.1 Keywords as search criteria

Insider threat indicators

Table 1.2 Key search digital repositories

Table 1.3 Main journals/Publishers

Journal of Peace Research

Table 1.4 Inclusion and Exclusion criteria of systematic literature review

2.1.2 Search criteria for case studies and CCTV records

Search criteria for case studies and CCTV records

The British Journal of Criminology

2.2 Survey methodology

2.2.2 Research hypothesis – quantitative method

H1.0: There is no relation between age group and decision-making.

The study employed Chi-Square tests of independence to analyze responses to questions

2.3 Trustworthiness of Data

The trustworthiness of data in a systematic literature review is an essential aspect of

2.4 Ethical issues

3. RESULTS FROM SYSTEMATIC LITERATURE, CASE

3.1 General findings

3.2 Results from behavioural science and CBRN-E terrorism-related systematic

Table 2.1 Systematic literature results tables

Alshaya, S. A., &

Boelaert, A., RooT37–CUTA’s 2021 Terrorist Risk No

the presence of – different

Jupe, L. M., St- communication: The

Fredholm, M. Lone actor terrorism 2016 CBRN-related Yes

Meijer, A., & Predictive policing: 2019 Predictive No

Parasuraman, R., Detecting threat- 2009 Threat detection No

Sferopoulos, R. A Review of 2009 Detection Yes

Spicer, B. Bomb threats and the 2020 Explosive Yes (only

US Joint First responders N.D. Indicators related Yes,

WILLIAMS, P., NUCLEAR 2002 Behaviour Yes

CASES SELECTED FOR CASE STUDY AND CCTV RECORDS REVIEW

4. RESULTS FROM SURVEY

4.1 Implementation of the survey

Graph 1 – Participants per country or EU agencies

Graph 2 – Sex of respondents

Male Female Not stated